220-1202 Practice Exam 3 — 20 Questions

Question 1

A user wants to share a folder on their Windows 11 PC so that other users on the local network can access files without a password. They have already enabled network discovery and file sharing. Which additional setting must they configure in the Advanced Sharing settings to allow password-less access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Turn off password protected sharing. To allow password-less access to shared folders on a local network, you must disable password protected sharing. When this setting is turned off, Windows 11 does not require users to have a local account and password on the host machine; instead, it grants access based on the 'Everyone' group permissions. This is configured in the 'Advanced sharing settings' under 'All Networks'.

Answer

Turn on Public folder sharing

Answer

Enable 128-bit encryption

Answer

Set up a homegroup

Question 2

A technician is cleaning the inside of a desktop computer that has accumulated a large amount of dust. What is the safest method to remove the dust?

Accepted Answer

Use compressed air to blow the dust out of the case.. Compressed air is the safest method because it dislodges dust without physical contact, avoiding electrostatic discharge (ESD) or mechanical damage to sensitive components. Unlike other methods, it does not introduce moisture or static buildup, and it can reach tight spaces between heatsinks and circuit boards.

Answer

Use a standard household vacuum cleaner with a brush attachment.

Answer

Use a damp cloth to wipe down the components.

Answer

Use a soft brush to sweep the dust out.

Question 3

During a routine security audit, you find that an employee has taped their door lock open to avoid using their badge every time they leave for a break. What is the most immediate security concern with this practice?

Accepted Answer

Unauthorized persons can enter without credentials. Propping a door lock open bypasses the physical access control system (PACS), allowing anyone—including unauthorized individuals—to enter the secured area without presenting valid credentials (e.g., a proximity card or PIN). This directly defeats the purpose of the access control mechanism, which is to authenticate and log each entry. The most immediate risk is that an attacker or tailgater can gain unrestricted physical access to sensitive assets, systems, or data.

Answer

The employee might lose their badge

Answer

It violates company badge policy

Answer

The door lock may break from being forced open

Question 4

A user receives an email that appears to be from their bank, asking them to click a link and verify their account information due to 'suspicious activity.' The email address looks legitimate, but the link points to a different domain. What type of attack is this?

Accepted Answer

Phishing. This is a classic phishing attack because the email uses social engineering to trick the user into clicking a link that leads to a fraudulent domain, even though the sender's address appears legitimate. Phishing is a broad category of social engineering where attackers impersonate a trusted entity to steal credentials or sensitive information, and the mismatched link is the key indicator.

Answer

Spear phishing

Answer

Whaling

Answer

Vishing

Question 5

A security incident occurred where an attacker modified a PowerShell script on a file server to include malicious commands. The script is executed daily by a scheduled task. Which scripting security best practice could have prevented this attack?

Accepted Answer

Use a digital signature to sign the script and enforce execution policy. Enforcing an execution policy that requires scripts to be digitally signed ensures that only scripts signed by a trusted publisher can run. If the attacker modified the script, the digital signature would become invalid, and the execution policy would block the script from running, preventing the malicious commands from executing.

Answer

Store the script in a hidden folder

Answer

Set the script file to read-only

Answer

Compile the script into an executable

Question 6

A system administrator needs to change the group ownership of a directory /srv/data and all its contents to 'datagroup'. Which command will accomplish this recursively?

Accepted Answer

chgrp -R datagroup /srv/data. The correct command is `chgrp -R datagroup /srv/data`. The `-R` (or `--recursive`) flag tells `chgrp` to operate on the directory and all its contents, changing the group ownership to 'datagroup'. This directly fulfills the requirement to change group ownership recursively.

Answer

chown datagroup: /srv/data

Answer

chmod -R g+rw /srv/data

Answer

groupmod -R datagroup /srv/data

Question 7

A Windows 11 workstation is infected with ransomware that encrypted user files. The IT security team wants to prevent future infections by restricting which processes can modify files in user profile folders. Which Windows security feature can enforce such restrictions without third-party software?

Accepted Answer

Controlled Folder Access. Controlled Folder Access (CFA) is a Windows Defender Exploit Guard feature that restricts which applications can modify files in protected folders, such as user profile directories. By default, CFA blocks untrusted or unknown processes from writing to or encrypting files in these folders, directly preventing ransomware from encrypting user data without requiring third-party software.

Answer

NTFS permissions set to 'Read-only' for all users.

Answer

AppLocker with a deny rule for unknown executables.

Answer

BitLocker with TPM protection

Question 8

A small business owner wants to ensure that employees cannot install unauthorized browser extensions on company-managed Windows 10 computers. Which method should you use to enforce this restriction?

