220-1202 Practice Test 19 — 15 Questions

Question 1

A user reports that after a recent Windows update, their computer now boots to a blue screen with the error 'INACCESSIBLE_BOOT_DEVICE'. They need to get back to work quickly. Which Windows recovery tool should you use first to attempt a repair?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Startup Repair. The 'INACCESSIBLE_BOOT_DEVICE' error often indicates a driver or disk configuration issue caused by an update. The Startup Repair tool in the Windows Recovery Environment (WinRE) can automatically diagnose and fix common boot problems like this. It is the safest and fastest initial step before trying more invasive methods.

Answer

System Restore

Answer

Reset this PC

Answer

Command Prompt (chkdsk /f)

Question 2

A customer complains that after a recent Windows update, their default web browser keeps resetting to Microsoft Edge. They want to set Google Chrome as the default. Where in the Settings app would you configure this?

Accepted Answer

Apps > Default apps. The 'Default apps' page under Apps in the Settings app is the specific location where you can change the default web browser from Microsoft Edge to Google Chrome. This setting controls which application handles protocols like HTTP and HTTPS, and it allows you to set Chrome as the default by selecting it from the list of installed browsers.

Answer

Apps > Apps & features

Answer

Personalization > Start

Answer

Update & Security > Windows Update

Question 3

A user reports that their Windows 10 PC is infected with a virus that changes the desktop background to a ransom note. After removing the virus with antivirus software, the desktop background remains unchanged. What should you do to restore the original background?

Accepted Answer

Check Group Policy settings for desktop wallpaper enforcement and reset them.. The virus likely modified the Group Policy setting that enforces a specific desktop wallpaper. Even after the virus is removed, the Group Policy setting persists and overrides any user attempts to change the background. Resetting the Group Policy wallpaper enforcement restores the user's ability to change the background normally.

Answer

Reinstall the graphics driver.

Answer

Run System File Checker (sfc /scannow).

Answer

Perform a system restore to a point before the infection.

Question 4

A security administrator needs to prevent users from running unauthorized software on Windows 10 Enterprise workstations. They want to allow only applications that are signed by approved publishers. Which Windows security feature should be configured?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is the correct feature because it enforces an application control policy that allows only executables, scripts, and installers signed by approved publishers to run. Unlike AppLocker, WDAC operates at the kernel level and can be configured via Group Policy or MDM to create a trust chain based on the publisher's digital signature, effectively blocking all unauthorized software.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker Drive Encryption

Answer

User Account Control (UAC)

Question 5

A company laptop was stolen, and the IT department needs to ensure that the data on the device cannot be accessed. The laptop had BitLocker enabled, but the drive was unlocked when stolen. What additional security measure could have prevented data access in this scenario?

Accepted Answer

Configure BitLocker with a startup PIN. BitLocker with a startup PIN requires the user to enter a PIN before the OS loads, even if the drive was previously unlocked. Since the laptop was stolen while unlocked, the PIN would have prevented the drive from being decrypted after a reboot or power loss, protecting the data from unauthorized access.

Answer

Enable Windows Defender Firewall

Answer

Use a strong user password

Answer

Enable System Restore

Question 6

A user reports that after a Windows update, their default browser keeps resetting to Microsoft Edge every time they restart the computer. They need to keep Google Chrome as the default. Which Control Panel or Settings applet should you use to permanently change this setting?

Accepted Answer

Default Apps. The Default Apps settings page (Settings > Apps > Default Apps) is the correct location in Windows 10/11 to permanently set Google Chrome as the default browser. This applet allows you to choose a specific browser for the HTTP, HTTPS, and .HTM/.HTML file associations. After a Windows update, these associations can be reset to Microsoft Edge; re-selecting Chrome here and confirming the change ensures the setting persists across reboots.

Answer

Programs and Features

Answer

Internet Options

Answer

Device Manager

Question 7

A company wants to allow external contractors to access a specific internal web application without installing any client software. Which remote access technology best meets this requirement?

Accepted Answer

Reverse proxy. A reverse proxy is the correct choice because it allows external contractors to access a specific internal web application through a public-facing proxy server without requiring any client software installation. The reverse proxy terminates the external connection and forwards requests to the internal web server, handling authentication and encryption at the proxy layer, which meets the requirement of zero client-side setup.

Answer

VPN with a client

Answer

Remote Desktop Protocol

Answer

SSH

Question 8

A company uses a web application for internal communication. A security audit reveals that the application is vulnerable to cross-site scripting (XSS). Which browser security feature can help mitigate the risk for users while the application is being patched?

Accepted Answer

Implement Content Security Policy (CSP) headers on the web server. Content Security Policy (CSP) is a browser security mechanism that allows a web server to specify which sources of content (scripts, styles, images, etc.) are trusted. By implementing CSP headers (e.g., Content-Security-Policy: script-src 'self'), the server instructs the browser to block inline scripts and other potentially malicious content, effectively mitigating XSS attacks even before the application code is patched. CSP operates as a defense-in-depth layer that the browser enforces, reducing the attack surface for users.

