220-1202 Practice Test 27 — 15 Questions

Question 1

A technician is configuring a new Windows 11 workstation for a user who frequently downloads free software. To reduce the risk of malware infections from bundled applications, which security setting should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set User Account Control to always notify.. User Account Control (UAC) set to 'Always notify' is the correct choice because it prompts the user for consent or credentials whenever an application (including bundled installers) attempts to make system-level changes. This gives the user a chance to review and block unauthorized installations, directly reducing the risk of malware from bundled freeware. The other options address different security concerns: Application Guard isolates browser sessions, Firewall controls network traffic, and BitLocker encrypts data at rest.

Answer

Enable Windows Defender Application Guard.

Answer

Turn on Windows Firewall with advanced logging.

Answer

Enable BitLocker drive encryption.

Question 2

A technician is setting up a wireless network for a small office that handles sensitive client data. The office has a mix of modern laptops and a few legacy printers that only support WEP. What should the technician do to maintain security while keeping the printers functional?

Accepted Answer

Create a separate VLAN for the printers using WEP and a strong passphrase, and keep the main network on WPA2.. It isolates the insecure WEP-based printers on a separate VLAN, preventing their weak encryption from compromising the main network which uses WPA2. This allows the legacy printers to remain functional while sensitive client data on the main network is protected by the stronger WPA2 protocol.

Answer

Enable WEP on the main router and set a complex 128-bit key.

Answer

Replace the printers with modern ones that support WPA2.

Answer

Set the router to mixed mode (WEP + WPA2) and use a single SSID.

Question 3

A user reports that their computer is infected with a virus and they have been trying to remove it using a free online scanner, but the problem persists. The technician suspects the malware may have disabled the antivirus software. Which safe mode should the technician use to run a full system scan?

Accepted Answer

Safe Mode with Networking. Safe Mode with Networking (C) is correct because it loads only essential drivers and services, including network components, which allows the technician to run a full system scan while the malware is likely inactive. Since the malware may have disabled the antivirus software in normal mode, booting into Safe Mode with Networking ensures the antivirus can run and still access the internet for signature updates or cloud-based scanning.

Answer

Safe Mode

Answer

Safe Mode with Command Prompt

Answer

Last Known Good Configuration

Question 4

A user reports that their Windows 10 PC is unable to connect to network shares on a server, but internet access works fine. You suspect the 'Workstation' service is not running. Which administrative tool should you use to verify and start this service?

Accepted Answer

Services console to locate the 'Workstation' service and start it.. The 'Workstation' service (LanmanWorkstation) is a core Windows service that enables the computer to initiate outbound SMB connections to network shares. The Services console (services.msc) is the correct administrative tool to check the status of this service and start it if it is stopped. Option C directly addresses the need to verify and manage this service.

Answer

Task Manager > Startup tab to check if the service is enabled.

Answer

Network and Sharing Center to run the network troubleshooter.

Answer

Device Manager to reinstall the network adapter driver.

Question 5

A user reports that after a recent Windows update, they can no longer install a legacy application that requires write access to the Program Files folder. The user is a local administrator. What Windows security setting is most likely blocking the installation?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) is the Windows security feature that prompts for consent or credentials before allowing actions that require administrative privileges, even for local administrators. By default, UAC virtualizes write attempts to protected system locations like Program Files, redirecting them to a per-user virtual store, which can cause legacy applications that expect direct write access to fail. Disabling UAC or running the installer with explicit administrative rights (e.g., right-click 'Run as administrator') typically resolves the issue.

Answer

BitLocker Drive Encryption

Answer

Windows Defender Firewall

Answer

Group Policy Software Restrictions

Question 6

A user reports that their computer is running slowly after they installed a 'free system cleaner' from a pop-up ad. The technician suspects malware. What is the most appropriate first step in handling this situation professionally?

Accepted Answer

Ask the user to describe exactly what they installed and from where, without sounding accusatory.. The first step in handling a potential malware infection professionally is to gather information from the user without judgment. Asking the user to describe what they installed and from where helps the technician understand the attack vector (e.g., a fake pop-up ad), which is critical for selecting the appropriate remediation steps and for any future security awareness training. This approach maintains trust and encourages the user to report issues promptly, which is essential for effective incident response.

Answer

Immediately run a full antivirus scan and quarantine any threats found.

Answer

Tell the user that installing software from pop-ups is dangerous and they should know better.

Answer

Remotely uninstall the program without informing the user.

Question 7

A user reports that their web browser frequently redirects to an unfamiliar search engine and displays pop-up ads even when no tabs are open. What is the most likely cause of this behavior?

Accepted Answer

The user has accidentally enabled a malicious browser extension.. The described behavior—unwanted redirects to an unfamiliar search engine and pop-up ads appearing even with no tabs open—is a classic symptom of adware or a malicious browser extension. Such extensions hijack browser settings, inject ads, and redirect search queries without the user's consent. Unlike a simple update or cache issue, this requires a malicious add-on that has been granted permissions to modify web content and navigation.

Answer

The browser needs to be updated to the latest version.

Answer

The internet connection is unstable and causing DNS errors.

Answer

The browser cache is full and needs to be cleared.

