220-1202 Practice Test 14 — 15 Questions

Question 1

A company deploys a new remote access solution using a VPN concentrator. After setup, users report that they can connect to the VPN but cannot access internal file servers. Other internal resources like email are accessible. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPN concentrator lacks a route to the file server's subnet. The VPN concentrator must have a route to the file server's subnet to forward traffic from VPN clients. Without this route, packets destined for the file server are dropped, while other resources (like email) remain accessible if their subnets are reachable. This is a classic routing issue in remote access VPN deployments.

Answer

The VPN client is using an incorrect DNS server

Answer

The file server is not on the same VLAN as the VPN concentrator

Answer

The users do not have permission to log on locally to the file server

Question 2

A user reports that their Windows 10 laptop is running slowly and frequently shows a 'Low Memory' warning. They have 8 GB of RAM and are not running any unusual applications. Which built-in Windows tool should you use to determine if a specific process is leaking memory?

Accepted Answer

Task Manager. Task Manager (Option B) is the correct tool because it provides a real-time view of per-process memory usage, including the 'Memory (Active Private Working Set)' column, which can identify a process that is consuming an abnormally increasing amount of RAM over time—indicative of a memory leak. Unlike other tools, Task Manager allows you to quickly sort processes by memory usage and observe growth without needing to configure counters or parse logs.

Answer

Performance Monitor

Answer

Event Viewer

Answer

System Configuration (msconfig)

Question 3

A user calls the help desk, frustrated that their laptop 'keeps freezing' during video conferences. They admit they have 15 browser tabs open, are running a resource-heavy design app, and have not restarted the laptop in three weeks. The technician needs to recommend a solution while maintaining professionalism. What should the technician say first?

Accepted Answer

"I understand that's frustrating. Let's look at what might be causing this. Have you noticed it happens when certain programs are open?". It first validates the user's frustration (professionalism) and then uses a probing question to gather diagnostic data about the specific conditions causing the freezing. This aligns with the CompTIA A+ troubleshooting methodology (identify the problem) and maintains rapport, which is critical for customer satisfaction. The technician avoids premature blame or dismissal, instead focusing on correlating the symptom (freezing) with resource contention from the browser tabs and design app.

Answer

"You need to close some tabs and restart your laptop immediately."

Answer

"That's because you never restart your computer. You should do that weekly."

Answer

"Let me transfer you to our advanced support team for this issue."

Question 4

A user reports that after a technician recycled an old computer by simply deleting the user profile, the next user found personal documents in the 'Recycle Bin'. Which step was missed in the data disposal process?

Accepted Answer

The technician should have used a data wiping tool that overwrites the free space.. Deleting a user profile only removes the user's registry and profile folder, but personal documents remain in the Recycle Bin because the Recycle Bin is a system-protected hidden folder that is not cleared by profile deletion. A data wiping tool that overwrites free space is required to securely erase the contents of the Recycle Bin and any other residual data, ensuring that deleted files cannot be recovered.

Answer

The technician should have performed a quick format.

Answer

The technician should have removed the hard drive and stored it.

Answer

The technician should have disabled the Recycle Bin.

Question 5

A technician is configuring a new Windows 10 workstation for a remote employee who will handle sensitive customer data. Which security feature should be enabled to ensure that if the laptop is lost, the data remains protected?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption (C) is the correct choice because it provides full-disk encryption using AES encryption algorithms, ensuring that if the laptop is lost or stolen, the sensitive customer data remains inaccessible without the recovery key or TPM authentication. This directly addresses the requirement to protect data at rest on a lost device.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

Windows Hello for Business

Question 6

A system administrator configures a new VPN server for remote employees. The requirement is that all traffic from the remote user's device must be routed through the corporate network to enforce security policies. Which VPN protocol setting should the administrator enable?

Accepted Answer

Disable split tunneling. Disabling split tunneling ensures that all traffic from the remote user's device is routed through the corporate VPN tunnel, enforcing security policies such as content filtering and intrusion detection. When split tunneling is enabled, only traffic destined for the corporate network goes through the VPN, while internet-bound traffic bypasses it, violating the requirement. This setting is typically configured in the VPN client or server profile (e.g., using the 'DisableSplitTunneling' registry key on Windows or the 'tunnel-all' directive in OpenVPN).

Answer

Enable split tunneling

Answer

Use PPTP instead of L2TP

Answer

Increase the MTU size

Question 7

A user calls the help desk saying their PC suddenly displays a ransom note demanding payment in Bitcoin to unlock their files. They cannot open any documents or images. What is the first action you should take?

Accepted Answer

Disconnect the PC from the network.. The correct first action is to disconnect the PC from the network (Option C). This immediately isolates the infected system, preventing the ransomware from communicating with its command-and-control (C2) server to exfiltrate data or encrypt additional network shares. It also stops the ransomware from spreading laterally to other devices on the same LAN, which is critical for containment before any remediation steps are taken.

Answer

Pay the ransom to get the decryption key.

Answer

Run a full antivirus scan immediately.

Answer

Restore files from a recent backup without disconnecting.

Question 8

A technician is investigating a security incident where a user's corporate email account was accessed from an unknown device. The user's iPhone shows no suspicious apps, and the password was recently changed. Which of the following is the MOST likely cause?

Accepted Answer

An OAuth token or app-specific password was stolen and used to access the account.. OAuth tokens or app-specific passwords bypass the need for the primary password, allowing persistent access even after a password change. Since the user's iPhone shows no suspicious apps and the password was recently changed, a stolen token is the most plausible vector for unauthorized email access via Exchange ActiveSync or modern authentication.