Accepted Answer

Configure Group Policy to block extension installation. Group Policy allows administrators to centrally manage Windows settings, including browser policies. By configuring the 'Block installation of extensions' policy under Administrative Templates for each browser (e.g., Chrome, Edge), you can prevent users from installing unauthorized extensions on company-managed Windows 10 computers.

Answer

Enable private browsing mode in each browser

Answer

Set the browser homepage to a company-approved site

Answer

Install an ad-blocker extension

Question 9

A company is upgrading its network switches and has 10 old switches that still work. The local school district has requested donations of working equipment. What should the technician do?

Accepted Answer

Donate the switches to the school district.. Donating the switches to the school district aligns with the principle of reuse, which is the most environmentally responsible option before recycling or disposal. The switches are still functional, so extending their lifecycle reduces e-waste and benefits the community. This practice supports the waste hierarchy: reduce, reuse, recycle.

Answer

Throw the switches in the company dumpster.

Answer

Send the switches to a recycler even though they work.

Answer

Keep the switches in storage indefinitely.

Question 10

A receptionist at a company receives a call from someone claiming to be from the IT department. The caller says they need her password to perform an urgent server update. The receptionist provides the password. What type of social engineering attack is this?

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker fabricates a scenario (the pretext) to manipulate the target into divulging sensitive information. In this case, the caller falsely claims to be from the IT department and invokes an urgent server update to trick the receptionist into revealing her password. This is not a technical exploit but a psychological manipulation that relies on the target's trust in authority and urgency.

Answer

Tailgating

Answer

Phishing

Answer

Baiting

Question 11

A user reports that their MacBook Pro running macOS Big Sur will not boot past the Apple logo. You suspect a corrupted system file. You need to boot into a special mode to run Disk Utility's First Aid on the startup volume. Which key combination should you hold during startup?

Accepted Answer

Hold Command (⌘) + R.. Holding Command (⌘) + R during startup boots macOS into the built-in macOS Recovery system, which includes Disk Utility. From there, you can run First Aid on the startup volume to repair a corrupted system file. This is the standard recovery mode for Intel-based Macs running macOS Big Sur.

Answer

Hold the Option (⌥) key.

Answer

Hold the Shift key.

Answer

Hold Command (⌘) + Option (⌥) + P + R.

Question 12

A security incident occurs where an attacker captures the 4-way handshake of a WPA2-PSK network and successfully cracks the passphrase offline. The technician is tasked with preventing this type of attack in the future. Which protocol should the technician implement?

Accepted Answer

WPA3-SAE.. WPA3-SAE (Simultaneous Authentication of Equals) replaces the pre-shared key (PSK) model with a password-authenticated key exchange that is resistant to offline dictionary attacks. Unlike WPA2-PSK, which transmits a hash of the password in the 4-way handshake that can be captured and cracked offline, SAE uses a zero-knowledge proof protocol that prevents an attacker from deriving the password from captured handshake data, even if they have the full handshake.

Answer

WPA2-PSK with a longer passphrase.

Answer

WPA2-Enterprise with PEAP-MSCHAPv2.

Answer

WPA2-PSK with TKIP.

Question 13

A user complains that their computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What is the most likely security issue?

Accepted Answer

The system is infected with adware that displays unsolicited advertisements.. The symptoms—pop-up ads without a browser open, an unwanted toolbar, and system slowdown—are classic indicators of adware. Adware is a type of potentially unwanted program (PUP) that displays intrusive advertisements, often by injecting ads into system processes or browser sessions, and can degrade performance by consuming CPU and memory resources.

Answer

A rootkit has hidden itself in the system's firmware.

Answer

A worm is spreading through the network, consuming bandwidth.

Answer

A Trojan horse has stolen the user's banking credentials.

Question 14

During a network upgrade, a technician needs to run new Ethernet cables through a drop ceiling. What is the most important safety precaution to take?

Accepted Answer

Use a non-contact voltage tester to check for live wires.. The most important safety precaution when running cables through a drop ceiling is to use a non-contact voltage tester to check for live wires. Drop ceilings often conceal electrical wiring, and accidentally cutting or damaging a live wire can cause electrocution, fire, or equipment damage. A non-contact voltage tester allows the technician to detect the presence of AC voltage without making physical contact, ensuring the area is safe before handling cables.

Answer

Wear a hard hat to protect against head injuries.

Answer

Ensure the area is well-ventilated.

Answer

Wear anti-static gloves to prevent ESD.

Question 15

While upgrading a workstation, you find that the old lithium-ion battery is swollen. What is the safest and most environmentally sound way to handle this battery?

