220-1202 Practice Test 18 — 15 Questions

Question 1

During a routine security audit, a technician discovers that a user's computer has a program that opens a backdoor on port 4444 and allows remote control. The program was installed alongside a free PDF converter the user downloaded last week. Which malware type is this, and what is the most effective removal method?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trojan horse; boot into Safe Mode and run a full anti-malware scan.. The program is a Trojan horse because it disguises itself as a legitimate PDF converter while secretly installing a backdoor. The most effective removal method is to boot into Safe Mode, which loads only essential drivers and services, preventing the Trojan from running, and then perform a full anti-malware scan to detect and remove the malicious files.

Answer

Worm; use a network-based firewall to block port 4444.

Answer

Ransomware; pay the ransom to regain control.

Answer

Rootkit; perform a clean installation of Windows.

Question 2

After deploying a new Windows 11 update, several users complain that they can no longer access shared folders on the network. You verify that network discovery and file sharing are enabled. Which Windows security setting should you check first to resolve this issue?

Accepted Answer

Review Windows Defender Firewall rules for 'File and Printer Sharing.'. After a Windows 11 update, the most common cause for losing access to shared folders—even when network discovery and file sharing are enabled—is that the Windows Defender Firewall rules for 'File and Printer Sharing' have been reset or disabled. This update often modifies firewall profiles (e.g., switching from Private to Public) or resets custom rules, blocking the NetBIOS, SMB, and RPC ports (TCP 139, 445; UDP 137, 138) required for file sharing. Checking and re-enabling these inbound rules restores connectivity.

Answer

Check if the users are in the 'Remote Desktop Users' group.

Answer

Verify that the 'Password Protected Sharing' option is turned off.

Answer

Run Windows Update to install additional patches.

Question 3

A technician receives a complaint from a user that their email account was used to send spam. The user insists they did not send the emails. What is the MOST appropriate first step in handling this security incident professionally?

Accepted Answer

Immediately reset the user's password and check the email logs for unauthorized access.. The immediate reset of the user's password stops further unauthorized use of the account, and checking email logs (e.g., SMTP logs, IMAP/POP3 access logs, or Exchange/Office 365 audit logs) allows the technician to identify the source of the spam, such as a compromised credential or a malicious forwarding rule. This follows the CompTIA A+ incident response procedure of containment first, then investigation, while maintaining professional communication with the user.

Answer

Tell the user they must have clicked on a phishing link and it's their fault.

Answer

Ignore the complaint because spam is common.

Answer

Ask the user to change their password and not worry about it.

Question 4

You are troubleshooting a Windows 10 PC that fails to boot with the error 'Boot Configuration Data is missing.' Which built-in tool can you use from the Windows Recovery Environment to rebuild the BCD store?

Accepted Answer

Bootrec.exe. Bootrec.exe is the correct built-in tool for rebuilding the Boot Configuration Data (BCD) store from the Windows Recovery Environment (WinRE). The specific command 'bootrec /rebuildbcd' scans all disks for Windows installations and allows you to rebuild the BCD store, directly addressing the 'Boot Configuration Data is missing' error. Other tools like SFC, Diskpart, and CHKDSK do not have the capability to reconstruct the BCD store.

Answer

System File Checker (sfc /scannow)

Answer

Diskpart

Answer

CHKDSK

Question 5

A network administrator is configuring a new wireless network for a hospital that requires the highest level of security for patient data. The network must support 802.1X authentication with smart cards. Which combination of security protocols and authentication methods should be used?

Accepted Answer

WPA2-Enterprise with EAP-TLS.. WPA2-Enterprise with EAP-TLS provides the highest level of security for a hospital network requiring 802.1X authentication with smart cards. EAP-TLS uses mutual authentication via digital certificates (which can be stored on smart cards), eliminating the risk of credential theft or man-in-the-middle attacks. WPA2-Enterprise is the appropriate underlying encryption framework for this scenario, as it supports the required 802.1X/EAP integration.

Answer

WPA2-PSK with PEAP-MSCHAPv2.

Answer

WPA3-Personal with SAE.

Answer

WPA3-Enterprise with EAP-TTLS.

Question 6

During a security audit, a Linux server is found to have a configuration file that is world-writable. The file /etc/app/config.cfg must only be readable and writable by the root user. Which command should the administrator run?

Accepted Answer

chmod 600 /etc/app/config.cfg. `chmod 600` sets the file permissions to read and write for the owner (root) and no permissions for group or others. This satisfies the requirement that only root can read and write `/etc/app/config.cfg`, as root is the owner of the file.

Answer

chmod 777 /etc/app/config.cfg

Answer

chmod 644 /etc/app/config.cfg

Answer

chmod 400 /etc/app/config.cfg

Question 7

A technician is tasked with replacing a faulty power supply in a desktop computer that is part of a critical patient record system at a clinic. Before starting, the technician reviews the change management policy. Which step should the technician perform first?

Accepted Answer

Submit a change request to the change advisory board (CAB). The change management policy requires that any modification to a system handling critical patient records must first be formally approved via a change request submitted to the Change Advisory Board (CAB). This ensures that risks are assessed, downtime is scheduled, and compliance with healthcare data regulations (e.g., HIPAA) is maintained before any physical work begins.

Answer

Power off the workstation and disconnect all cables

Answer

Back up the patient records to an external drive

Answer

Notify the clinic staff that the system will be offline

Question 8

A technician is cleaning a computer that has been infected with a rootkit. After running a standard antivirus scan, the malware is still detected on reboot. Which step should the technician take next to ensure complete removal?

