220-1202 Practice Test 18 — 15 Questions

Question 1

A user reports that their MacBook Pro running macOS Monterey frequently displays a message saying 'Your system has run out of application memory.' They have 16 GB of RAM and are only using Safari and Mail. Which macOS tool should you use to investigate the cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activity Monitor. Activity Monitor is the correct tool because it provides real-time, graphical monitoring of memory pressure, process-specific memory usage, and the 'Memory' tab's 'Memory Pressure' graph directly indicates whether the system is under memory strain. Since the user has 16 GB of RAM and is only using Safari and Mail, the 'out of application memory' error typically indicates a memory leak or excessive memory consumption by a specific process, which Activity Monitor can pinpoint by sorting processes by memory usage.

Answer

System Information

Answer

Terminal with 'vm_stat' command

Answer

Console

Question 2

A user's browser is displaying a warning that the website's certificate is not trusted, even though the URL is correct. The technician checks the date and time on the computer and finds it is set to 2019. What is the most likely cause of the certificate warning?

Accepted Answer

The system date is incorrect, causing certificate validation to fail.. The system date is set to 2019, which is outside the certificate's validity period. SSL/TLS certificates have a specific notBefore and notAfter date range; when the client's clock is outside this range, the browser rejects the certificate as untrusted. This is the most direct and common cause of the warning given the symptom and the technician's finding.

Answer

The website's SSL certificate has been revoked.

Answer

The browser's certificate store is corrupted.

Answer

The user is connected to a malicious proxy.

Question 3

A technician is troubleshooting a user's slow computer. The user mentions they received a call from 'Windows Support' saying their computer had a virus. The user gave the caller remote access to 'fix' it. Now, the computer is running slower and has strange pop-ups. What is the most likely consequence of this social engineering attack?

Accepted Answer

The attacker installed a keylogger to steal credentials and sensitive data.. The attacker gained remote access to the user's computer under the guise of tech support. Once in, they installed a keylogger to capture keystrokes, which is a common payload in such social engineering attacks. This allows the attacker to steal credentials, banking information, and other sensitive data, explaining the continued slow performance and pop-ups.

Answer

The computer is now part of a botnet used for DDoS attacks.

Answer

The computer's BIOS has been corrupted.

Answer

The hard drive has been physically damaged.

Question 4

A small business owner wants to prevent employees from installing any software on their Windows 10 workstations without administrator approval. Which Control Panel or Settings feature should you configure to enforce this restriction?

Accepted Answer

User Accounts > Change User Account Control settings. User Account Control (UAC) settings, accessed via User Accounts in Control Panel, allow you to control when and how users are prompted for permission before making system changes, including software installations. By setting UAC to the highest level, you ensure that any installation attempt triggers an administrator approval prompt, effectively preventing unauthorized software installations on Windows 10 workstations.

Answer

Windows Defender Firewall

Answer

System > Advanced system settings > Performance

Answer

Ease of Access > Make the keyboard easier to use

Question 5

A technician is configuring a new Windows 10 workstation for a user who requires access to files stored on an encrypted USB drive. The drive uses BitLocker To Go. What must the technician do to ensure the user can access the drive on this computer?

Accepted Answer

Provide the user with the drive's password or recovery key. BitLocker To Go encrypts removable drives with a password or recovery key. To access the drive on a new Windows 10 workstation, the technician must provide the user with the drive's password or recovery key, as the drive is already encrypted and requires authentication at mount time. No additional configuration is needed on the workstation beyond entering the correct credentials.

Answer

Enable BitLocker on the workstation's internal drive

Answer

Format the USB drive to NTFS

Answer

Install the BitLocker Drive Encryption feature from Control Panel

Question 6

A technician needs to install a new hard drive in a computer that is under a strict security policy requiring all drives to be sanitized before disposal. The old drive will be replaced. What is the most secure method to ensure data cannot be recovered from the old drive?

Accepted Answer

Use a degausser to erase the magnetic fields.. A degausser generates a powerful magnetic field that physically randomizes the magnetic domains on the platters, effectively destroying all stored data and rendering the drive unusable. This is the only method listed that meets the strict security policy requirement for sanitization, as it prevents any possible data recovery even with advanced forensic tools.

Answer

Perform a quick format of the drive.

Answer

Run the Windows Disk Cleanup tool.

Answer

Delete all partitions using Disk Management.

Question 7

During a security audit, you find that several employees have been using the same weak password for their domain accounts. Which remediation should you implement first?

Accepted Answer

Configure a password policy in Group Policy requiring complexity and minimum length. The most effective first step to prevent weak passwords is to enforce a strong password policy via Group Policy. This centrally mandates complexity requirements (e.g., uppercase, lowercase, digits, special characters) and a minimum length (typically 8–14 characters), which directly blocks the use of simple, common passwords at the domain level. Unlike awareness campaigns or reactive measures, this technical control proactively enforces security standards across all domain accounts.

Answer

Disable the user accounts and require a manager to re-enable them

Answer

Send a company-wide email reminding users to choose strong passwords

Answer

Install a third-party password manager for all employees

Question 8

A help desk ticket states that a user cannot write to a shared directory /data/projects. The directory permissions are drwxr-xr-x and the user is in the 'staff' group. The directory's group owner is 'staff'. What is the most likely cause?

