220-1202 Practice Test 24 — 15 Questions

Question 1

A small business owner calls for support because all of their files on the server have been renamed with a .encrypted extension, and a text file named 'README_TO_DECRYPT.txt' appears on the desktop demanding a Bitcoin payment. What is the first step the technician should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the server from the network.. The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Paying the ransom is discouraged as it does not guarantee data recovery and funds criminal activity. After isolation, the technician can assess the damage and attempt recovery from backups.

Answer

Pay the ransom to get the decryption key immediately.

Answer

Run a full antivirus scan on the server.

Answer

Restore files from a recent backup immediately.

Question 2

A technician is tasked with upgrading the operating system on ten identical workstations. The change advisory board has approved the upgrade. After completing the first workstation, the technician notices the new OS causes a critical line-of-business application to fail. What should the technician do next?

Accepted Answer

Report the failure to the change advisory board and pause further upgrades.. This question tests the change management process when an approved change causes unexpected issues. The correct action is to stop the rollout and document the problem so the CAB can reassess the change.

Answer

Continue upgrading the remaining workstations since the change was approved.

Answer

Restore the first workstation to the previous OS and complete the rest without changes.

Answer

Research a hotfix for the application and apply it to all workstations.

Question 3

A customer reports that their Android phone's screen is unresponsive to touch after a drop. They can still hear notifications and see the display. Which built-in tool should you use to test the touchscreen functionality without relying on third-party apps?

Accepted Answer

Diagnostics Mode (e.g., *#0*#). This question tests knowledge of Android's built-in diagnostic tools. The correct answer is the 'Diagnostics' or 'Test' mode, often accessed via the dialer code or settings, which allows hardware testing without third-party apps. This is a standard feature for verifying touchscreen integrity after physical damage.

Answer

Safe Mode

Answer

Developer Options

Answer

Factory Reset

Question 4

A customer is frustrated because every time they plug in a USB flash drive, Windows automatically opens the folder and plays any media files. They want to stop this behavior but still want the drive to be recognized. Which Control Panel item should you use?

Accepted Answer

AutoPlay. The AutoPlay settings in Control Panel let you configure default actions for different media types. Disabling or setting 'Take no action' for removable drives stops automatic folder opening and media playback without affecting drive recognition.

Answer

File Explorer Options

Answer

Device Manager

Answer

Sound

Question 5

A user reports that their system is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice that their default search engine has changed without their permission. Which type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware is designed to display unwanted advertisements and can modify browser settings, causing pop-ups and search engine hijacking. Unlike a virus or worm, adware does not typically replicate itself or require a host file to spread. The symptoms described—pop-ups outside the browser and unauthorized search engine changes—are classic signs of adware infection.

Answer

Virus

Answer

Ransomware

Answer

Rootkit

Question 6

During a security audit, you find that a server room door has a standard key lock, but the key is kept in an unlocked drawer nearby. Which physical security principle is being violated?

Accepted Answer

Defense in depth. The principle of defense in depth requires multiple layers of security. Storing the key in an unlocked drawer negates the door lock, creating a single point of failure. Proper key management is essential.

Answer

Least privilege

Answer

Separation of duties

Answer

Change management

Question 7

During a software deployment, a technician needs to ensure that a company-issued Android device automatically connects to the corporate Wi-Fi network and disables the camera for security. Which mobile OS tool should be used to enforce these policies?

Accepted Answer

Deploy a Mobile Device Management (MDM) profile. Mobile Device Management (MDM) solutions allow administrators to push configuration profiles and restrictions, such as Wi-Fi settings and camera disablement. This is the standard enterprise tool for managing multiple devices centrally.

Answer

Use the Android Debug Bridge (ADB) to manually set Wi-Fi and camera permissions

Answer

Configure the device's built-in Guest Mode

Answer

Install a third-party camera-blocking app from the Play Store

Question 8

A technician is troubleshooting a network issue and needs to access the user's computer remotely. The user is in a different city and speaks with a heavy accent, making communication difficult. The technician has trouble understanding the user's description of the error. What is the best approach?

Accepted Answer

Ask the user to type the error message in a chat window to avoid miscommunication.. This question tests adaptability and respectful communication when language barriers exist. The correct answer uses a collaborative, patient approach to ensure understanding without causing embarrassment.

Answer

Speak slowly and loudly, repeating each question until the user understands.

