220-1102 Question 262
Single answertopA technician is preparing a Windows 11 laptop for a traveling employee who frequently uses public Wi-Fi. Company policy requires reducing the risk of unauthorized inbound connections when the device is off the corporate network, while still allowing the employee to browse the web and use a VPN client. Which action should the technician take FIRST to best meet this requirement?
- A
Set the active network profile to Public in Windows Defender Firewall settings
- B
Disable Windows Defender Firewall to prevent conflicts with the VPN client
- C
Configure the network connection as Metered to limit background activity
- D
Join the laptop to a workgroup instead of a domain
- E
Disable Network Discovery only
Show answer and explanation
Correct answer: A
Explanation
For A+ Core 2, technicians are expected to understand how Windows network profiles affect local security posture. On untrusted networks, the Public profile is the recommended choice because it uses more restrictive settings for sharing and inbound connectivity than Private or Domain profiles. This supports the requirement to reduce unauthorized inbound access while preserving normal outbound use, including web traffic and VPN connectivity. Microsoft documentation for Windows networking and Windows Defender Firewall describes Public networks as appropriate for places such as airports and cafes, where the device should not be discoverable and should use stricter protections.
- A. Correct.
Correct. Setting the network profile to Public is the best first step on untrusted networks such as hotel, airport, or coffee shop Wi-Fi. In Windows, the Public profile applies more restrictive firewall and sharing settings by default, reducing exposure to unsolicited inbound traffic while still allowing normal outbound access such as web browsing and VPN connections. This aligns with standard endpoint-hardening practices for devices used on unsecured networks.
- B. Incorrect.
Incorrect. Disabling Windows Defender Firewall weakens host-based protection and increases the risk of unauthorized inbound connections. VPN clients are generally designed to function with the firewall enabled, and if a specific exception is needed, it should be configured explicitly rather than turning the firewall off entirely. This option reflects a common but unsafe troubleshooting mistake.
- C. Incorrect.
Incorrect. A Metered connection can reduce data usage and background downloads, but it is not primarily a security control for blocking inbound connections. It may help with bandwidth management, but it does not address the main requirement of reducing attack surface on public Wi-Fi.
- D. Incorrect.
Incorrect. Whether the laptop is joined to a workgroup or domain does not directly determine how exposed it is to inbound traffic on public Wi-Fi. Domain membership affects centralized management and authentication, not the immediate firewall posture required in this scenario.
- E. Incorrect.
Incorrect. Disabling Network Discovery can reduce visibility to other devices, but by itself it does not provide the broader protection achieved by using the Public profile in Windows Defender Firewall. The Public profile typically incorporates multiple restrictive settings, including tighter sharing and firewall behavior, making it the more complete first action.