220-1202 Practice Test 19 — 15 Questions

Question 1

A technician receives an angry email from a user claiming that the technician's previous fix made their computer worse. The technician knows the fix was correct. Which response is MOST professional?

Accepted Answer

Apologize for the inconvenience and schedule a time to revisit the issue.. The most professional response in this scenario is to de-escalate the situation by acknowledging the user's frustration and offering to re-engage on the issue. Even if the technician's fix was technically correct, the user's perception of a problem is a valid concern that must be addressed to maintain trust and service quality. Scheduling a follow-up allows the technician to re-evaluate the system, verify that no other changes have affected the computer, and provide reassurance, which aligns with ITIL best practices for incident management and customer service.

Answer

Reply with a detailed technical explanation proving the fix was right.

Answer

Ignore the email to avoid an argument.

Answer

Forward the email to the user's manager to complain about the user's tone.

Question 2

A user is unable to install a new app on their Android tablet because the device claims there is 'insufficient storage,' even though they have deleted several large files. What is the most likely reason for this error?

Accepted Answer

The deleted files are still in the recycle bin or trash folder, taking up space.. On Android devices, deleted files are moved to a recycle bin or trash folder (e.g., in the Files by Google app or the Gallery app's trash), not permanently erased. The system still counts these files as occupied storage until the trash is emptied, so even after deleting large files, the available space remains unchanged, causing the 'insufficient storage' error during app installation.

Answer

The device's SD card is corrupted.

Answer

The app is incompatible with the Android version.

Answer

The tablet's battery is too low to complete the installation.

Question 3

A technician is configuring a new Windows 10 workstation for a user who is visually impaired. The user needs the screen magnifier to start automatically when they log in, and they want high-contrast themes. Which Control Panel tool should the technician use to enable these accessibility features?

Accepted Answer

Ease of Access Center. The Ease of Access Center in Windows 10 is the dedicated Control Panel tool for configuring accessibility features, including Magnifier and high-contrast themes. It provides settings to enable Magnifier to start automatically at login and to apply high-contrast themes system-wide, directly addressing the user's needs.

Answer

System > Advanced system settings

Answer

Personalization

Answer

Display

Question 4

A technician is preparing to replace a failed hard drive in a server that hosts a critical database. The change requires a planned downtime of two hours. Which documentation must the technician review before proceeding?

Accepted Answer

The approved change request and the backout plan.. Before performing any hardware replacement that requires planned downtime, the technician must review the approved change request to confirm the change has been authorized and to understand the scope, risk, and implementation steps. The backout plan is equally critical as it provides the documented steps to revert the server to its previous state if the replacement fails, ensuring database integrity and minimizing extended downtime. This aligns with ITIL change management best practices and CompTIA A+ 220-1202 objectives for documentation review during hardware maintenance.

Answer

The server's warranty information.

Answer

The network topology diagram.

Answer

The employee handbook.

Question 5

A user calls the help desk claiming they received an urgent email from the CEO asking them to purchase gift cards for a client and reply with the codes. The user is suspicious because the email address looks slightly off. What type of social engineering attack is this?

Accepted Answer

Phishing. This is a phishing attack because the attacker impersonates a trusted entity (the CEO) via email to trick the user into performing a fraudulent action (purchasing gift cards and sharing codes). The suspicious email address indicates a spoofed sender, a common phishing technique that exploits trust and urgency to bypass user skepticism.

Answer

Shoulder surfing

Answer

Tailgating

Answer

Dumpster diving

Question 6

A user reports that their Windows 10 PC displays a 'Low Disk Space' warning on the C: drive. You want to use a built-in tool to delete temporary files and empty the Recycle Bin. Which Settings page should you open?

Accepted Answer

System > Storage. The 'Low Disk Space' warning on the C: drive can be resolved by using the built-in Storage Sense or the manual 'Free up space now' feature, both accessible under System > Storage. This page provides tools to delete temporary files, empty the Recycle Bin, and remove other unnecessary data to reclaim disk space without third-party software.

Answer

System > About

Answer

Apps > Apps & features

Answer

Update & Security > Windows Update

Question 7

A small business is deploying a new accounting application across five workstations. The IT lead creates a detailed change request that includes the purpose, scope, risk assessment, and rollback plan. Which document should the IT lead update immediately after the deployment is successfully completed?

Accepted Answer

The change request form. The change request form is the central document that tracks the entire lifecycle of a change, including planning, approval, implementation, and post-implementation review. Once the deployment is successfully completed, the IT lead must update the change request form to mark it as 'Closed' or 'Completed,' documenting the actual outcome, any deviations, and the final status. This ensures an accurate audit trail for compliance and future troubleshooting, as required by ITIL-based change management processes.

Answer

The firewall configuration log

Answer

The employee handbook

Answer

The backup verification checklist

Question 8

During a routine security audit, a technician discovers that a user's computer has a program that opens a backdoor on port 4444 and allows remote control. The program was installed alongside a free PDF converter the user downloaded last week. Which malware type is this, and what is the most effective removal method?

Accepted Answer

Trojan horse; boot into Safe Mode and run a full anti-malware scan.. The program is a Trojan horse because it disguises itself as a legitimate PDF converter while secretly installing a backdoor. The most effective removal method is to boot into Safe Mode, which loads only essential drivers and services, preventing the Trojan from running, and then perform a full anti-malware scan to detect and remove the malicious files.

Answer

Worm; use a network-based firewall to block port 4444.

