220-1202 Practice Test 15 — 15 Questions

Question 1

A customer reports that their computer is running slowly and they see pop-up ads even when no browser is open. They suspect malware. Which of the following should you perform first to remediate this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the computer from the network. Disconnecting the computer from the network is the first step because it immediately stops the malware from communicating with its command-and-control (C2) server, preventing further data exfiltration, additional payload downloads, or remote control. This containment step is critical before any remediation (like scanning or rebooting) to avoid the malware spreading or causing more damage.

Answer

Run a full antivirus scan

Answer

Reboot the computer in Safe Mode

Answer

Restore from a recent backup

Question 2

A customer reports that their Windows 10 PC is slow and displays pop-up ads even when no browser is open. They suspect malware. After running a full antivirus scan, the symptoms persist. Which step should you take next to remediate the issue?

Accepted Answer

Run a scan with a dedicated anti-malware tool like Malwarebytes.. Standard antivirus software often misses potentially unwanted programs (PUPs) and adware that inject pop-ups into the system. A dedicated anti-malware tool like Malwarebytes uses heuristic analysis and signature databases specifically tuned to detect and remove adware, browser hijackers, and other low-level threats that traditional AV engines may overlook.

Answer

Reinstall the operating system.

Answer

Disable Windows Defender permanently.

Answer

Clear the browser cache and cookies.

Question 3

A user calls the help desk, frustrated because their computer is running slowly after installing a new antivirus program. The technician suspects the antivirus is causing high CPU usage. Which of the following is the MOST appropriate initial response?

Accepted Answer

Apologize for the frustration and ask the user to describe when the slowness started.. It follows the CompTIA A+ troubleshooting methodology by first gathering information and showing empathy. The technician needs to confirm the timeline of the slowness relative to the antivirus installation, as other factors (e.g., a Windows update, disk I/O bottleneck, or malware) could be the root cause. Jumping to conclusions without verifying the symptom onset violates the 'identify the problem' step and risks misdiagnosis.

Answer

Tell the user to uninstall the antivirus immediately.

Answer

Explain that antivirus programs always slow down computers and there's nothing to be done.

Answer

Immediately remote into the computer to check CPU usage.

Question 4

A technician is setting up a new workstation in a cubicle. The cubicle has multiple power strips daisy-chained together to provide enough outlets. What is the correct safety action the technician should take?

Accepted Answer

Remove the daisy chain and plug each device directly into a wall outlet using a single power strip with surge protection.. Daisy-chaining power strips is a fire hazard because it can exceed the ampacity of the circuit, leading to overheating and potential electrical fires. The correct safety action is to remove the daisy chain and plug each device directly into a wall outlet, using a single power strip with surge protection to safely distribute power without overloading the circuit.

Answer

Continue using the daisy-chained setup since it is convenient and all strips are rated for 15 amps.

Answer

Replace all power strips with heavy-duty extension cords rated for the total load.

Answer

Install a UPS at the end of the daisy chain to regulate power.

Question 5

A company is migrating from Windows 7 to Windows 10 and needs to automate the installation of 200 workstations with identical software and settings. They have a reference computer already configured. Which Windows tool should they use to capture and deploy a custom system image?

Accepted Answer

System Preparation Tool (Sysprep). Sysprep is the correct tool because it generalizes a Windows installation by removing unique system identifiers (such as the computer SID, computer name, and driver caches) so that the reference computer’s image can be safely captured and deployed to multiple workstations. After Sysprep runs with the /generalize option, the image is captured using a tool like DISM or ImageX, then deployed to 200 identical workstations, ensuring each machine generates its own unique SID and settings on first boot.

Answer

Windows System Image Manager (Windows SIM)

Answer

Windows Recovery Environment (WinRE)

Answer

Windows Backup and Restore

Question 6

A technician is configuring a new virtual machine for a developer. The developer needs to run multiple isolated environments for testing, but the host machine has limited storage space. Which type of virtual disk configuration should the technician use to minimize storage usage while still allowing the VM to grow as needed?

Accepted Answer

Thin provisioning. Thin provisioning (Option B) allocates storage on demand, writing only the data blocks that are actually used, which minimizes initial storage consumption while allowing the virtual disk to grow dynamically up to its maximum configured size. This is ideal for the developer's scenario of multiple isolated test environments on a host with limited storage space.

Answer

Thick provisioning

Answer

Fixed-size disk

Answer

Dynamic disk

Question 7

During a routine security audit, you discover that several user accounts on a Windows 10 workstation have local administrator privileges when they should only be standard users. You need to quickly review and modify user account types from the command line. Which built-in tool should you use?

Accepted Answer

net localgroup. The `net localgroup` command is the correct built-in tool for this task because it allows you to both view and modify group memberships from the command line. Specifically, `net localgroup Administrators` lists current members, and `net localgroup Administrators <username> /delete` removes a user from the local Administrators group, effectively demoting them to a standard user. This directly addresses the need to quickly review and change user account types without a GUI.

Answer

lusrmgr.msc (Local Users and Groups MMC)

Answer

net user

Answer

diskpart

Question 8

A user calls the help desk, frantic because their banking app shows an unauthorized transfer of $500. They say they received a call earlier from 'bank security' asking them to install a remote access tool to 'verify their account'. What type of social engineering attack did the user fall victim to?