Accepted Answer

The directory lacks group write permission.. The directory permissions are drwxr-xr-x, which means the owner has read, write, and execute (rwx), the group has read and execute (r-x), and others have read and execute (r-x). Since the user is in the 'staff' group and the directory's group owner is 'staff', the user's effective permissions are the group permissions, which lack write (w). Therefore, the user cannot write to the directory. Option B correctly identifies that the directory lacks group write permission.

Answer

The user does not have read permission on the directory.

Answer

The user is not the owner of the directory.

Answer

The sticky bit is set on the directory.

Question 9

A non-profit organization is upgrading its computers and wants to donate the old ones to a local school. The HDDs contain donor information that must be kept confidential. The organization wants the drives to be reusable. Which method should be used?

Accepted Answer

Perform a full overwrite with zeros using disk-wiping software.. Performing a full overwrite with zeros using disk-wiping software ensures that all data on the HDDs is irrecoverably destroyed while leaving the drives functional for reuse. This method meets the organization's need for confidentiality (donor information) and reusability, as it overwrites every sector of the drive, including hidden areas like the HPA and DCO, with a known pattern (e.g., zeros or random data), making data recovery infeasible with standard tools.

Answer

Use a degausser to erase the drives.

Answer

Physically drill holes through the drive platters.

Answer

Delete all files and empty the recycle bin.

Question 10

A user reports that their laser printer is producing faint, streaky prints and has a strong ozone smell. The printer has been in use for three years. What is the most important safety procedure to follow before attempting to service the printer?

Accepted Answer

Unplug the printer and discharge the high-voltage power supply.. The strong ozone smell indicates a high-voltage issue, likely with the corona wire or power supply. Before servicing, you must unplug the printer and discharge the high-voltage power supply to prevent electric shock, as laser printers store lethal voltages in capacitors even when powered off.

Answer

Replace the toner cartridge immediately.

Answer

Clean the corona wire with isopropyl alcohol.

Answer

Reset the printer to factory defaults.

Question 11

A technician is investigating a security incident where multiple workstations on the same network are showing signs of infection: slow performance, unusual network traffic, and the presence of a file named 'svch0st.exe' in the Startup folder. The technician suspects a worm that spreads through network shares. What is the most effective containment strategy?

Accepted Answer

Disable network shares and isolate infected workstations from the network.. Disabling network shares and isolating infected workstations from the network is the most effective containment strategy because the worm spreads through network shares (SMB protocol). By cutting off the propagation vector (network shares) and isolating infected hosts, you prevent the worm from reaching other workstations, even if the malware is still active locally. This aligns with the immediate containment phase of incident response, which prioritizes stopping the spread over remediation.

Answer

Run a full antivirus scan on all workstations simultaneously.

Answer

Update the antivirus definitions on one workstation and scan it.

Answer

Reboot all workstations into Safe Mode with Networking.

Question 12

A technician is updating the documentation for a server that had its RAID controller replaced. The technician must ensure that future technicians can quickly identify the new hardware configuration. Which type of documentation should be updated?

Accepted Answer

The server's asset inventory record.. The server's asset inventory record (Option C) is the correct documentation to update because it contains the detailed hardware configuration of the server, including the RAID controller model, firmware version, and disk layout. Future technicians rely on this record to quickly identify the exact hardware components without having to physically inspect the server or dig through logs. Updating the asset inventory ensures that the documented configuration matches the actual hardware, which is critical for troubleshooting, warranty claims, and future upgrades.

Answer

The network topology diagram.

Answer

The change management log.

Answer

The knowledge base article for RAID troubleshooting.

Question 13

A user's Windows 10 PC is experiencing random freezes and application crashes. You suspect a corrupted system file. You run sfc /scannow but it reports that it cannot repair some files. What is the next best step to repair the system files using a DISM command?

Accepted Answer

Run DISM /Online /Cleanup-Image /RestoreHealth. The correct next step is to run DISM /Online /Cleanup-Image /RestoreHealth because SFC (System File Checker) relies on a healthy component store (WinSxS) to replace corrupted files. When SFC cannot repair files, it indicates the component store itself may be damaged. DISM repairs the component store by using Windows Update as the source, or a specified repair source, thereby enabling SFC to succeed on a subsequent scan.

Answer

Run chkdsk /f

Answer

Run System Restore

Answer

Run Windows Update

Question 14

A customer reports that their laptop was stolen from their desk over the weekend. The laptop contained sensitive client data. Which physical security control should have been implemented to prevent this theft?

Accepted Answer

Cable lock. A cable lock is a physical security control that physically secures the laptop to a desk or immovable object, preventing unauthorized removal. In this scenario, the laptop was stolen from the desk, so a cable lock would have directly prevented the theft by tethering the device in place.

Answer

Biometric authentication

Answer

Full disk encryption

Answer

Smart card reader

Question 15

A technician is troubleshooting an iPhone that fails to activate after a software update. The phone displays 'Activation Error' and the SIM card is known to be working. Which of the following steps should the technician perform FIRST?

Accepted Answer

Check Apple's System Status page for activation server outages.. The 'Activation Error' after a software update typically indicates that the iPhone cannot reach Apple's activation servers to verify its eligibility. Since the SIM card is known to be working, the most logical first step is to check Apple's System Status page to rule out a server-side outage, which is a common cause of activation failures and can be resolved without any device-side intervention.

Answer

Replace the SIM card with a new one.

Answer

Restore the iPhone using iTunes or Finder.

Answer

Reset the iPhone's network settings.