220-1202 Practice Test 25 — 15 Questions

Question 1

During a software deployment, a technician must dispose of 50 unused software license CDs. The CDs are still sealed. What is the most environmentally friendly way to handle them?

Accepted Answer

Donate them to a local school or non-profit that can use them.. Donating or recycling the CDs through a media recycling program is the best approach. CDs are made of polycarbonate and can be recycled, but they should not go into regular trash. This question tests knowledge of proper disposal of electronic media.

Answer

Throw them in the general office trash bin.

Answer

Shred them and put the pieces in the recycling bin.

Answer

Burn them in an incinerator to generate energy.

Question 2

A small business is deploying a new time-tracking application to five workstations. The technician needs to ensure the installation is standardized and repeatable. Which documentation should the technician create before starting the deployment?

Accepted Answer

A step-by-step installation guide with screenshots.. This question focuses on the importance of creating a deployment plan or runbook before performing installations. Standardized documentation ensures consistency and reduces errors across multiple machines.

Answer

A list of user passwords for the application.

Answer

A detailed network topology diagram.

Answer

A copy of the software license agreement.

Question 3

During a security audit, a technician discovers that an employee used a hammer to destroy several old hard drives. The drives are now in pieces, but the organization's policy mandates 'secure data destruction' for compliance. Which additional step should the technician take?

Accepted Answer

Visually inspect the platters for scratches and breaks, then shred any intact platters.. To verify the destruction by inspecting the platters for visible damage and ensuring they are not intact. Hammering may leave platters partially readable. This question tests the concept of verification in data destruction, as physical methods must be confirmed effective.

Answer

Document the destruction and consider it complete.

Answer

Use a degausser on the remaining pieces.

Answer

Run a data recovery tool on the pieces to see if data remains.

Question 4

A user on a Windows 10 Pro workstation complains that they cannot change their desktop background or theme, and several personalization settings are grayed out. The computer is not joined to a domain. Which Group Policy or local policy setting is most likely causing this restriction?

Accepted Answer

The 'Prevent changing desktop background' policy.. The Local Group Policy Editor (gpedit.msc) can enforce user restrictions. The specific policy 'Prevent changing desktop background' under User Configuration > Administrative Templates > Control Panel > Personalization would cause this symptom. The other options are either not specific to personalization or affect different settings.

Answer

The 'Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands' policy.

Answer

The 'Prohibit access to Control Panel and PC settings' policy.

Answer

The 'Turn off all Windows Spotlight features' policy.

Question 5

A user calls the help desk frustrated because their laptop will not connect to the company Wi-Fi. They say they have tried restarting the laptop but it still does not work. The technician suspects the wireless adapter driver may be corrupt. What is the best first step for the technician to take?

Accepted Answer

Ask the user if they see any error messages or if other devices connect to the Wi-Fi.. This question tests the concept of active listening and gathering information before jumping to solutions. The correct answer is to ask clarifying questions to understand the issue fully, which ensures the technician does not waste time on incorrect assumptions.

Answer

Remotely reinstall the wireless adapter driver.

Answer

Tell the user to bring the laptop to the IT office for a physical inspection.

Answer

Escalate the ticket to the network team immediately.

Question 6

During a security audit, you find that a user's workstation has a USB device that automatically logs in to a cloud storage account when inserted. What security best practice is being violated?

Accepted Answer

Disabling auto-run. USB auto-run devices can bypass authentication and pose a security risk. Disabling auto-run prevents unauthorized access and malware from executing automatically, which is a key security practice.

Answer

Password complexity requirements

Answer

Account lockout policies

Answer

Enforcing screen locks

Question 7

A company uses a cloud-based SaaS application for customer relationship management (CRM). Several employees report that they cannot access the CRM this morning, but internet connectivity is working. The IT support team checks the cloud provider's status page and finds no reported outages. What should the technician check next?

Accepted Answer

Check if the users' accounts have expired or if passwords need to be reset.. When a cloud service is accessible to some but not others, the issue is often local authentication or configuration. Expired credentials or browser cache problems are common causes. The cloud provider's status page shows no outage, so the issue is likely client-side. DNS and firewall settings would affect all users if misconfigured.

Answer

Verify that the DNS server is resolving the CRM URL correctly.

Answer

Reboot the company's firewall to clear any temporary blocks.

Answer

Reinstall the CRM application on the affected workstations.