Accepted Answer

Place it in a fireproof container and contact a hazardous waste disposal service.. A swollen lithium-ion battery indicates internal damage and potential thermal runaway risk. Placing it in a fireproof container and contacting hazardous waste disposal ensures safe containment and proper recycling, preventing fire hazards and environmental contamination from toxic electrolytes and heavy metals.

Answer

Puncture the battery to release the pressure, then throw it in the trash.

Answer

Put it in a sealed plastic bag and put it in the regular recycling bin.

Answer

Freeze the battery to stop the swelling, then dispose of it in the trash.

Question 16

A user's iPhone is running iOS 16 and they cannot update to the latest iOS 17 because the 'Software Update' section in Settings shows 'Unable to Check for Update'. The device is connected to Wi-Fi and has sufficient storage. Which advanced troubleshooting step should you take to resolve this update issue?

Accepted Answer

Use a computer with Finder (macOS) or iTunes (Windows) to download and install the update.. When an iPhone displays 'Unable to Check for Update' despite having Wi-Fi and storage, the issue often lies with the device's inability to contact Apple's update servers directly due to network restrictions or corrupted cached update data. Using a computer with Finder (macOS) or iTunes (Windows) bypasses the iPhone's over-the-air (OTA) update mechanism by downloading the full IPSW firmware directly from Apple's servers and installing it via USB, which is a standard advanced troubleshooting step for OTA update failures.

Answer

Reset All Settings from General > Reset.

Answer

Restore the iPhone using an iCloud backup.

Answer

Disable iCloud Private Relay in iCloud settings.

Question 17

A user reports that their Windows 10 PC frequently crashes with a blue screen error. You want to analyze the memory dump files to identify the faulty driver. Which tool should you use to view and analyze these dump files?

Accepted Answer

Event Viewer. Event Viewer is the correct tool because it logs system events, including blue screen errors (BugCheck events), and provides access to memory dump files. You can view the details of a crash under 'Windows Logs > System' and filter by event ID 1001, which includes the path to the dump file and the module that caused the failure. This allows you to identify the faulty driver by analyzing the dump file directly or by using additional tools like WinDbg.

Answer

Windows Memory Diagnostic

Answer

Performance Monitor

Answer

Task Manager

Question 18

A technician is troubleshooting a Windows 10 workstation that displays a fake security alert claiming the system is infected and prompting the user to call a toll-free number. The user cannot close the alert window or open Task Manager. Which type of malware is causing this behavior, and what is the best removal approach?

Accepted Answer

It is a tech support scam; boot into Safe Mode with Networking and run an anti-malware scan.. The fake security alert that cannot be closed and blocks Task Manager is a classic tech support scam, not actual malware that encrypts files or hides deep in the system. Booting into Safe Mode with Networking loads only essential drivers and services, bypassing the scam's persistence mechanism, and allows an anti-malware scan to remove the malicious files and registry entries.

Answer

It is a rootkit; use a rootkit removal tool from within Windows.

Answer

It is ransomware; pay the fee to remove the alert.

Answer

It is a worm; disconnect the network and reinstall the operating system.

Question 19

A company's IT policy requires that all wireless traffic be encrypted using the strongest available protocol. A technician is configuring a new access point that supports WPA3-SAE, WPA2-PSK with AES, and WPA2-PSK with TKIP. Which configuration meets the policy?

Accepted Answer

WPA3-SAE.. WPA3-SAE (Simultaneous Authentication of Equals) is the strongest available wireless encryption protocol among the options, as it replaces the pre-shared key (PSK) model with a more secure handshake that provides forward secrecy and is resistant to offline dictionary attacks. The IT policy requires the strongest available protocol, and WPA3-SAE is superior to both WPA2-PSK variants, making option C the correct choice.

Answer

WPA2-PSK with TKIP.

Answer

WPA2-PSK with AES.

Answer

A mixed mode of WPA2 and WPA3.

Question 20

A technician is configuring a small office network and wants to ensure that guest users can access the internet but cannot connect to internal company resources like file servers or printers. Which logical security method should be implemented?

Accepted Answer

Implement a guest VLAN that is isolated from the internal network.. A guest VLAN configured with access control lists (ACLs) or private VLAN features isolates guest traffic from the internal corporate VLAN. This ensures guest users can reach the internet via a default gateway or NAT while being unable to route or bridge to internal subnets containing file servers or printers. This is a standard logical segmentation method defined in IEEE 802.1Q.

Answer

Enable MAC address filtering on the wireless access point.

Answer

Require a complex password for the guest Wi-Fi network.

Answer

Disable the SSID broadcast for the guest network.