220-1202 Practice Exam 2 — 20 Questions

Question 1

A user reports that a VBScript logon script that maps network drives stopped working after a Windows update. The script uses the MapNetworkDrive method. Other scripts on the same computer work fine. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The update disabled VBScript execution for security reasons.. Recent Windows updates have tightened security around legacy scripting hosts, including cscript.exe and wscript.exe. Specifically, Microsoft has introduced a default behavior that blocks VBScript execution via the Windows Script Host unless explicitly allowed by Group Policy or registry settings. Since the user reports that only the VBScript logon script fails while other scripts work, the most likely cause is that the update disabled VBScript execution, not that the script was deleted or that the script host was changed to PowerShell.

Answer

The script file was deleted by Windows Defender.

Answer

The update changed the default script host to PowerShell.

Answer

The network share requires SMB 2.0, which is no longer supported.

Question 2

A data center manager wants to implement a physical security control that can detect if a server chassis has been opened without authorization. Which control should they use?

Accepted Answer

Chassis intrusion switch. A chassis intrusion switch is a physical security control, typically a microswitch inside the server chassis, that detects when the chassis cover is opened. Upon detection, it can trigger an alert, log an event in the system's management controller (like IPMI or BMC), or prevent the system from booting. This provides an immediate and active detection mechanism for unauthorized access. While tamper-evident seals provide visual evidence of tampering, a chassis intrusion switch offers a more direct and often automated method of detection.

Answer

Intrusion detection system (IDS) on the network

Answer

Tamper-evident seals

Answer

Video surveillance

Question 3

A company's server room has a door with a proximity card reader. Employees report that the door sometimes does not close fully, allowing it to be pushed open without a card. What is the best solution?

Accepted Answer

Install a door closer mechanism. The core issue is that the door fails to close fully, bypassing the proximity card reader's access control. A door closer mechanism is a mechanical device that automatically pulls the door shut, ensuring it latches and requires card authentication to re-enter. This directly addresses the physical vulnerability without changing the authentication method.

Answer

Replace the proximity card reader with a biometric reader

Answer

Add a security camera to monitor the door

Answer

Increase the frequency of badge audits

Question 4

During a security audit, a technician discovers that an employee has been using a third-party remote desktop tool without IT approval. The employee claims it was necessary to access a legacy application. Which security risk is most directly associated with unauthorized remote access tools?

Accepted Answer

Man-in-the-middle attacks. Unauthorized remote desktop tools often lack the encryption and authentication controls found in approved solutions like SSH or RDP with Network Level Authentication. This exposes the connection to man-in-the-middle attacks, where an attacker can intercept, decrypt, or modify the traffic between the employee's workstation and the legacy application server, potentially capturing credentials or sensitive data.

Answer

Increased bandwidth usage

Answer

Compatibility issues with the operating system

Answer

Increased licensing costs

Question 5

During a security audit, an administrator discovers that several employees have written their domain passwords on sticky notes attached to their monitors. The company policy requires strong passwords and prohibits sharing credentials. Which security principle is being violated?

Accepted Answer

Password confidentiality. Password confidentiality is the principle that passwords must be kept secret and known only to the authorized user. By writing domain passwords on sticky notes attached to monitors, employees are exposing credentials to anyone with physical access, directly violating this principle. The company policy explicitly prohibits sharing credentials, and this practice undermines the security of the domain authentication system.

Answer

Principle of least privilege

Answer

Account lockout policy

Answer

Multi-factor authentication

Question 6

A technician is performing a routine software update on a finance department server. The change management documentation specifies that the update must be applied during a maintenance window from 2:00 AM to 4:00 AM. At 3:30 AM, the update fails with an error. The technician has no rollback plan documented. What should the technician do?

Accepted Answer

Leave the server in its current state and escalate the issue to the change manager.. The technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Answer

Attempt to roll back the update using the server’s built-in recovery options.

Answer

Continue troubleshooting until the maintenance window ends, then document the failure.

Answer

Reboot the server to clear the error and retry the update.

Question 7

During a security audit, you discover that a Windows 10 workstation has the 'Store passwords and credentials using reversible encryption' policy enabled. What is the primary security risk associated with this setting?

Accepted Answer

It stores passwords in a format that can be easily decrypted, making them vulnerable if the database is compromised.. The 'Store passwords using reversible encryption' policy causes Windows to store passwords in a format that can be decrypted back to plaintext. This directly violates the principle of storing only hashed credentials; if the SAM database or LSASS process memory is compromised, an attacker can recover the original password, enabling lateral movement or privilege escalation.