Answer

Ransomware; pay the ransom to regain control.

Answer

Rootkit; perform a clean installation of Windows.

Question 9

After deploying a new Windows 11 update, several users complain that they can no longer access shared folders on the network. You verify that network discovery and file sharing are enabled. Which Windows security setting should you check first to resolve this issue?

Accepted Answer

Review Windows Defender Firewall rules for 'File and Printer Sharing.'. After a Windows 11 update, the most common cause for losing access to shared folders—even when network discovery and file sharing are enabled—is that the Windows Defender Firewall rules for 'File and Printer Sharing' have been reset or disabled. This update often modifies firewall profiles (e.g., switching from Private to Public) or resets custom rules, blocking the NetBIOS, SMB, and RPC ports (TCP 139, 445; UDP 137, 138) required for file sharing. Checking and re-enabling these inbound rules restores connectivity.

Answer

Check if the users are in the 'Remote Desktop Users' group.

Answer

Verify that the 'Password Protected Sharing' option is turned off.

Answer

Run Windows Update to install additional patches.

Question 10

A technician receives a complaint from a user that their email account was used to send spam. The user insists they did not send the emails. What is the MOST appropriate first step in handling this security incident professionally?

Accepted Answer

Immediately reset the user's password and check the email logs for unauthorized access.. The immediate reset of the user's password stops further unauthorized use of the account, and checking email logs (e.g., SMTP logs, IMAP/POP3 access logs, or Exchange/Office 365 audit logs) allows the technician to identify the source of the spam, such as a compromised credential or a malicious forwarding rule. This follows the CompTIA A+ incident response procedure of containment first, then investigation, while maintaining professional communication with the user.

Answer

Tell the user they must have clicked on a phishing link and it's their fault.

Answer

Ignore the complaint because spam is common.

Answer

Ask the user to change their password and not worry about it.

Question 11

You are troubleshooting a Windows 10 PC that fails to boot with the error 'Boot Configuration Data is missing.' Which built-in tool can you use from the Windows Recovery Environment to rebuild the BCD store?

Accepted Answer

Bootrec.exe. Bootrec.exe is the correct built-in tool for rebuilding the Boot Configuration Data (BCD) store from the Windows Recovery Environment (WinRE). The specific command 'bootrec /rebuildbcd' scans all disks for Windows installations and allows you to rebuild the BCD store, directly addressing the 'Boot Configuration Data is missing' error. Other tools like SFC, Diskpart, and CHKDSK do not have the capability to reconstruct the BCD store.

Answer

System File Checker (sfc /scannow)

Answer

Diskpart

Answer

CHKDSK

Question 12

A network administrator is configuring a new wireless network for a hospital that requires the highest level of security for patient data. The network must support 802.1X authentication with smart cards. Which combination of security protocols and authentication methods should be used?

Accepted Answer

WPA2-Enterprise with EAP-TLS.. WPA2-Enterprise with EAP-TLS provides the highest level of security for a hospital network requiring 802.1X authentication with smart cards. EAP-TLS uses mutual authentication via digital certificates (which can be stored on smart cards), eliminating the risk of credential theft or man-in-the-middle attacks. WPA2-Enterprise is the appropriate underlying encryption framework for this scenario, as it supports the required 802.1X/EAP integration.

Answer

WPA2-PSK with PEAP-MSCHAPv2.

Answer

WPA3-Personal with SAE.

Answer

WPA3-Enterprise with EAP-TTLS.

Question 13

During a security audit, a Linux server is found to have a configuration file that is world-writable. The file /etc/app/config.cfg must only be readable and writable by the root user. Which command should the administrator run?

Accepted Answer

chmod 600 /etc/app/config.cfg. `chmod 600` sets the file permissions to read and write for the owner (root) and no permissions for group or others. This satisfies the requirement that only root can read and write `/etc/app/config.cfg`, as root is the owner of the file.

Answer

chmod 777 /etc/app/config.cfg

Answer

chmod 644 /etc/app/config.cfg

Answer

chmod 400 /etc/app/config.cfg

Question 14

A technician is tasked with replacing a faulty power supply in a desktop computer that is part of a critical patient record system at a clinic. Before starting, the technician reviews the change management policy. Which step should the technician perform first?

Accepted Answer

Submit a change request to the change advisory board (CAB). The change management policy requires that any modification to a system handling critical patient records must first be formally approved via a change request submitted to the Change Advisory Board (CAB). This ensures that risks are assessed, downtime is scheduled, and compliance with healthcare data regulations (e.g., HIPAA) is maintained before any physical work begins.

Answer

Power off the workstation and disconnect all cables

Answer

Back up the patient records to an external drive

Answer

Notify the clinic staff that the system will be offline

Question 15

A technician is cleaning a computer that has been infected with a rootkit. After running a standard antivirus scan, the malware is still detected on reboot. Which step should the technician take next to ensure complete removal?

Accepted Answer

Boot from a rescue disk and run a malware scan.. Rootkits are designed to hide from the operating system and standard antivirus tools by intercepting system calls and loading before the OS security components. Booting from a rescue disk (e.g., a Linux live CD or a dedicated antivirus rescue ISO) bypasses the infected OS entirely, allowing the scanner to access the file system without the rootkit actively masking its presence. This ensures the malware cannot interfere with the scan, enabling complete detection and removal.

Answer

Perform a clean installation of Windows.

Answer

Disable System Restore and run the antivirus again.

Answer

Run the antivirus in Safe Mode.