220-1202 Practice Test 11 — 15 Questions

Question 1

A company uses a Remote Desktop Gateway to allow employees to access internal desktops from the internet. Users report that they can connect to the gateway but cannot see any available desktops in the list. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The users are not members of the correct Active Directory group that is allowed to access specific desktops.. The Remote Desktop Gateway (RD Gateway) acts as a proxy, allowing external RDP connections to internal desktops. When users can connect to the gateway itself but see no desktops, it typically indicates an authorization failure: the RD Gateway uses Resource Authorization Policies (RAPs) to control which desktops a user can access. If the user is not a member of the Active Directory group specified in the RAP, the gateway will deny the list of available desktops, even though the gateway connection succeeds.

Answer

The Remote Desktop Gateway service is not running on the server.

Answer

The desktops are powered off or disconnected from the network.

Answer

The user's RDP client is outdated and cannot display the list.

Question 2

A security incident occurred on a Windows 10 workstation where an attacker gained administrative access and created several hidden user accounts. You need to ensure no unauthorized accounts exist and that the built-in Administrator account is disabled. Which two tools can you use from the command line to list all user accounts and check the status of the Administrator account?

Accepted Answer

Use 'net user' to list accounts and 'net user Administrator | findstr /i active' to check status.. The 'net user' command lists all local user accounts on a Windows system, which is necessary to identify hidden or unauthorized accounts. Piping 'net user Administrator' through 'findstr /i active' filters the output to show whether the built-in Administrator account is enabled or disabled, as the status line contains 'Active' or 'Account active' depending on the locale. This combination directly fulfills the requirement to list all accounts and check the Administrator account's status from the command line.

Answer

Use 'whoami' to list current user and 'net localgroup Administrators' to see group members.

Answer

Use 'dir C:\Users' to list user profile folders and 'net accounts' to see password policies.

Answer

Use 'gpresult /R' to list applied policies and 'net start' to see running services.

Question 3

A security incident response team needs to find all files in /var/www that have the SUID bit set, which may indicate a privilege escalation risk. Which command should they use?

Accepted Answer

find /var/www -type f -perm /4000. The `find` command with `-perm /4000` matches any file that has the SUID bit set (the 4000 octal permission), regardless of other permission bits. The `/` prefix tells `find` to match if any of the specified permission bits are set, which is the precise way to locate files with the SUID bit enabled. This command will recursively search `/var/www` for regular files (`-type f`) with the SUID bit, helping identify potential privilege escalation risks.

Answer

find /var/www -type f -perm 4000

Answer

ls -la /var/www | grep '^...s'

Answer

chmod -R u+s /var/www

Question 4

A small business deploys 20 Android tablets for inventory management. The tablets must remain in a single app (the inventory app) and prevent users from accessing settings or other apps. Which Android feature should you enable to lock the devices into this single-app mode?

Accepted Answer

Use the Screen Pinning feature in Security settings.. Screen Pinning (option B) is the correct Android feature to lock a device into a single app. When enabled, it prevents users from leaving the pinned app, accessing the home screen, recent apps, or notification shade without entering a PIN or password. This is ideal for kiosk-mode deployments like inventory management tablets, as it restricts the device to exactly one application.

Answer

Enable Guest Mode from the user switcher.

Answer

Set up a separate user account with restricted profile.

Answer

Activate Factory Reset Protection (FRP).

Question 5

A technician is troubleshooting a VM that fails to boot with the error 'Operating system not found'. The VM was working yesterday. The technician checks the virtual machine settings and sees that the virtual hard disk is attached to the IDE controller. What should the technician do first?

Accepted Answer

Check the VM's boot order in the BIOS and ensure the virtual hard disk is first. The error 'Operating system not found' indicates that the VM is attempting to boot from a device that does not contain a bootable operating system. Since the VM was working yesterday, the most likely cause is that the boot order in the VM's BIOS has been changed or reset, causing it to try booting from a non-bootable device (e.g., network or CD-ROM) before the virtual hard disk. Checking and correcting the boot order in the BIOS to prioritize the virtual hard disk is the logical first step before making configuration changes.

