220-1102 Question 425
Select 2User education regarding common threatsA help desk technician is asked to deliver a short user-awareness session after several employees reported pop-up messages claiming their computers are infected and instructing them to call a phone number immediately. One employee then installed a remote-access tool after speaking with the caller, and another entered company credentials into a fake Microsoft 365 sign-in page linked from an email. Which TWO training points should the technician emphasize to best reduce the likelihood of these incidents happening again?
- A
Users should close unexpected security pop-ups without calling the displayed number and report the incident through the company’s official support process.
- B
Users should trust sign-in pages if the logo and color scheme match a well-known vendor, because attackers usually cannot copy branding accurately.
- C
Users should verify links and sender details before signing in, and navigate to cloud services using known bookmarks or manually typed URLs when possible.
- D
Users should allow remote access to any technician who claims to be from a software vendor if the vendor name is familiar.
- E
Users should provide credentials only after a caller confirms the device serial number, since that is sufficient proof that the caller is legitimate.
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are the training points that directly address the two threats described: tech support scams and credential phishing. In A+ Core 2, user education is a key administrative control for reducing social engineering risk. Employees should be taught to avoid interacting with scareware-style pop-ups, to distrust unsolicited support requests, and to verify links, senders, and URLs before entering credentials. These practices align with widely accepted security awareness guidance from organizations such as CISA and NIST, which recommend using trusted contact methods, recognizing phishing indicators, and reporting suspicious messages promptly. The scenario tests practical application of user education to prevent common threats rather than recall of definitions alone.
- A. Correct.
Correct. This addresses a common tech support scam pattern: alarming pop-ups that pressure users to call a fake support number. User education should stress that legitimate security alerts from the operating system or browser do not require calling an unsolicited phone number on a pop-up. Best practice is to close the window if possible, disconnect from the network if needed, and contact the organization through an approved internal support channel.
- B. Incorrect.
Incorrect. Attackers frequently copy logos, branding, and page layouts very convincingly. Visual appearance alone is not a trustworthy indicator of legitimacy. This option reflects a common misconception that phishing pages are easy to spot by poor design, when many modern phishing kits closely imitate real sign-in portals.
- C. Correct.
Correct. This is a core anti-phishing practice. Users should inspect sender addresses carefully, hover over or otherwise verify links before clicking, and use trusted bookmarks or manually entered URLs for services such as Microsoft 365. This reduces the chance of credential theft through look-alike domains and malicious email links.
- D. Incorrect.
Incorrect. Legitimate vendors generally do not initiate unsolicited support calls asking for remote access. Training users to grant access based on familiarity with a vendor name would increase risk. This option reflects the misunderstanding that caller claims alone are enough to establish trust.
- E. Incorrect.
Incorrect. A device serial number is not strong proof of identity and may be visible on the device, in emails, asset tags, or previous documentation. Users should never treat a small piece of device information as sufficient verification before sharing credentials. Proper verification should occur through established company procedures and approved support channels.