220-1102 Question 190
Single answerFile typesA user calls the help desk because a file named budget_report.pdf.exe was emailed to several employees and appears on a shared drive. On the affected Windows PCs, the file displays with a PDF icon because known file extensions are hidden. The user says, "It looks like a PDF, but when I double-click it, a warning appears and antivirus blocks it." What should the technician identify this file as?
- A
A normal PDF document with a damaged file association
- B
A Windows executable that is disguised to look like a PDF
- C
A compressed archive that requires a PDF reader plug-in
- D
A temporary file created by Microsoft Edge during download
Show answer and explanation
Correct answer: B
Explanation
In Windows, the last file extension is the one that determines the file type, so budget_report.pdf.exe is an executable, not a PDF. Hiding known file extensions can make a malicious file appear to be budget_report.pdf, which is why showing file extensions is a common security best practice. This scenario reflects a common social engineering and malware tactic covered in A+ Core 2: recognizing suspicious file types and misleading extensions. Microsoft documentation and standard Windows administration guidance emphasize that executable files such as .exe can run code, while document files such as .pdf are opened by associated applications rather than executed directly. A technician should identify the file as a disguised executable, warn users not to open it, and follow organizational malware response procedures.
- A. Incorrect.
Incorrect. A damaged file association can cause the wrong app to open a file, but it does not change the actual file type. The filename ends with .exe, which indicates an executable in Windows. The presence of a PDF icon and hidden extensions can mislead users, but the extension determines how Windows identifies the file type.
- B. Correct.
Correct. The final extension is .exe, so this is a Windows executable. Attackers commonly use double extensions such as .pdf.exe to trick users into thinking the file is a harmless document, especially when Windows is configured to hide known file extensions. This is a realistic malware delivery technique and should be treated as suspicious and blocked.
- C. Incorrect.
Incorrect. A compressed archive would typically use extensions such as .zip or .7z, not .exe. Self-extracting archives can use .exe, but in this scenario the file is specifically being disguised as a PDF to deceive the user, which is the more accurate identification. The PDF icon does not make it a document or archive.
- D. Incorrect.
Incorrect. Temporary browser download files use different naming and extension patterns, and they are not typically presented to users as finished documents on a shared drive. The key detail here is the double extension ending in .exe, which identifies it as an executable file rather than a temporary download artifact.