220-1202 Practice Test 2 — 10 Questions

Question 1

A technician is troubleshooting a Windows 10 PC that was infected with a rootkit. After booting from a rescue disk and running a scan, the rootkit is removed, but the system is still unstable. What should the technician do next to ensure the system is fully remediated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the System File Checker (SFC) tool to repair corrupted files.. After removing a rootkit, the system may have corrupted system files that cause instability. Running the System File Checker (SFC) tool with the 'sfc /scannow' command scans protected system files and replaces corrupted versions with cached copies from the Windows side-by-side store, directly addressing file integrity issues left by the rootkit.

Answer

Reinstall the operating system from scratch.

Answer

Disable System Restore and delete all restore points.

Answer

Perform a disk cleanup to remove temporary files.

Question 2

A user reports that their Windows 10 PC is infected with malware that prevents the Task Manager from opening. You need to terminate a suspicious process from the command line. Which command should you use to forcefully end a process by its name?

Accepted Answer

taskkill /IM malware.exe /F. The `taskkill` command with the `/IM` (image name) parameter targets a process by its executable name, and the `/F` flag forcefully terminates it. This is the appropriate tool when Task Manager is disabled by malware, as it directly ends the process from the command line without relying on GUI interaction.

Answer

tasklist /v

Answer

shutdown /r /t 0

Answer

regedit /e backup.reg

Question 3

A company is experiencing a security incident where an attacker gained access to the internal network via a compromised VPN account. The technician must prevent future attacks. Which two-factor authentication method should the technician implement for VPN access?

Accepted Answer

Implement a time-based one-time password (TOTP) via an authenticator app. Two-factor authentication (2FA) adds a second factor beyond the password, such as a one-time code from an authenticator app. This significantly reduces the risk of account compromise even if the password is stolen.

Answer

Require a complex password with a minimum length of 20 characters

Answer

Restrict VPN access to specific IP addresses

Answer

Enable single sign-on (SSO) with Active Directory

Question 4

A technician is troubleshooting a user's inability to access a specific website. The user can access other websites without issue. The technician wants to check the route packets take to the problematic server and identify where the connection fails. Which command should be used?

Accepted Answer

tracert example.com. The `tracert` command (short for 'trace route') is the correct tool because it sends ICMP Echo Request packets with incrementally increasing TTL (Time to Live) values, causing each router along the path to reply with an ICMP Time Exceeded message. This reveals the exact hop-by-hop path to the destination and pinpoints where the connection fails, which is precisely what the technician needs to diagnose a site-specific outage.

Answer

ping -t example.com

Answer

nslookup example.com

Answer

netstat -an

Question 5

A user reports that their Windows 10 PC is infected with malware that keeps reinstalling after removal. You need to boot into a minimal environment to run antivirus scans without malware interference. Which advanced startup option should you use?

Accepted Answer

Safe Mode. Safe Mode (B) loads Windows with a minimal set of drivers and services, preventing malware that runs as a startup program or service from loading. This allows antivirus software to scan and remove the infection without interference, addressing the scenario where malware reinstalls after removal in a normal boot.

Answer

Enable Boot Logging

Answer

Last Known Good Configuration

Answer

Debugging Mode

Question 6

A technician is tasked with securing a shared office printer that stores sensitive documents on its hard drive. The printer is in an open area. Which physical security measure should be prioritized to protect the data on the printer?

Accepted Answer

Place the printer in a locked room. The most effective physical security measure to protect sensitive data on a printer's hard drive in an open area is to control physical access to the device itself. Placing the printer in a locked room prevents unauthorized individuals from physically removing the hard drive or accessing the printer's internal components, which is the primary threat in an open area. While encryption and secure release are important, they do not mitigate the risk of physical theft or tampering with the storage medium.

Answer

Enable secure print release with a PIN

Answer

Encrypt the printer's hard drive

Answer

Use a cable lock on the printer

Question 7

A user reports that their Windows 10 PC is running slowly and they see many background processes in Task Manager. You need to identify which processes are consuming the most CPU and memory resources without installing any additional software. Which built-in Windows tool should you use?

Accepted Answer

Task Manager. Task Manager (Option C) is the correct built-in tool because it provides a real-time, sortable list of all running processes, displaying their CPU and memory usage directly on the Processes tab. This allows you to quickly identify which processes are consuming the most resources without needing to install additional software, as the user specifically requested.

Answer

Performance Monitor

Answer

Resource Monitor

Answer

System Configuration (msconfig)

Question 8

A user has accidentally deleted several important files from their Documents folder on their Mac running macOS Ventura. They need to recover them immediately. Which built-in macOS tool should you guide them to use first?

Accepted Answer

The Trash folder in the Dock.. When files are deleted from the Documents folder on macOS, they are first moved to the Trash, not permanently erased. The Trash folder in the Dock provides immediate access to these files, allowing the user to drag them back to their original location or use the 'Put Back' context menu option. This is the fastest and simplest recovery method before considering any backup or advanced tools.

Answer

Time Machine from the menu bar.

Answer

Terminal with the 'cd' and 'ls' commands.

Answer

System Settings > General > Storage.

Question 9

A user reports that their Android phone's battery drains rapidly after a recent app update. They have already tried restarting the device. Which of the following should a technician recommend FIRST to diagnose the issue?

Accepted Answer

Check battery usage in Settings to identify the app consuming the most power.. The first step in diagnosing rapid battery drain after an app update is to use the built-in battery usage tool in Android Settings. This tool provides a per-app breakdown of power consumption, allowing the technician to identify which specific app is consuming excessive energy without making invasive changes. Restarting the device already failed to resolve the issue, so checking battery stats is the logical next step before any destructive or restrictive actions.

Answer

Perform a factory reset.

Answer

Replace the battery immediately.

Answer

Disable all background data.

Question 10

A user on a corporate iOS device complains that they cannot install a required business app from the App Store because the device is 'supervised' and shows a message that installation is blocked. What is the most likely reason and solution?

Accepted Answer

The device has a configuration profile that disables App Store installs; update the MDM policy. The 'supervised' status on iOS devices is an MDM-enforced mode that allows granular restrictions. The error message about installation being blocked indicates a configuration profile or MDM policy specifically disables App Store installations. Updating the MDM policy to allow installs is the correct solution, as it directly addresses the restriction without compromising supervision.

Answer

The user needs to sign out of iCloud and sign back in

Answer

Perform a factory reset to remove supervision

Answer

Enable 'Allow Untrusted Shortcuts' in Settings