Answer

Enable pop-up blocker

Answer

Configure the browser to use a proxy server

Answer

Disable JavaScript in the browser

Question 9

A user reports that their Windows 10 laptop shows a blue screen with an error message about 'Driver IRQL not less or equal' after connecting a new external hard drive. They need to use the drive for work. Which security setting should you check to ensure driver installation is not blocked?

Accepted Answer

Disable Driver Signature Enforcement temporarily.. The 'Driver IRQL not less or equal' blue screen error typically indicates a faulty or unsigned driver. Disabling Driver Signature Enforcement (Option C) allows the installation of an unsigned driver, which is often necessary for older or third-party hardware like an external hard drive. This directly addresses the driver installation being blocked by Windows' driver signature requirements.

Answer

Check if Secure Boot is enabled in UEFI.

Answer

Verify that User Account Control is set to 'Notify me only when apps try to make changes.'

Answer

Run Windows Update to find a signed driver.

Question 10

During a routine security audit, a technician discovers that a user's workstation has a program that records keystrokes and periodically sends the data to an external server. The user denies installing any software recently. Which type of malware is this?

Accepted Answer

Keylogger. The program described records keystrokes and exfiltrates them to an external server, which is the defining behavior of a keylogger. This type of malware captures user input, such as usernames and passwords, and sends the data to an attacker. The user's denial of installing software suggests the keylogger may have been delivered stealthily, often via a Trojan horse or drive-by download, but the core functionality is keylogging.

Answer

Trojan horse

Answer

Worm

Answer

Ransomware

Question 11

A company's login script uses a batch file that calls multiple other scripts. Recently, the script stopped working after a Windows update. The technician discovers that the script uses 'call' to run sub-scripts, but one of the sub-scripts contains an 'exit' command that terminates the entire batch process. How should the technician modify the sub-script to prevent this?

Accepted Answer

Change 'exit' to 'exit /b'. The 'exit' command without parameters terminates the entire command interpreter (cmd.exe), which kills the parent batch file as well. Using 'exit /b' instead exits only the current batch script or subroutine, returning control to the calling script. This preserves the intended flow when sub-scripts are invoked via 'call'.

Answer

Replace 'exit' with 'goto :eof'

Answer

Remove the 'exit' command entirely

Answer

Use 'endlocal' before 'exit'

Question 12

A user reports that their computer's hard drive is making clicking noises and they cannot access certain files. You want to check the disk for errors and attempt to repair any bad sectors. Which command should you run from an elevated command prompt?

Accepted Answer

chkdsk /r. The correct command is `chkdsk /r` because it locates bad sectors on the hard drive and recovers readable information from them. The `/r` switch implies `/f` (which fixes file system errors) and additionally performs a surface scan to identify and mark bad sectors, directly addressing the clicking noise and file access issue.

Answer

chkdsk /f

Answer

sfc /scannow

Answer

diskpart

Question 13

A user reports that their Windows 10 laptop shows a 'Your license will expire soon' watermark on the desktop, even though they purchased a retail license key. You need to resolve the activation issue. Which Control Panel applet should you use first?

Accepted Answer

System. The System applet (Control Panel > System) provides direct access to the Windows activation status and the 'Change product key' option. Since the user already has a retail license key, the first troubleshooting step is to verify the current activation state and re-enter the key via this applet, which triggers a re-activation with Microsoft's licensing servers.

Answer

Device Manager

Answer

Programs and Features

Answer

User Accounts

Question 14

During a security audit, you discover that a user’s Windows 10 device has allowed multiple failed login attempts without locking the account. Which policy should you adjust to enforce account lockout after 5 failed attempts?

Accepted Answer

Account Lockout Policy – Account lockout threshold. The Account Lockout Policy – Account lockout threshold setting directly controls the number of failed logon attempts allowed before the account is locked. By setting this value to 5, the system will enforce a lockout after exactly five incorrect password entries, preventing further brute-force attempts until an administrator unlocks the account or the lockout duration expires.

Answer

Password Policy – Minimum password length

Answer

User Rights Assignment – Deny log on locally

Answer

Security Options – Interactive logon: Message text for users attempting to log on

Question 15

A user calls the help desk saying they cannot log into their Windows 10 workstation because a message claims their files are encrypted and they must pay a ransom. What is the most effective remediation approach?

Accepted Answer

Disconnect from the network and restore files from a verified backup. Ransomware encrypts files with a key known only to the attacker, making decryption without the key impossible. Disconnecting from the network prevents the ransomware from spreading to other systems, and restoring from a verified backup is the only reliable way to recover the original files without paying the ransom.

Answer

Pay the ransom to get the decryption key

Answer

Reboot into Safe Mode and run a malware scan

Answer

Run System Restore to a point before the attack