Accepted Answer

Boot from a rescue disk and run a malware scan.. Rootkits are designed to hide from the operating system and standard antivirus tools by intercepting system calls and loading before the OS security components. Booting from a rescue disk (e.g., a Linux live CD or a dedicated antivirus rescue ISO) bypasses the infected OS entirely, allowing the scanner to access the file system without the rootkit actively masking its presence. This ensures the malware cannot interfere with the scan, enabling complete detection and removal.

Answer

Perform a clean installation of Windows.

Answer

Disable System Restore and run the antivirus again.

Answer

Run the antivirus in Safe Mode.

Question 9

A technician is configuring a remote desktop solution for a user who needs to access a Windows 10 Pro workstation from a Linux laptop. Which protocol should the technician ensure is enabled on the Windows machine?

Accepted Answer

RDP. RDP (Remote Desktop Protocol) is the native protocol used by Windows for remote desktop connections. Windows 10 Pro includes an RDP server that listens on TCP port 3389, allowing clients such as the Microsoft Remote Desktop client on Linux to connect and provide a full graphical desktop experience. The technician must ensure the 'Allow remote connections to this computer' setting is enabled and that the Windows Firewall permits inbound RDP traffic.

Answer

VNC

Answer

SSH

Answer

Telnet

Question 10

A company policy requires that all USB flash drives be encrypted before use. A technician needs to configure a new drive for a manager who will store confidential client data. Which built-in Windows tool should the technician use?

Accepted Answer

BitLocker To Go. BitLocker To Go is the correct built-in Windows tool for encrypting removable drives like USB flash drives. It provides full-disk encryption specifically designed for portable storage, ensuring that the confidential client data on the drive is protected if the drive is lost or stolen.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Firewall

Answer

Device Manager

Question 11

A small office user reports that their Windows 10 PC randomly freezes for 10-15 seconds, especially when opening large files. Task Manager shows high disk usage (100%) but low CPU and memory usage. Which built-in Windows tool should be used to diagnose the disk performance issue?

Accepted Answer

Use Resource Monitor to analyze disk activity and queue length.. Resource Monitor (resmon.exe) provides real-time metrics on disk activity, including disk queue length, average disk seconds per read/write, and per-process I/O. The user's symptom of 100% disk usage with low CPU/memory suggests a disk bottleneck; a consistently high queue length (above 2 per spindle) indicates the disk cannot keep up with I/O requests, which Resource Monitor can pinpoint directly.

Answer

Run the Performance Monitor with a Data Collector Set for disk.

Answer

Check the Event Viewer for disk-related errors.

Answer

Defragment the hard drive using the Optimize Drives tool.

Question 12

An employee finds a USB drive labeled 'Employee Bonuses Q4' in the parking lot and plugs it into their work computer to see the contents. The computer immediately begins exhibiting erratic behavior. Which social engineering attack was executed?

Accepted Answer

Baiting. Baiting. Baiting is a social engineering attack that uses a physical device (like a USB drive) or digital offer to lure a victim into taking an action that compromises security. In this scenario, the attacker left a USB drive labeled with an enticing file name ('Employee Bonuses Q4') in a public location, and the victim plugged it into their work computer, which then executed malicious code (e.g., autorun.inf or a malicious script) that caused erratic behavior. This is a classic example of a physical baiting attack, distinct from phishing or pretexting which rely on digital communication or fabricated scenarios.

Answer

Phishing

Answer

Pretexting

Answer

Tailgating

Question 13

A technician is setting up remote access for a user who will be traveling internationally. The user needs to access files on a Windows server using RDP. Which additional security measure should the technician implement to protect the RDP session?

Accepted Answer

Use a VPN to encrypt all traffic before initiating RDP. B is correct because RDP traffic is encrypted but not authenticated at the transport layer, making it vulnerable to man-in-the-middle attacks, especially over untrusted international networks. A VPN (e.g., IPsec or OpenVPN) provides an additional layer of encryption and authentication for the entire session before RDP traffic is sent, ensuring confidentiality and integrity even if the RDP protocol itself is compromised.

Answer

Enable Network Level Authentication (NLA) on the server

Answer

Change the RDP port to a non-standard number

Answer

Disable clipboard redirection in the RDP session

Question 14

A user reports that their browser displays a warning saying 'Your connection is not private' when visiting a frequently used banking site. After checking, you see the certificate error is for a different domain. What is the most likely cause?

Accepted Answer

A malicious proxy or DNS hijacking is redirecting traffic to a fake site. The certificate error for a different domain indicates that the browser is being directed to a server whose SSL certificate does not match the expected banking site's domain. This is a classic sign of a man-in-the-middle attack, often caused by malicious proxy or DNS hijacking, where traffic is redirected to a fraudulent server presenting a certificate for a different domain.

Answer

The user's system date and time are incorrect

Answer

The website's SSL certificate has expired

Answer

The browser needs to be updated to the latest version

Question 15

During a security audit, a technician discovers that an unauthorized person accessed a restricted server room by pretending to be a fire inspector. The person had a fake ID and clipboard. Which social engineering technique was used, and what is the best mitigation?

Accepted Answer

Pretexting; enforce visitor check-in and verification procedures.. The attacker used a fabricated identity (fake ID and clipboard) to create a false scenario—pretending to be a fire inspector—which is the hallmark of pretexting. The best mitigation is to enforce visitor check-in and verification procedures, such as requiring government-issued ID validation and escort policies, to prevent unauthorized access based on fabricated roles.

Answer

Tailgating; install mantraps at entrances.

Answer

Phishing; implement email filtering.

Answer

Baiting; disable USB ports on workstations.