Answer

Reattach the virtual hard disk to the SCSI controller

Answer

Increase the VM's memory allocation

Answer

Restore the VM from a recent snapshot

Question 6

A company's security policy requires that all laptops have a TPM chip enabled and be configured to require a PIN at startup before the operating system loads. Which security feature is being configured?

Accepted Answer

BitLocker with TPM and PIN protector. The scenario describes using a TPM chip and requiring a PIN at startup before the OS loads. This is exactly how BitLocker's TPM+PIN protector works: the TPM validates the system integrity, and the PIN provides an additional factor of authentication, unlocking the drive encryption key before Windows boots. Option B is correct because it directly matches the described configuration.

Answer

Secure Boot

Answer

Windows Defender System Guard

Answer

Group Policy password complexity enforcement

Question 7

A user reports that their Android phone will not connect to their corporate Wi-Fi network, but other devices connect fine. They have forgotten the network and re-entered the password, but it still fails. What should you check first?

Accepted Answer

Verify the Wi-Fi password is being entered correctly.. The most common cause of a single device failing to connect after forgetting and re-entering the network is a typo or case-sensitive error in the Wi-Fi password. Since other devices connect fine, the issue is isolated to the phone, and verifying the password is the quickest, least intrusive step before escalating to more complex troubleshooting.

Answer

Check if the router is using MAC address filtering.

Answer

Reset the phone's network settings to default.

Answer

Update the phone's operating system to the latest version.

Question 8

A customer reports that their old laptop, which they sold online, still contains personal files that the new owner accessed. The customer had only performed a 'Reset this PC' with the 'Remove everything' option. What should the technician recommend to prevent this in the future?

Accepted Answer

Use a third-party data wiping tool that overwrites the drive multiple times.. The 'Reset this PC' with 'Remove everything' option in Windows performs a quick format or a single-pass overwrite, which leaves data recoverable by file recovery tools. A third-party data wiping tool that overwrites the drive multiple times (e.g., using the DoD 5220.22-M standard) ensures that the data is irrecoverable by overwriting all sectors with patterns, preventing any future access.

Answer

Perform a factory reset from the recovery partition.

Answer

Remove the hard drive and physically destroy it.

Answer

Change the user password before selling.

Question 9

A technician is tasked with decommissioning a RAID array of SSDs that stored proprietary source code. The company policy requires that the drives be reused in another department. Which method ensures data is securely removed while preserving the SSDs?

Accepted Answer

Use the drive manufacturer's secure erase utility.. The drive manufacturer's secure erase utility (e.g., ATA Secure Erase) issues a hardware-level command that triggers the SSD's internal controller to cryptographically erase all data by resetting the encryption key, which is instantaneous and preserves the drive's health. This method is specifically designed for SSDs because traditional overwriting (like zero-filling) is ineffective on SSDs due to wear-leveling and garbage collection, which can leave data remnants in over-provisioned or reallocated sectors.

Answer

Run a full format on each SSD.

Answer

Degauss the SSDs.

Answer

Overwrite the drives with zeros three times.

Question 10

A security incident has occurred: a user's Mac running macOS Ventura was infected with malware that modified system files. The technician needs to boot the Mac into a mode that loads only essential Apple-signed kernel extensions and prevents third-party software from loading, in order to safely remove the malware. Which startup mode should they use?

Accepted Answer

Safe Mode (Shift key during startup).. Safe Mode (Shift key during startup) is correct because it forces macOS to load only essential kernel extensions that are signed by Apple, disables all third-party startup items and login items, and runs a directory integrity check. This minimal environment prevents the malware from loading its own kernel extensions or other malicious code, allowing the technician to safely remove the infected files without interference.

Answer

Single-user mode (Command + S).

Answer

Verbose mode (Command + V).

Answer

Target Disk Mode (T key).