Question 8

During a security audit, you discover that a user's browser has multiple pop-up windows appearing, even when no websites are open. The user denies installing any software. Which tool should you use to identify and remove the underlying cause?

Accepted Answer

Run a full scan with Windows Defender or another anti-malware tool. Pop-ups appearing without a browser suggest adware or a potentially unwanted program (PUP) running as a background process. Using Windows Defender or an anti-malware scanner is the correct approach. This tests understanding of adware behavior and removal tools.

Answer

Reset the browser settings to default

Answer

Disable JavaScript in the browser

Answer

Clear the browser cache and cookies

Question 9

A user reports that their computer is running slowly and they suspect a virus. After scanning, the technician finds malware that has encrypted several files. The technician decides to wipe the drive and reinstall the OS. What should be done to ensure the malware is completely removed before data destruction?

Accepted Answer

Use a secure erase utility that overwrites the entire drive including the boot sector.. Some malware can persist in the boot sector or firmware. A full wipe of the entire drive (including the boot sector) using a secure erase or low-level format ensures no malware remnants remain. A simple format may leave boot-sector malware intact.

Answer

Run a quick format and then reinstall the OS.

Answer

Delete the encrypted files and run a registry cleaner.

Answer

Use System Restore to revert to a previous state.

Question 10

Your company's security policy requires that all workstations have the latest Windows security updates installed. You need to verify the update history on a user's Windows 10 PC to ensure no critical updates are missing. Which tool should you use?

Accepted Answer

Windows Update. Windows Update settings (in Settings app or old Control Panel) shows update history, including installed updates and their dates. This is the standard way to check which updates have been applied.

Answer

Event Viewer

Answer

System Information

Answer

Reliability Monitor

Question 11

A user reports receiving a phone call from someone claiming to be from 'Microsoft Support' saying their computer has a virus and asking for remote access to fix it. The user did not grant access. What type of attack was attempted?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack, a social engineering technique where the attacker uses phone calls to trick victims into providing sensitive information or remote access. Legitimate companies like Microsoft do not make unsolicited support calls.

Answer

Phishing

Answer

Smishing

Answer

Pretexting

Question 12

A technician discovers that a user has been sharing their login credentials with coworkers to allow them to access a shared drive. The company's security policy prohibits password sharing. What is the most effective way to prevent this behavior while still allowing necessary access?

Accepted Answer

Configure the shared drive permissions using security groups and add the coworkers to the appropriate group.. The root cause is that the shared drive access is tied to individual accounts, encouraging sharing. Implementing group-based permissions with proper access control lists (ACLs) allows the company to grant access to a group rather than an individual, eliminating the need to share passwords. Additionally, enforcing a policy of non-repudiation and using audit logs can deter sharing.

Answer

Disable the user's account and create a generic shared account for the drive.

Answer

Implement a Group Policy that forces password changes every 30 days.

Answer

Send a company-wide email reminding users not to share passwords.

Question 13

A small business owner wants to restrict app installations on company Macs to only the Mac App Store to prevent employees from downloading unapproved software. Which macOS security feature should you configure?

Accepted Answer

Gatekeeper. Gatekeeper controls where apps can be installed from. Setting it to 'App Store' restricts installations to only Mac App Store apps, meeting the business requirement.

Answer

FileVault

Answer

System Integrity Protection (SIP)

Answer

Parental Controls

Question 14

A company's Android devices are failing to connect to the corporate email server after a security policy update. The devices show 'Authentication failed' for the email app. What is the most likely cause?

Accepted Answer

The email app's server settings (IMAP/POP/SMTP) are no longer correct.. After a security policy update, authentication failures often stem from outdated or incorrect server settings. The most common change is an updated server address or port. The technician should verify the incoming/outgoing server settings in the email app.

Answer

The devices need a factory reset to clear cached credentials.

Answer

The SIM cards are deactivated.

Answer

The devices are infected with malware that blocks email.

Question 15

A user complains that their Windows 10 computer is running slowly and they see frequent pop-ups from an unknown program. After running a full antivirus scan, nothing is detected. Which Windows security feature should you use to investigate and remove potentially unwanted software?

Accepted Answer

Windows Defender Offline Scan. Windows Defender Offline Scan boots from a trusted environment to detect and remove persistent malware that standard scans miss. It is ideal for rootkits or stubborn infections that hide from a live OS.

Answer

Windows Defender Firewall

Answer

System Restore

Answer

User Account Control (UAC)