CompTIA Updated 220-1202 Exam Questions and Answers by andrew

The correct answer is D. Smishing, which is a form of phishing attack conducted via SMS text messages. The key indicators in this scenario are the unexpected text message and the embedded link prompting the user to reset a password. These attacks rely on urgency and fear to trick users into clicking malicious links or providing credentials.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, smishing attacks often impersonate legitimate organizations such as banks, IT departments, or service providers. The attacker claims that an account action is required, such as resetting an expired password, to prompt immediate user response.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that smishing is distinct from other phishing variants based on delivery method. Vishing uses voice calls, spear phishing targets specific individuals via email, and whaling targets high-level executives. Since this attack is delivered via text message, it is classified as smishing.

The Mike Meyers / Mark Soper Lab Manual reinforces that modern attackers increasingly use SMS because users often trust text messages more than emails. This makes smishing a highly effective and common attack vector.

Because the attack uses SMS with a malicious link, smishing is the correct answer.

The correct answer is A. DLP (Data Loss Prevention), because DLP solutions are specifically designed to detect, monitor, and prevent unauthorized transmission of sensitive data outside an organization. Information exfiltration occurs when confidential data is improperly transferred, leaked, or stolen, either intentionally or accidentally.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, DLP technologies enforce policies that restrict how data can be shared via email, cloud services, removable media, or network transfers. DLP systems can block, quarantine, or alert administrators when sensitive data patterns—such as credit card numbers or personal identifiers—are detected leaving the organization.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that DLP focuses on data protection, not user authentication or device management. While IAM controls access to resources and MDM manages mobile devices, neither directly prevents data from being exfiltrated once access is granted.

The Mike Meyers / Mark Soper Lab Manual reinforces that SAML is an authentication framework and does not monitor data movement.

Because the question specifically addresses information exfiltration, the security control designed to prevent it is Data Loss Prevention, making A the correct answer.

Extra icons in the system tray after an update often indicate new background apps loading at startup, increasing boot time. The Mike Meyers Lab Manual explains that “autostarting programs will slow down your system,” and Windows provides control through Task Manager’s Startup tab to enable/disable startup programs—specifically calling this out as useful “especially if Windows is slow to load.” The All-in-One Exam Guide gives the same practical step: open Task Manager’s Startup tab and “review the enabled applications for any you don’t need,” then disable unnecessary ones to regain speed.

Importantly, the All-in-One answer guidance explicitly notes that disabling unnecessary startup programs is the least disruptive first action: “Andre’s best option would be to disable unnecessary startup programs… A system restore might help… but it’ll be much slower and more disruptive.”

Uninstalling the update or restoring the system are more disruptive and should come later if simpler optimization fails. Antivirus scanning can be appropriate if no obvious cause exists, but the clear clue here is new startup items (system tray icons).

This scenario is phishing delivered through a QR code (scan an image to reach a portal), which is best described as quishing . Quentin Docter defines phishing as a social engineering method where the attacker makes a message look legitimate and convinces the user to click a link to “correct” an account problem; after the click, the victim is taken to a site controlled by the attacker and asked for credentials. A QR code in a message is simply an alternate way to deliver that same malicious “link” without showing the URL clearly.

The Mike Meyers Lab Manual distinguishes related social engineering types: vishing is done by phone calls, and whaling targets high-level executives. Smishing is phishing delivered via SMS text messages, but the prompt specifically centers on scanning an image (QR-style workflow), not a text-message attack vector.

Docter also notes QR codes are commonly used in authentication workflows (for example, adding accounts to authenticator apps), which is why attackers mimic this behavior to make the scam seem normal. Therefore, QR-based phishing is best labeled quishing .