220-1102 Question 664
Single answerExternal/third-partyA small accounting firm uses a third-party remote support tool so an external MSP can assist users after hours. The office manager reports that several employees received pop-up prompts asking them to approve incoming remote-control sessions they did not request. The technician confirms the prompts are coming from the installed third-party remote access application, and there is no approved maintenance window. What should the technician do FIRST to follow security best practices while reducing immediate risk?
- A
Disable or stop the third-party remote access service and verify with the MSP whether the connection attempts are authorized
- B
Instruct users to click Allow so the MSP can investigate whether the prompts are legitimate
- C
Uninstall the local antivirus because it may be interfering with the remote support tool
- D
Open additional inbound firewall ports to ensure the third-party tool can complete its handshake properly
Show answer and explanation
Correct answer: A
Explanation
This question focuses on handling external or third-party remote access tools in a real support environment. On A+ Core 2, candidates are expected to apply security best practices to practical situations involving vendors, remote support software, and suspicious activity. The best first step is containment: disable the remote access service or otherwise prevent further connection attempts, then confirm authorization with the MSP through a trusted process. This approach reflects standard incident-response methodology, especially the containment phase, and follows the principle of least privilege by not permitting external access until it is verified. Best practices from security guidance such as NIST incident handling recommendations emphasize validating unexpected remote activity, limiting exposure, and using approved change windows and communication channels when third parties are involved.
- A. Correct.
Correct. When unexpected remote-control prompts appear, the immediate priority is to contain potential unauthorized access. Disabling or stopping the third-party remote access service reduces the attack surface and prevents further session attempts while the technician validates whether the activity is legitimate. This aligns with incident-response best practices: contain first, then verify and remediate.
- B. Incorrect.
Incorrect. Allowing an unverified remote session could grant an attacker interactive access to endpoints and sensitive accounting data. Even if the MSP normally uses the tool, the requests are unexpected and outside an approved maintenance window, so user approval should not be given until the activity is validated through an approved channel.
- C. Incorrect.
Incorrect. Antivirus software is not the likely cause of unauthorized session prompts, and removing endpoint protection would increase risk. This option reflects a common but unsafe troubleshooting mistake: disabling security controls before confirming the root cause.
- D. Incorrect.
Incorrect. Opening more inbound firewall ports would increase exposure and does not address the main issue, which is unverified external access attempts. Many legitimate third-party remote support tools use outbound connections or brokered sessions, so adding inbound rules is both unnecessary in this scenario and potentially harmful.