Answer

It increases the time required to log on to the system.

Answer

It allows users to bypass the password complexity requirement.

Answer

It prevents the use of biometric authentication methods.

Question 8

A user reports that their iPhone's battery drains quickly and the phone feels warm. After checking, you find that several apps are using Location Services in the background. What is the most efficient way to manage this without disabling location for all apps?

Accepted Answer

Set each app's location permission to 'While Using the App'. Setting each app's location permission to 'While Using the App' is the most efficient solution because it prevents apps from accessing location services in the background, which is the primary cause of battery drain and heat generation. This granular control allows critical apps (e.g., Maps) to still function when actively used, while stopping unnecessary background location polling that consumes GPS and cellular resources.

Answer

Turn off Location Services entirely in Privacy settings

Answer

Enable Low Power Mode

Answer

Reset all settings on the iPhone

Question 9

A small business owner wants to ensure that only authorized USB storage devices can be used on company laptops running Windows 10 Pro. They have a list of approved device hardware IDs. Which security policy should be configured to enforce this restriction?

Accepted Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions. The 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions allows an administrator to specify a whitelist of approved hardware IDs. When configured, only USB storage devices whose hardware IDs match the list will be installed, effectively blocking all unauthorized devices. This directly enforces the requirement to restrict USB storage to approved devices only.

Answer

Enable the 'Removable Storage Access' policy under Windows Components

Answer

Configure the 'Devices: Restrict CD-ROM access to locally logged-on user only' policy

Answer

Set the 'Deny all devices' policy under Device Installation Restrictions

Question 10

A user reports that they cannot access a shared folder on the network, but other users can. The folder is on a Windows 10 Pro workstation. What should you check first to resolve this issue?

Accepted Answer

Check the NTFS permissions on the folder. Since other users can access the shared folder, the network share and firewall are functioning correctly. The issue is specific to one user, which points to a permission problem at the file system level. NTFS permissions control user-level access to folders, and a misconfigured or missing ACE (Access Control Entry) for that user would prevent access while allowing others. Checking NTFS permissions is the logical first step because it directly governs per-user access to the resource.

Answer

Check the Windows Defender Firewall settings

Answer

Check the user’s password expiration status

Answer

Check the User Account Control settings

Question 11

A client brings in a laptop that was used by an employee who left the company. The manager wants to ensure all data is unrecoverable before recycling the laptop. The laptop has a traditional HDD. Which method should be used?

Accepted Answer

Run a full overwrite using disk-wiping software.. Disk-wiping software performs a full overwrite of every sector on the HDD with patterns (e.g., zeros, random data), making the original data unrecoverable even with advanced forensic tools. This method is specifically designed for secure data destruction on functional drives, ensuring compliance with data sanitization standards like NIST SP 800-88.

Answer

Perform a quick format of the drive.

Answer

Use a degausser to demagnetize the drive.

Answer

Physically shred the drive with a hard drive shredder.

Question 12

A user reports that they can no longer connect to the company network from home using VPN. They confirm their internet connection is working and that they can browse websites. Which of the following should a technician check first to resolve the VPN connectivity issue?

Accepted Answer

Verify the user's VPN username and password. The user's internet connection is working (they can browse websites), which rules out general network connectivity issues. The most common cause of VPN authentication failure is incorrect or expired credentials, so verifying the username and password is the quickest and most logical first step before escalating to more complex troubleshooting.

Answer

Check if the VPN client software is up to date

Answer

Restart the VPN server at the data center

Answer

Reinstall the network adapter drivers

Question 13

After a security incident, a forensic analyst needs to ensure that Windows 10 audit logs capture all successful and failed attempts to access the 'Confidential' folder on a file server. Which audit policy configuration is required?

Accepted Answer

Enable 'Audit object access' and configure the SACL on the folder. To audit access attempts to a specific folder, you must enable the 'Audit object access' policy in the Advanced Audit Policy Configuration (or the legacy 'Audit object access' under Local Policies). This policy alone does not audit anything; you must also configure a System Access Control List (SACL) on the 'Confidential' folder itself, specifying which access types (e.g., Read, Write) for which users or groups to audit for success and failure. Without the SACL, no object access events are generated.

