Module 4: Security & Account Management

1. Multiple Choice:
Which of the following is malware that encrypts files and demands payment for decryption?
A) Virus
B) Spyware
C) Ransomware
D) Trojan

Phishing attacks often use urgent requests or suspicious links to trick users.

Which of the following is a strong password practice?
A) Use the same password for multiple accounts
B) Use short, easy-to-remember words
C) Use unique passwords with numbers, letters, and symbols
D) Share your password with trusted coworkers

You receive an email from someone claiming to be IT support asking for your password to “fix an urgent issue.” What should you do?
A) Reply with your password immediately
B) Delete the email and report it as phishing
C) Click the link in the email to see what happens
D) Forward it to all colleagues

Which social engineering technique involves following someone into a secure area without authorization?
A) Baiting
B) Pretexting
C) Tailgating
D) Phishing

6. Multiple Choice:
Active Directory is used to:
A) Manage user accounts, groups, and resources in a network
B) Update antivirus software
C) Monitor internet speed
D) Encrypt files

Groups in Active Directory simplify permission management for multiple users.

Which principle ensures users only have access to what they need to perform their job?
A) Principle of least privilege
B) Principle of maximum access
C) Principle of universal access
D) Principle of shared passwords

9. Scenario-Based:**
A new employee joins the Sales team. Which steps should a technician take in Active Directory?
A) Create a user account, assign them to the Sales group, apply correct permissions
B) Give them full admin rights immediately
C) Let them share another employee’s account
D) Do nothing; wait for the employee to ask

10. Multiple Choice:
Which backup type copies all data every time a backup is made?
A) Incremental
B) Differential
C) Full
D) Snapshot

Incremental backups only store changes since the last backup.

A user accidentally deleted important files. Which steps should a technician take?
A) Restore from the most recent backup to the original or alternate location
B) Reinstall Windows
C) Tell the user the files are lost forever
D) Format the drive immediately

Why is it important to test backups regularly?
A) To ensure backup processes work and data can be restored
B) To increase network speed
C) To monitor employee activity
D) To update antivirus software

14. Multiple Choice:
What is the correct sequence of steps in incident response?
A) Review → Contain → Identify → Eradicate → Recover
B) Identify → Contain → Eradicate → Recover → Review
C) Contain → Eradicate → Recover → Identify → Review
D) Eradicate → Identify → Contain → Review → Recover

Technicians should escalate a security incident if it is beyond their expertise

A ransomware infection affects multiple computers in the office. What should a technician do first?
A) Identify and contain the infection, then escalate to security team
B) Reinstall Windows on all computers immediately
C) Delete all files on infected machines
D) Ignore the issue and continue working

Which of the following is important for documentation during a security incident?
A) Actions taken, affected systems, and outcomes
B) Personal opinions about the user
C) Only the time you started working
D) Irrelevant emails

During a simulated phishing test, a technician identifies a suspicious email. What hands-on actions should they take?
A) Flag it, educate the user, and secure accounts if necessary
B) Delete the email and ignore it
C) Reply to the sender to ask if it is real
D) Forward it to all users

Which of the following is a sign of malware infection?
A) Pop-ups and unknown processes
B) Slow system performance
C) Unexpected network activity
D) All of the above

A user forgot their password for a business account. What is the proper procedure?
A) Reset the password following company policies and enable MFA if required,,
B) Ask the user to guess until they succeed
C) Give them another user’s password
D) Ignore the request