Question 11

A user reports that they cannot connect to the company's internal file server from home using the provided VPN client. They can access the internet without issues. Which of the following is the most likely cause of this problem?

Accepted Answer

The VPN client is configured for split tunneling, and the file server's IP range is not in the allowed routes.. Split tunneling allows the VPN client to route only specific traffic (e.g., corporate subnets) through the encrypted tunnel, while all other traffic goes directly to the internet. If the file server's IP range is not included in the allowed routes, traffic to that server will bypass the VPN and be sent unencrypted to the user's local gateway, which cannot reach the internal server. This matches the symptom: internet works, but the file server is unreachable.

Answer

The user's home router is blocking VPN traffic on port 443.

Answer

The file server is powered off or experiencing a hardware failure.

Answer

The user's VPN client software is outdated and needs to be reinstalled.

Question 12

A small business wants to reduce its environmental footprint by properly managing old computer equipment. They ask which components must be handled separately due to hazardous materials. What should you identify?

Accepted Answer

CRT monitors. CRT monitors contain leaded glass in the cathode ray tube and significant amounts of lead in the solder and phosphor coating, making them hazardous electronic waste that must be handled separately under regulations like the EPA's RCRA and the EU's WEEE Directive. Unlike LCDs, which may contain mercury in backlights but are often managed differently, CRTs require specialized recycling to prevent lead leaching into groundwater.

Answer

LCD monitors

Answer

Keyboard and mouse

Answer

Ethernet cables

Question 13

A technician needs to configure a Windows 10 kiosk machine that runs a single full-screen application for public use. They want to prevent users from accessing the desktop, taskbar, or any other system functions. Which Settings page should they use to set up this restricted user experience?

Accepted Answer

Settings > Accounts > Other users > Set up a kiosk. The 'Set up a kiosk' option under Settings > Accounts > Other users is the dedicated Windows 10 feature for configuring an assigned access kiosk. This setting restricts the user to a single full-screen Universal Windows Platform (UWP) app and blocks access to the desktop, taskbar, and other system functions, meeting the exact requirement for a public-facing kiosk.

Answer

Settings > Personalization > Start

Answer

Control Panel > User Accounts > Manage User Accounts

Answer

Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings

Question 14

A technician is troubleshooting a Windows 10 PC that shows a black screen with a movable mouse cursor after boot. The user can press Ctrl+Alt+Del and launch Task Manager. Which Control Panel or Settings tool should be used to repair the system files that may be corrupted?

Accepted Answer

System Properties > System Protection. The black screen with a movable mouse cursor after boot, combined with the ability to launch Task Manager via Ctrl+Alt+Del, indicates that the Windows shell (explorer.exe) may be failing to load due to corrupted system files. System Properties > System Protection provides access to System Restore, which can revert system files and registry settings to a previous known-good state, effectively repairing corruption without affecting user data. This tool leverages Volume Shadow Copy snapshots to restore critical system files, making it the appropriate choice for this scenario.

Answer

Device Manager

Answer

Administrative Tools > Computer Management

Answer

Settings > Update & Security > Troubleshoot

Question 15

During a remote troubleshooting session, a technician uses a tool that allows them to view the user's screen and control the mouse and keyboard. The user reports that the session is extremely laggy, with noticeable delay between the technician's actions and the screen update. Which of the following is the most likely cause of this lag?

Accepted Answer

The network connection between the technician and the user has high latency or low bandwidth.. The lag described is a classic symptom of network latency or insufficient bandwidth, which directly impacts the responsiveness of remote desktop protocols like RDP or VNC. These protocols transmit screen updates and input events in real time; high latency delays the round-trip of packets, while low bandwidth can cause frame drops or compression artifacts, resulting in the noticeable delay between the technician's actions and the screen update.

Answer

The remote desktop software is using an outdated encryption protocol.

Answer

The user's computer has insufficient RAM to handle remote desktop sessions.

Answer

The technician's computer is running a different operating system than the user's.