Answer

Enable 'Audit account logon events' for success and failure

Answer

Enable 'Audit privilege use' for success and failure

Answer

Enable 'Audit process tracking' for success and failure

Question 14

A user complains that their Remote Desktop session to a Windows 10 Pro workstation frequently disconnects after a few minutes of inactivity. The workstation is on a local network. Which setting should the technician modify on the host computer to prevent this?

Accepted Answer

Increase the idle session limit in Remote Desktop settings. The Remote Desktop Session Host (RDSH) has a configurable idle session limit that disconnects sessions after a period of inactivity. By default, Windows 10 Pro may enforce a short idle timeout (often 1-5 minutes) to conserve resources. Increasing this limit in the Remote Desktop Session Host settings (under Local Group Policy or the Remote Desktop Services configuration) prevents the automatic disconnection the user is experiencing.

Answer

Disable the screensaver

Answer

Change the power plan to High Performance

Answer

Enable Network Level Authentication

Question 15

During a security incident, a user's files have been renamed with a '.encrypted' extension, and a ransom note demands Bitcoin to restore them. The user has no backups. What is the most appropriate immediate action?

Accepted Answer

Disconnect the computer from the network immediately.. Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

Answer

Pay the ransom to regain access quickly.

Answer

Run a full antivirus scan to remove the malware.

Answer

Restart the computer in Safe Mode and attempt file recovery.

Question 16

A user reports that their MacBook Pro running macOS Ventura is unable to open any applications after a recent system update. They see a spinning beach ball when clicking app icons. Which macOS tool should you use first to diagnose and resolve this issue?

Accepted Answer

Activity Monitor. Activity Monitor is the correct first tool because it allows you to inspect running processes, CPU usage, memory pressure, and disk activity. The spinning beach ball indicates a hung or unresponsive process, likely caused by a kernel extension or system daemon failing after the update. Activity Monitor can identify the offending process (e.g., a high CPU or stuck I/O process) so you can force quit it or gather logs for further troubleshooting.

Answer

Terminal

Answer

Disk Utility

Answer

System Information

Question 17

A user reports that a specific application crashes immediately on launch. You want to verify the integrity of the application's core files without reinstalling. Which command-line tool can you use to scan and repair system files that the application depends on?

Accepted Answer

sfc /scannow. The `sfc /scannow` (System File Checker) command scans all protected system files and replaces corrupted versions with a cached copy located in the `%WinDir%\System32\dllcache` directory. Since the application crashes on launch, it likely depends on core Windows system files (e.g., DLLs, executables) that may be corrupted or missing. Running `sfc /scannow` verifies and repairs these system files without reinstalling the application itself, directly addressing the integrity of the dependencies.

Answer

chkdsk /f

Answer

tasklist

Answer

dism /online /cleanup-image /restorehealth

Question 18

A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?

Accepted Answer

Set the execution policy to AllSigned. Setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

Answer

Set the execution policy to Restricted

Answer

Set the execution policy to RemoteSigned

Answer

Disable PowerShell using Group Policy

Question 19

A technician is configuring a new Windows 10 kiosk computer that will run a single application for public use. They need to prevent users from accessing the desktop, taskbar, or other system functions. Which Windows security feature should be used?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (Kiosk Mode) is the correct feature because it locks down the Windows 10 device to run only a single Universal Windows Platform (UWP) app or a classic Win32 app in full-screen mode, completely hiding the desktop, taskbar, Start menu, and other system interfaces. This is specifically designed for public-facing kiosk scenarios where users must not be able to exit the application or access any other system functions.

Answer

User Account Control (UAC) set to highest level

Answer

Local Group Policy – Software Restriction Policies

Answer

Windows Defender Application Guard

Question 20

A user calls the help desk saying they cannot access a shared folder on the network. They can access other shares on the same server. The technician verifies the user's account is active and the folder exists. What should the technician check next to resolve the access issue?

Accepted Answer

Review the NTFS permissions on the shared folder.. Since the user can access other shares on the same server, the issue is isolated to a specific shared folder. NTFS permissions control access at the folder level independently of share permissions, and a missing or incorrect NTFS entry for the user would block access even if the share permissions are open. The technician should review the NTFS permissions on that folder to ensure the user or their group has at least Read access.

Answer

Check if the user's password has expired.

Answer

Verify the user has been added to the local Administrators group.

Answer

Reboot the file server to clear any cached permissions.