220-1202 Practice Test 20 — 15 Questions

Question 1

A technician is configuring a remote desktop solution for a user who needs to access a Windows 10 Pro workstation from a Linux laptop. Which protocol should the technician ensure is enabled on the Windows machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RDP. RDP (Remote Desktop Protocol) is the native protocol used by Windows for remote desktop connections. Windows 10 Pro includes an RDP server that listens on TCP port 3389, allowing clients such as the Microsoft Remote Desktop client on Linux to connect and provide a full graphical desktop experience. The technician must ensure the 'Allow remote connections to this computer' setting is enabled and that the Windows Firewall permits inbound RDP traffic.

Answer

VNC

Answer

SSH

Answer

Telnet

Question 2

A company policy requires that all USB flash drives be encrypted before use. A technician needs to configure a new drive for a manager who will store confidential client data. Which built-in Windows tool should the technician use?

Accepted Answer

BitLocker To Go. BitLocker To Go is the correct built-in Windows tool for encrypting removable drives like USB flash drives. It provides full-disk encryption specifically designed for portable storage, ensuring that the confidential client data on the drive is protected if the drive is lost or stolen.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Firewall

Answer

Device Manager

Question 3

A small office user reports that their Windows 10 PC randomly freezes for 10-15 seconds, especially when opening large files. Task Manager shows high disk usage (100%) but low CPU and memory usage. Which built-in Windows tool should be used to diagnose the disk performance issue?

Accepted Answer

Use Resource Monitor to analyze disk activity and queue length.. Resource Monitor (resmon.exe) provides real-time metrics on disk activity, including disk queue length, average disk seconds per read/write, and per-process I/O. The user's symptom of 100% disk usage with low CPU/memory suggests a disk bottleneck; a consistently high queue length (above 2 per spindle) indicates the disk cannot keep up with I/O requests, which Resource Monitor can pinpoint directly.

Answer

Run the Performance Monitor with a Data Collector Set for disk.

Answer

Check the Event Viewer for disk-related errors.

Answer

Defragment the hard drive using the Optimize Drives tool.

Question 4

An employee finds a USB drive labeled 'Employee Bonuses Q4' in the parking lot and plugs it into their work computer to see the contents. The computer immediately begins exhibiting erratic behavior. Which social engineering attack was executed?

Accepted Answer

Baiting. Baiting. Baiting is a social engineering attack that uses a physical device (like a USB drive) or digital offer to lure a victim into taking an action that compromises security. In this scenario, the attacker left a USB drive labeled with an enticing file name ('Employee Bonuses Q4') in a public location, and the victim plugged it into their work computer, which then executed malicious code (e.g., autorun.inf or a malicious script) that caused erratic behavior. This is a classic example of a physical baiting attack, distinct from phishing or pretexting which rely on digital communication or fabricated scenarios.

Answer

Phishing

Answer

Pretexting

Answer

Tailgating

Question 5

A technician is setting up remote access for a user who will be traveling internationally. The user needs to access files on a Windows server using RDP. Which additional security measure should the technician implement to protect the RDP session?

Accepted Answer

Use a VPN to encrypt all traffic before initiating RDP. B is correct because RDP traffic is encrypted but not authenticated at the transport layer, making it vulnerable to man-in-the-middle attacks, especially over untrusted international networks. A VPN (e.g., IPsec or OpenVPN) provides an additional layer of encryption and authentication for the entire session before RDP traffic is sent, ensuring confidentiality and integrity even if the RDP protocol itself is compromised.

Answer

Enable Network Level Authentication (NLA) on the server

Answer

Change the RDP port to a non-standard number

Answer

Disable clipboard redirection in the RDP session

Question 6

A user reports that their browser displays a warning saying 'Your connection is not private' when visiting a frequently used banking site. After checking, you see the certificate error is for a different domain. What is the most likely cause?

Accepted Answer

A malicious proxy or DNS hijacking is redirecting traffic to a fake site. The certificate error for a different domain indicates that the browser is being directed to a server whose SSL certificate does not match the expected banking site's domain. This is a classic sign of a man-in-the-middle attack, often caused by malicious proxy or DNS hijacking, where traffic is redirected to a fraudulent server presenting a certificate for a different domain.

Answer

The user's system date and time are incorrect

Answer

The website's SSL certificate has expired

Answer

The browser needs to be updated to the latest version

Question 7

During a security audit, a technician discovers that an unauthorized person accessed a restricted server room by pretending to be a fire inspector. The person had a fake ID and clipboard. Which social engineering technique was used, and what is the best mitigation?

Accepted Answer

Pretexting; enforce visitor check-in and verification procedures.. The attacker used a fabricated identity (fake ID and clipboard) to create a false scenario—pretending to be a fire inspector—which is the hallmark of pretexting. The best mitigation is to enforce visitor check-in and verification procedures, such as requiring government-issued ID validation and escort policies, to prevent unauthorized access based on fabricated roles.

Answer

Tailgating; install mantraps at entrances.

Answer

Phishing; implement email filtering.

Answer

Baiting; disable USB ports on workstations.

Question 8

A customer complains that after a recent Windows update, their default web browser keeps resetting to Microsoft Edge. They want to set Google Chrome as the default. Where in the Settings app would you configure this?

