220-1202 Practice Test 20 — 15 Questions

Question 1

A technician is helping a user who accidentally installed a potentially unwanted program (PUP) that changed their browser homepage and search engine. The user is embarrassed and asks the technician not to tell their manager. What is the most ethical response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Explain that you will remove the PUP but must document the incident per company policy, though you will not share unnecessary details.. It balances the user's privacy concern with the technician's professional obligation to follow company policy. Documenting the incident (e.g., in a help desk ticket) is standard procedure for tracking PUP infections, which may indicate broader security issues like drive-by downloads or social engineering. The technician can remove the PUP using tools like Malwarebytes or AdwCleaner while omitting the user's name from unnecessary reports, preserving trust without violating policy.

Answer

Agree not to tell the manager and remove the PUP quietly.

Answer

Tell the user that this is a serious security breach and you have to report it immediately.

Answer

Ignore the request and report the user to HR for violating IT policy.

Question 2

A technician is documenting a configuration change to a firewall rule that allows remote access for a new employee. The technician must ensure the documentation is clear for future audits. Which of the following is the most critical piece of information to include?

Accepted Answer

The business justification for the rule.. Change management documentation must include the business justification to demonstrate that the change was authorized and necessary. Without a clear reason, auditors cannot verify that the firewall rule complies with organizational security policy or regulatory requirements. The business justification provides the context needed to distinguish legitimate changes from unauthorized or malicious modifications.

Answer

The exact date and time the rule was added.

Answer

The IP address of the new employee's remote location.

Answer

The name of the technician who made the change.

Question 3

A user reports that their Windows 10 laptop suddenly shows a black screen with a movable mouse cursor after logging in. They can press Ctrl+Alt+Del to open the security screen. Which troubleshooting step should you perform first to restore the desktop?

Accepted Answer

Press Ctrl+Alt+Del, open Task Manager, then run a new task and type 'explorer.exe'.. A black screen with a cursor after login often indicates that the Windows Explorer shell (explorer.exe) has crashed or is not starting properly. Using Task Manager to manually restart the explorer.exe process is a quick and non-destructive first step that often resolves the issue without rebooting.

Answer

Boot into Safe Mode and run System File Checker (sfc /scannow).

Answer

Perform a system restore to a point before the issue started.

Answer

Check the display driver by pressing Windows+P and switching display modes.

Question 4

A user needs to connect to a work VPN but cannot find the VPN settings in the network tray. You need to guide them to the correct location to add a VPN connection. Where in Windows Settings would you direct them?

Accepted Answer

Network & Internet > VPN. The VPN settings in Windows are located under Network & Internet > VPN. This is the dedicated section where users can add, configure, and manage VPN connections, including setting up a new VPN profile with the server address, authentication method, and protocol (e.g., IKEv2, SSTP, or L2TP/IPsec). The network tray only shows existing connections; to add a new VPN, you must navigate to this specific settings page.

Answer

Network & Internet > Status

Answer

Network & Internet > Ethernet

Answer

Network & Internet > Proxy

Question 5

A technician needs to write a script that runs a specific command only if a Windows service is running. If the service is stopped, the script should start it first. Which scripting method is most appropriate?

Accepted Answer

Use an if-else statement to check the service status.. An if-else statement is the most appropriate scripting method to check the status of a specific Windows service and conditionally execute a command or start the service. In PowerShell, you can use `Get-Service` to retrieve the service status and then an if-else block to evaluate whether the `Status` property equals 'Running'. This provides clear, linear logic that directly matches the requirement without unnecessary complexity.

Answer

Use a for loop to iterate over all services.

Answer

Use a switch statement with multiple conditions.

Answer

Use a try-catch block to handle errors if the command fails.

Question 6

A technician is writing a PowerShell script to check the last boot time of a remote computer. The script uses Get-CimInstance Win32_OperatingSystem. The script works locally but fails with an access denied error when targeting a remote machine. Both computers are domain-joined and the technician has admin rights. What is the most likely issue?

Accepted Answer

The remote computer has Windows Firewall blocking WMI traffic.. Get-CimInstance uses the WS-Management (WSMan) protocol, which relies on WinRM. By default, Windows Firewall blocks inbound WinRM traffic on port 5985 (HTTP) and 5986 (HTTPS). Even though the technician has admin rights and both machines are domain-joined, the remote firewall must allow WinRM traffic for the CIM session to succeed. The local success is because no firewall traversal is needed.

Answer

The remote computer does not have PowerShell installed.

Answer

The script uses an incorrect namespace.

Answer

The technician is not a member of the Remote Management Users group.

Question 7

During a wireless site survey, a technician discovers that an employee has set up a personal wireless router in their cubicle, connected to the corporate network. This rogue access point is broadcasting an open SSID. Which security risk is most immediately concerning?

Accepted Answer

The rogue AP provides an unencrypted entry point for attackers to access the corporate network.. The most immediate security risk of a rogue access point broadcasting an open SSID is that it provides an unencrypted entry point into the corporate network. Any attacker within range can associate with the open SSID and, because the AP is connected to the corporate LAN, gain direct access to internal resources without authentication or encryption, bypassing perimeter security controls.

Answer

The rogue AP may cause radio frequency interference with the corporate WLAN.

Answer

The rogue AP will consume additional power from the corporate UPS.