Accepted Answer

Vishing. The user received a phone call (voice channel) and was tricked into installing remote access software, which is the hallmark of vishing (voice phishing). Unlike phishing, which uses email or malicious links, vishing exploits telephone systems and social engineering to gain unauthorized access or sensitive information.

Answer

Phishing

Answer

Smishing

Answer

Shoulder surfing

Question 9

A company policy requires that all web traffic from employee computers be filtered to block known malicious sites. You need to implement this without installing client software on each machine. Which approach should you use?

Accepted Answer

Implement a DNS-based content filtering service on the network's DNS server.. DNS-based content filtering operates at the network level, blocking resolution of domains known to host malicious content. This approach requires no client software, as all DNS queries from employee computers are intercepted and filtered by the network's DNS server, enforcing the policy transparently.

Answer

Configure each browser's proxy settings to use a filtering proxy server.

Answer

Enable Windows Defender SmartScreen on each computer via Group Policy.

Answer

Install a third-party browser extension on all browsers to block malicious sites.

Question 10

A customer calls saying their home Wi-Fi network suddenly stopped working after they changed the router's security mode from WPA2-PSK to WPA2-Enterprise. All their devices previously connected fine. What is the most likely cause of the problem?

Accepted Answer

The router is now requiring a username and password from a RADIUS server, which the home network lacks.. WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to validate credentials (username and password). Home routers typically lack a built-in RADIUS server, so after changing to WPA2-Enterprise, the router cannot authenticate any client, causing all devices to fail to connect. The previous WPA2-PSK mode used a simple pre-shared key, which worked without any external server.

Answer

The router's firmware is outdated.

Answer

The devices do not support the new encryption cipher.

Answer

The SSID was changed during the configuration.

Question 11

During a network equipment upgrade, a technician finds several old switches with visibly leaking capacitors on the circuit boards. What is the correct procedure for handling these switches?

Accepted Answer

Wear nitrile gloves, place the switches in a sealed bag, and label for e-waste recycling.. Leaking capacitors often contain hazardous materials such as electrolytes or polychlorinated biphenyls (PCBs), which require special handling to prevent environmental contamination and personal injury. The correct procedure is to wear nitrile gloves (to avoid skin contact with corrosive or toxic substances), place the switches in a sealed bag to contain any leaked material, and label them for e-waste recycling, ensuring compliance with environmental regulations like the WEEE Directive or RCRA.

Answer

Power them on to see if they still function before disposal.

Answer

Use compressed air to blow out the leaked substance and then recycle the switches.

Answer

Dispose of the switches in the regular office recycling bin.

Question 12

A user reports that their Windows 10 PC is running slowly and they suspect too many programs are starting automatically. They want to disable a few startup items without uninstalling them. Which tool should you use to manage these startup programs?

Accepted Answer

Task Manager > Startup tab. Task Manager's Startup tab provides a straightforward interface to enable or disable startup programs without uninstalling them. It displays each startup item's name, publisher, status, and startup impact, allowing users to selectively disable unwanted entries. This is the correct tool for managing startup programs in Windows 10.

Answer

Services.msc

Answer

Control Panel > Programs and Features

Answer

Settings > Apps > Startup

Question 13

A technician is configuring a new Windows 10 workstation for a remote employee. The employee will use the laptop to access company resources via VPN. Which security setting should be configured to ensure the VPN connection is always used when accessing the internet?

Accepted Answer

Disable split tunneling to force all traffic through the VPN.. Disabling split tunneling ensures that all network traffic, including internet-bound traffic, is routed through the VPN tunnel. This forces the VPN connection to be always used when accessing the internet, which is essential for enforcing security policies and ensuring that company resources are protected even when the remote employee accesses external websites.

Answer

Enable split tunneling to improve performance.

Answer

Configure the VPN to use PPTP protocol.

Answer

Set the VPN to connect only when accessing internal websites.

Question 14

A technician is configuring a new Mac mini for a kiosk application. The kiosk should run only a single web browser in full-screen mode, and users should not be able to exit the app or access the desktop. Which macOS feature should be used to enforce this?

Accepted Answer

Configure a user account with Parental Controls set to allow only the browser app. MacOS Parental Controls (now part of Screen Time) can restrict a standard user account to a single app, such as a web browser. When configured to 'Allow only this app,' the system prevents the user from switching apps, accessing the desktop, or exiting the browser, which is exactly what a kiosk requires.

Answer

Enable Guided Access in Accessibility settings

Answer

Use the 'Single App Mode' setting in System Settings

Answer

Set the browser as a Login Item for a standard user

Question 15

An organization is moving to a cloud-based system and needs to dispose of several tape backup cartridges that contain years of financial data. The tapes are LTO-5 and are still readable. Which destruction method is most appropriate?

Accepted Answer

Overwrite the tapes with a bulk eraser or degausser.. A degausser or bulk eraser generates a powerful magnetic field that disrupts the magnetic domains on the LTO-5 tape media, rendering the previously stored data unrecoverable. This method is the most appropriate for LTO-5 tapes because it physically destroys the magnetic encoding without requiring a compatible tape drive, and it is faster and more reliable than attempting to overwrite the entire tape. For secure disposal of magnetic media containing sensitive financial data, degaussing is the industry-standard approach when physical destruction is not mandated.

Answer

Perform a quick format of the tapes using a tape drive.

Answer

Reuse the tapes for non-sensitive data after deleting the files.

Answer

Burn the tapes in an industrial incinerator.