Accepted Answer

Apps > Default apps. The 'Default apps' page under Apps in the Settings app is the specific location where you can change the default web browser from Microsoft Edge to Google Chrome. This setting controls which application handles protocols like HTTP and HTTPS, and it allows you to set Chrome as the default by selecting it from the list of installed browsers.

Answer

Apps > Apps & features

Answer

Personalization > Start

Answer

Update & Security > Windows Update

Question 9

A user reports that their Windows 10 PC is infected with a virus that changes the desktop background to a ransom note. After removing the virus with antivirus software, the desktop background remains unchanged. What should you do to restore the original background?

Accepted Answer

Check Group Policy settings for desktop wallpaper enforcement and reset them.. The virus likely modified the Group Policy setting that enforces a specific desktop wallpaper. Even after the virus is removed, the Group Policy setting persists and overrides any user attempts to change the background. Resetting the Group Policy wallpaper enforcement restores the user's ability to change the background normally.

Answer

Reinstall the graphics driver.

Answer

Run System File Checker (sfc /scannow).

Answer

Perform a system restore to a point before the infection.

Question 10

A security administrator needs to prevent users from running unauthorized software on Windows 10 Enterprise workstations. They want to allow only applications that are signed by approved publishers. Which Windows security feature should be configured?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is the correct feature because it enforces an application control policy that allows only executables, scripts, and installers signed by approved publishers to run. Unlike AppLocker, WDAC operates at the kernel level and can be configured via Group Policy or MDM to create a trust chain based on the publisher's digital signature, effectively blocking all unauthorized software.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker Drive Encryption

Answer

User Account Control (UAC)

Question 11

A company laptop was stolen, and the IT department needs to ensure that the data on the device cannot be accessed. The laptop had BitLocker enabled, but the drive was unlocked when stolen. What additional security measure could have prevented data access in this scenario?

Accepted Answer

Configure BitLocker with a startup PIN. BitLocker with a startup PIN requires the user to enter a PIN before the OS loads, even if the drive was previously unlocked. Since the laptop was stolen while unlocked, the PIN would have prevented the drive from being decrypted after a reboot or power loss, protecting the data from unauthorized access.

Answer

Enable Windows Defender Firewall

Answer

Use a strong user password

Answer

Enable System Restore

Question 12

A user reports that after a Windows update, their default browser keeps resetting to Microsoft Edge every time they restart the computer. They need to keep Google Chrome as the default. Which Control Panel or Settings applet should you use to permanently change this setting?

Accepted Answer

Default Apps. The Default Apps settings page (Settings > Apps > Default Apps) is the correct location in Windows 10/11 to permanently set Google Chrome as the default browser. This applet allows you to choose a specific browser for the HTTP, HTTPS, and .HTM/.HTML file associations. After a Windows update, these associations can be reset to Microsoft Edge; re-selecting Chrome here and confirming the change ensures the setting persists across reboots.

Answer

Programs and Features

Answer

Internet Options

Answer

Device Manager

Question 13

A company wants to allow external contractors to access a specific internal web application without installing any client software. Which remote access technology best meets this requirement?

Accepted Answer

Reverse proxy. A reverse proxy is the correct choice because it allows external contractors to access a specific internal web application through a public-facing proxy server without requiring any client software installation. The reverse proxy terminates the external connection and forwards requests to the internal web server, handling authentication and encryption at the proxy layer, which meets the requirement of zero client-side setup.

Answer

VPN with a client

Answer

Remote Desktop Protocol

Answer

SSH

Question 14

A company uses a web application for internal communication. A security audit reveals that the application is vulnerable to cross-site scripting (XSS). Which browser security feature can help mitigate the risk for users while the application is being patched?

Accepted Answer

Implement Content Security Policy (CSP) headers on the web server. Content Security Policy (CSP) is a browser security mechanism that allows a web server to specify which sources of content (scripts, styles, images, etc.) are trusted. By implementing CSP headers (e.g., Content-Security-Policy: script-src 'self'), the server instructs the browser to block inline scripts and other potentially malicious content, effectively mitigating XSS attacks even before the application code is patched. CSP operates as a defense-in-depth layer that the browser enforces, reducing the attack surface for users.

Answer

Enable pop-up blocker

Answer

Configure the browser to use a proxy server

Answer

Disable JavaScript in the browser

Question 15

A user reports that their Windows 10 laptop shows a blue screen with an error message about 'Driver IRQL not less or equal' after connecting a new external hard drive. They need to use the drive for work. Which security setting should you check to ensure driver installation is not blocked?

Accepted Answer

Disable Driver Signature Enforcement temporarily.. The 'Driver IRQL not less or equal' blue screen error typically indicates a faulty or unsigned driver. Disabling Driver Signature Enforcement (Option C) allows the installation of an unsigned driver, which is often necessary for older or third-party hardware like an external hard drive. This directly addresses the driver installation being blocked by Windows' driver signature requirements.

Answer

Check if Secure Boot is enabled in UEFI.

Answer

Verify that User Account Control is set to 'Notify me only when apps try to make changes.'

Answer

Run Windows Update to find a signed driver.