Answer

The rogue AP's DHCP server may conflict with the corporate DHCP server.

Question 8

A small business owner reports that all their employees are receiving emails from each other containing a link that, when clicked, downloads a file that installs a program that spreads to other contacts. The emails appear to come from known senders. What type of malware is this?

Accepted Answer

Worm. (Worm) because the malware self-replicates by sending copies of itself via email to all contacts without requiring user action beyond clicking the link. Unlike a virus, it does not need to attach to a host file; it spreads autonomously over the network using the email system as a transport mechanism.

Answer

Virus

Answer

Trojan horse

Answer

Rootkit

Question 9

A technician is asked to install a new accounting application on a user's computer. The user mentions that a coworker told them the software is known to cause conflicts with antivirus programs. What should the technician do?

Accepted Answer

Research the software's compatibility with the antivirus and test in a sandbox if possible.. The technician must validate the user's concern through proper research rather than dismissing it. Checking the software's documented compatibility with the specific antivirus program and testing in an isolated sandbox environment prevents potential system instability or security bypasses without risking the production system.

Answer

Ignore the user's comment because it is hearsay and proceed with the installation.

Answer

Disable the antivirus temporarily and install the software.

Answer

Tell the user that the coworker is mistaken and install the software anyway.

Question 10

A technician is configuring a kiosk mode on a company-owned Android tablet for customer use. After enabling the dedicated device management app, the tablet still allows users to exit the kiosk app by pressing the home button. Which setting did the technician MOST likely overlook?

Accepted Answer

The 'Lock task mode' or 'Pin app' feature.. The technician enabled the dedicated device management app but did not activate Android's 'Lock task mode' (or 'Pin app' feature). This mode is required to pin the kiosk app to the foreground and block system navigation keys (Home, Recent Apps), preventing users from exiting the app. Without it, the Home button remains functional, allowing escape from the kiosk environment.

Answer

The tablet's screen timeout setting.

Answer

The tablet's Wi-Fi configuration.

Answer

The device's date and time settings.

Question 11

A user reports that their Windows 10 PC is running slowly and they suspect too many programs start automatically. Which tool in the Settings app would you use to disable unnecessary startup programs?

Accepted Answer

Apps > Startup. The Apps > Startup page in the Windows 10 Settings app provides a list of all startup programs with toggle switches to enable or disable them. This directly addresses the user's issue of too many programs launching automatically, which can slow down boot time and overall performance. The tool shows the impact of each startup item (e.g., 'High', 'Medium', 'Low') to help prioritize which to disable.

Answer

System > About

Answer

Devices > Bluetooth & other devices

Answer

Update & Security > Troubleshoot

Question 12

A small business wants to prevent unauthorized individuals from following employees through a secure entrance after badge access is granted. Which physical security control is specifically designed to address this threat?

Accepted Answer

Deploy a mantrap. A mantrap is a physical security control consisting of two interlocking doors with a small vestibule between them. It prevents tailgating by allowing only one person to enter at a time; the first door must close and lock before the second door can open, ensuring that only the authenticated individual passes through.

Answer

Install a biometric fingerprint scanner

Answer

Use a proximity card reader

Answer

Add a security guard

Question 13

A technician is investigating a security breach where sensitive customer data was exfiltrated. The only malware found is a hidden driver that intercepts keystrokes and sends them to a remote server. Which malware type is responsible, and what is the best removal strategy?

Accepted Answer

Keylogger; use a rescue disk to boot and run an anti-rootkit scanner.. The malware is a hidden driver that intercepts keystrokes and sends them to a remote server, which is the classic behavior of a keylogger. Because it is a driver, it likely operates at the kernel level, making it a rootkit. Standard antivirus scans may miss it because the OS is compromised, so the best removal strategy is to boot from a rescue disk (clean OS) and run an anti-rootkit scanner to detect and remove the driver without the rootkit hiding itself.

Answer

Spyware; remove by running a standard antivirus scan.

Answer

Ransomware; restore from backup.

Answer

Adware; uninstall suspicious programs from Control Panel.

Question 14

A technician is deploying 20 new laptops to a department. The manager asks the technician to install the software quickly, but the technician knows that a full deployment includes user training and data migration. Which action BEST demonstrates professional communication?

Accepted Answer

Explain the standard deployment process and offer a revised timeline that includes training.. It demonstrates professional communication by clearly explaining the standard deployment process—which includes user training and data migration—and offering a revised timeline. This aligns with the CompTIA A+ objective of managing expectations and ensuring a complete, effective rollout rather than a rushed, incomplete installation.

Answer

Agree to the manager's request and rush the installation to avoid conflict.

Answer

Install the software and let the users figure out the rest on their own.

Answer

Tell the manager that training is not part of the technician's job.

Question 15

A technician is investigating a security incident where a user's credentials were stolen. The user says they only logged into their email from a coffee shop Wi-Fi. The technician notices that the browser was not using HTTPS for the login page. What is the most likely attack method used?

Accepted Answer

Man-in-the-middle attack.. On an open Wi-Fi network, an attacker can perform a man-in-the-middle attack to intercept unencrypted HTTP traffic. Without HTTPS, the login credentials are sent in plaintext and can be captured easily. This is a common risk on public Wi-Fi.

Answer

Cross-site scripting (XSS) attack.

Answer

DNS spoofing attack.

Answer

Brute force attack.