Answer

The user's iCloud account was compromised, and the email is synced via Exchange.

Answer

The user's iPhone has a jailbreak that hides malicious apps.

Answer

The corporate email server has a backdoor account.

Question 9

A company is implementing a remote access solution for employees using personal smartphones. They need to ensure that corporate email and documents are accessible but that no corporate data remains on the device if it is lost or wiped. Which technology should they use?

Accepted Answer

Mobile Device Management (MDM) with a containerized work profile.. Mobile Device Management (MDM) with a containerized work profile creates a separate, encrypted sandbox on the smartphone that stores corporate email and documents. This container can be remotely wiped by the administrator without affecting the user's personal data, ensuring no corporate data remains on a lost or wiped device.

Answer

Virtual Private Network (VPN) with split tunneling.

Answer

Remote Desktop Protocol (RDP) to a virtual desktop.

Answer

Third-party remote access software like LogMeIn.

Question 10

An employee's company-issued Android phone is suddenly displaying pop-up ads even when no browser is open. The employee claims they only downloaded apps from the official Google Play Store. Which of the following is the MOST likely cause?

Accepted Answer

A recently installed app has been granted 'Draw over other apps' permission.. The 'Draw over other apps' permission allows an app to display content on top of other applications, including the home screen and lock screen. This is a common technique used by adware and malicious apps to serve persistent pop-up ads even when no browser is open, as the app can draw its own window outside of the normal app lifecycle. Since the employee only downloaded from Google Play, this permission abuse is the most likely cause, as even Play Store apps can be granted this permission by the user during installation or runtime.

Answer

The phone's firmware is outdated.

Answer

The phone's Wi-Fi network is infected with malware.

Answer

The phone's screen has a hardware defect causing ghost touches.

Question 11

A technician needs to deploy a custom security policy to all Windows 10 workstations in a small office. The policy must restrict access to the Control Panel and prevent users from changing system settings. Which administrative tool should be used to create and apply this policy locally on each machine?

Accepted Answer

Local Group Policy Editor (gpedit.msc). The Local Group Policy Editor (gpedit.msc) is the correct tool because it provides the administrative templates and policy nodes (e.g., User Configuration > Administrative Templates > Control Panel) needed to restrict access to Control Panel and prevent system setting changes. These settings are written to the local Group Policy Objects (GPOs) stored in %SystemRoot%\System32\GroupPolicy, which Windows applies at user logon. This tool is available on Windows 10 Pro, Enterprise, and Education editions, but not on Windows 10 Home.

Answer

Local Security Policy (secpol.msc)

Answer

User Accounts (netplwiz)

Answer

System Configuration (msconfig)

Question 12

A user reports that their application crashes with an 'Access Denied' error when trying to write to a specific folder. You have verified the user has Full Control NTFS permissions. Which administrative tool should you use to check for any file encryption or compression that might be blocking the write?

Accepted Answer

File Explorer > right-click folder > Properties > Advanced to view encryption and compression attributes.. The 'Access Denied' error despite Full Control NTFS permissions indicates a file-level attribute conflict. File encryption (EFS) or compression attributes are stored in the folder's Advanced Attributes dialog, accessible via File Explorer > Properties > Advanced. These attributes can block write access even when NTFS permissions are permissive, as encryption requires the user's EFS certificate and compression changes the file's physical layout.

Answer

Computer Management > Shared Folders to view open files.

Answer

Local Security Policy to check user rights assignments.

Answer

Registry Editor to modify the folder's security descriptor.

Question 13

A technician is helping a user who is upset because their important presentation file was accidentally deleted. The user is very emotional and raising their voice. What is the best way for the technician to handle this situation?

Accepted Answer

Listen calmly, apologize for the inconvenience, and explain steps to recover the file from the recycle bin or backup.. It demonstrates the professional communication and empathy required in a support role. The technician remains calm, acknowledges the user's frustration, and immediately provides a technical solution—recovering the file from the Recycle Bin or a backup. This aligns with CompTIA's emphasis on active listening, de-escalation, and problem-solving without dismissing the user's concerns.

Answer

Tell the user to calm down and that losing data is not a big deal.

Answer

Raise your voice to match the user's tone to show you are taking it seriously.

Answer

Transfer the call to a manager immediately.

Question 14

A technician is tasked with securely connecting a remote office to the main office over the internet. The remote office has 10 users who need access to the same resources as local users. Which of the following remote access methods provides the most secure and scalable solution?

Accepted Answer

Set up a site-to-site VPN between the two offices. A site-to-site VPN (often using IPsec or a secure tunnel protocol) creates an encrypted, always-on connection between the two office routers, allowing all 10 users transparent access to the main office resources as if they were on the same LAN. This method is both secure (encrypting all traffic) and scalable (handling multiple users without per-client configuration), making it the best fit for connecting entire networks over the internet.

Answer

Configure port forwarding on the main office router for each required service

Answer

Use Remote Desktop for each user to connect to a workstation at the main office

Answer

Implement a client-to-site VPN for each user

Question 15

A user reports that their Windows 11 laptop suddenly shows a blue screen with an error message every time they try to boot. You need to access advanced troubleshooting options to repair the system. Which key should you press during startup to access the Windows Recovery Environment (WinRE)?

Accepted Answer

F11. Pressing F11 during the Windows 11 boot process is the standard key to access the Windows Recovery Environment (WinRE) on most modern systems. WinRE provides advanced troubleshooting tools such as System Restore, Startup Repair, Command Prompt, and Safe Mode, which are essential for repairing a system that fails to boot due to a blue screen error.

Answer

F8

Answer

F2

Answer

F12