Answer

Ask the user to transfer the call to a colleague who speaks English more clearly.

Answer

Proceed with remote access without further communication, assuming you can diagnose the issue visually.

Question 9

A user calls the help desk saying that every time they click a link in an email, their browser opens a page that says 'Your computer is infected! Call this number.' They are unable to close the page normally. What type of attack is this, and what is the first step you should take?

Accepted Answer

Tech support scam; force close the browser using Task Manager, then run a security scan. This is a tech support scam using a social engineering tactic to frighten the user. The correct first step is to close the browser forcefully using Task Manager, then run a security scan. This tests the ability to distinguish between different attack types and appropriate response procedures.

Answer

Phishing attack; immediately change the user's email password

Answer

Browser hijacker; run a full antivirus scan immediately

Answer

Drive-by download; disconnect the computer from the network

Question 10

A company is implementing a new policy to prevent tailgating at the main entrance. Which physical security control should they deploy?

Accepted Answer

Mantrap. A mantrap uses two interlocking doors to ensure only one person can enter at a time, effectively preventing tailgating. This tests understanding of specialized access controls designed to enforce one-person-per-authentication.

Answer

Security cameras

Answer

Biometric reader

Answer

Badge reader

Question 11

A customer brings in a laptop that they want to recycle, but they are concerned about personal data. The laptop has a 256GB SSD and the customer wants to keep the laptop functional for resale. Which method should the technician recommend?

Accepted Answer

Use the 'Reset this PC' option with the 'Remove everything and clean the drive' setting.. To use the built-in 'Reset this PC' with the 'Remove everything and clean the drive' option, which performs a secure wipe on SSDs. This ensures data is overwritten while keeping the laptop usable. Simple deletion or formatting is insufficient, and physical destruction would make the laptop unusable.

Answer

Remove the SSD and physically destroy it, then sell the laptop without a drive.

Answer

Use a degausser on the SSD.

Answer

Perform a standard format and reinstall Windows.

Question 12

A company’s change management policy requires all changes to be approved by the Change Advisory Board (CAB) before implementation. A technician applies an emergency security patch to a critical server without CAB approval because the vulnerability is being actively exploited. What should the technician do after applying the patch?

Accepted Answer

Document the change and submit an emergency change request for retroactive approval.. Even in emergency changes, documentation and retroactive approval are required. The technician must document the change and notify the CAB as soon as possible to obtain retroactive approval, ensuring compliance with change management policies.

Answer

Wait for the next CAB meeting to report the change.

Answer

Revert the patch and wait for CAB approval.

Answer

Delete the change log entry to avoid accountability.

Question 13

A technician is tasked with migrating a physical server running a legacy OS that does not support virtualization drivers. The technician needs to ensure the OS can boot and run in a virtual machine. Which of the following steps is most critical before performing the physical-to-virtual (P2V) conversion?

Accepted Answer

Use a P2V tool that can inject the correct HAL and storage drivers for the hypervisor. Legacy OSes often lack drivers for virtualized hardware, so using a P2V tool that can inject the necessary HAL and storage drivers during conversion is essential. Without this, the VM will likely blue screen on boot. This tests advanced knowledge of P2V migration challenges and driver injection.

Answer

Increase the physical server's RAM before conversion

Answer

Ensure the legacy OS has the latest service pack installed

Answer

Create a full backup of the physical server

Question 14

A user reports that their Windows 10 PC is running slowly after they installed a new program. You need to identify which service or startup program is consuming the most CPU resources to troubleshoot the issue. Which administrative tool should you use?

Accepted Answer

Task Manager. Task Manager provides real-time performance monitoring, including CPU usage per process. This makes it the ideal tool for quickly identifying resource hogs. Other tools like Event Viewer or Services.msc are for different purposes.

Answer

Event Viewer

Answer

Services.msc

Answer

Performance Monitor

Question 15

A technician needs to deploy a PowerShell script to 50 Windows 10 workstations that will install a security update silently. The script must run with administrative privileges. Which method should the technician use to ensure the script executes properly without user interaction?

Accepted Answer

Run the script via 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt. Running 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt bypasses PowerShell's execution policy for that session and ensures the script runs with administrative privileges. This combination allows silent, unattended execution of the security update installation across multiple workstations without user interaction.

Answer

Double-click the script file on each workstation

Answer

Use the 'Start-Process' cmdlet without elevation

Answer

Copy the script to the Startup folder