220-1102 Question 553
Single answer2.11 Given a scenario, configure relevant security settings in a browser.A technician is configuring a web browser for employees who frequently access internal HR and payroll sites. Management wants to reduce the risk of malicious pop-ups, tracking, and unauthorized storage of sensitive session data on shared workstations, but users must still be able to sign in to legitimate company websites. Which browser setting should the technician configure FIRST to best meet this requirement?
- A
Enable private/incognito browsing mode for all sessions
- B
Block third-party cookies in the browser
- C
Disable JavaScript for all websites
- D
Clear the browser cache once per month
Show answer and explanation
Correct answer: B
Explanation
The best answer is to block third-party cookies. In a real business environment, technicians must balance usability and security. Third-party cookies are commonly used for cross-site tracking and advertising and are not usually required for core login functionality on legitimate sites. Blocking them helps reduce tracking exposure while preserving most first-party sign-in behavior. Private browsing can help limit what is retained after a session, but it does not stop tracking during the session and is not the most direct security/privacy control for this scenario. Disabling JavaScript globally is overly disruptive, and infrequent cache clearing does not meaningfully protect shared workstation sessions. This aligns with modern browser security guidance from vendors such as Microsoft, Google, and Mozilla, which provide controls for blocking third-party cookies and managing site privacy without disabling core web functionality.
- A. Incorrect.
Enabling private/incognito mode can reduce local storage of browsing history, cookies, and form data after the session ends, but it is not typically a browser security setting that can be relied on by itself to prevent tracking or malicious pop-ups. It also does not inherently block third-party tracking during the active session. This is a plausible choice because it helps on shared systems, but it does not best address the full requirement.
- B. Correct.
Blocking third-party cookies is the best first step because it directly reduces cross-site tracking while still allowing most legitimate first-party authentication cookies needed for users to sign in to company websites. This aligns with common browser privacy and security best practices and is a realistic setting technicians configure to limit tracking without breaking normal access to trusted internal or external business sites.
- C. Incorrect.
Disabling JavaScript for all websites is too restrictive for a business environment. Many HR, payroll, and SSO sign-in pages require JavaScript to function correctly. While JavaScript can be abused by malicious sites, disabling it globally would likely break legitimate business applications and is not the best practical first choice.
- D. Incorrect.
Clearing the browser cache once per month does not adequately protect sensitive session data on shared workstations. Cache cleanup may remove some stored web content, but cookies and active session risks are separate concerns. In addition, once-per-month cleanup is far too infrequent for shared systems handling sensitive access.