Question 8

A user reports that their browser crashes every time they visit a particular website. Other websites work fine. The technician tries the same website on another computer and it works normally. What is the most likely cause on the user's computer?

Accepted Answer

A browser extension is incompatible with that website.. The issue is isolated to a single website on one computer, and the same website works on another computer. This rules out network-wide or server-side problems. Browser extensions can inject scripts, modify headers, or block resources that a specific website requires, causing crashes. Disabling extensions or testing in incognito mode (which typically disables extensions) can confirm this.

Answer

The website has been blacklisted by the company's firewall.

Answer

The user's network adapter driver is outdated.

Answer

The website is using a newer version of TLS that the browser doesn't support.

Question 9

A user needs to access a shared folder on a Windows 10 workstation from their Windows 11 laptop. Both devices are on the same local network. Which Windows feature must be enabled on the workstation to allow file sharing?

Accepted Answer

File and Printer Sharing. File and Printer Sharing (option B) is the correct feature because it enables the Server Message Block (SMB) protocol on the workstation, which is the underlying protocol Windows uses for shared folder access. Without this service running and allowed through the firewall, other devices cannot connect to the workstation's shared resources, regardless of network discovery or firewall settings.

Answer

Network Discovery

Answer

HomeGroup

Answer

Windows Firewall

Question 10

A company is migrating to new laptops and needs to dispose of 50 old hard drives securely. The drives contain proprietary software and client data. The IT manager wants a method that is both environmentally friendly and compliant with data protection laws. Which disposal method should be chosen?

Accepted Answer

Use a certified e-waste recycler that offers secure destruction and recycling.. Certified e-waste recyclers follow strict data destruction standards (e.g., NIST SP 800-88) and environmental regulations (e.g., R2 or e-Stewards certification). This ensures the drives are physically destroyed or degaussed to prevent data recovery, while responsibly recycling materials, meeting both security and compliance requirements.

Answer

Donate the drives to a local charity after wiping them with a free tool.

Answer

Physically break the drives with a drill and dispose of them in the regular trash.

Answer

Perform a quick format and sell the drives online.

Question 11

A technician is troubleshooting a computer that has been infected with ransomware. The ransomware encrypted files and left a note demanding payment. After removing the malware, what is the most important step to prevent future infections?

Accepted Answer

Implement a strict backup policy and educate users on phishing. Ransomware often enters through phishing emails or unpatched vulnerabilities. While removing the malware is necessary, preventing future infections requires a combination of user education to avoid phishing attempts and a strict backup policy to ensure data can be restored without paying the ransom. Without addressing the root cause (user behavior and data resilience), the system remains vulnerable to reinfection.

Answer

Reinstall the operating system

Answer

Update all software to the latest versions

Answer

Disable all browser plugins

Question 12

A small office is decommissioning several SSDs from old laptops. The technician needs to ensure data is destroyed securely and the drives can be resold. Which method is most appropriate?

Accepted Answer

Use the ATA Secure Erase command.. The ATA Secure Erase command is the most appropriate method because it is specifically designed for SSDs, issuing a secure erase command at the firmware level that resets all cells to their unprogrammed state, effectively destroying all data in seconds. This method is reliable, fast, and does not wear out the NAND flash cells like multi-pass overwrites would, making it ideal for decommissioning and reselling SSDs.

Answer

Run a multi-pass overwrite with random data.

Answer

Degauss the SSDs to remove magnetic data.

Answer

Perform a standard delete and empty the recycle bin.

Question 13

A company uses a private cloud for its development environment. A developer complains that they cannot deploy a new application because the cloud management portal shows a 'resource quota exceeded' error. The technician checks the cluster and finds that CPU and memory usage are below 50%. What is the most likely cause of the error?

Accepted Answer

The developer's resource allocation quota has been reached. The error 'resource quota exceeded' in a cloud management portal is a quota-based restriction, not a physical capacity issue. Since CPU and memory usage are below 50%, the cluster has available resources, but the developer's individual or project-level allocation quota has been reached. This is a common multi-tenant cloud control mechanism to prevent any single user from consuming all resources.

Answer

The hypervisor is in maintenance mode

Answer

The storage pool is full

Answer

The virtual switch is not configured for the developer's VLAN

Question 14

A technician is investigating a data breach and discovers that an attacker obtained sensitive files by searching through the company's recycling bins. The bins contained printed reports with customer names and account numbers. What social engineering attack was used?

Accepted Answer

Dumpster diving. Dumpster diving is the social engineering attack where an attacker retrieves discarded materials, such as printed documents, to obtain sensitive information. In this scenario, the attacker searched through recycling bins and found printed reports with customer data, which is a classic example of dumpster diving.

Answer

Tailgating

Answer

Shoulder surfing

Answer

Phishing

Question 15

A new employee receives an email that appears to be from the company's HR department, asking them to click a link to verify their direct deposit information for payroll. The email contains the company logo and looks professional. What is the most likely social engineering attack?

Accepted Answer

Phishing. Phishing is the correct answer because the attack uses a deceptive email that impersonates a legitimate entity (HR department) to trick the recipient into clicking a malicious link. This is a classic example of a broad, untargeted social engineering attack delivered via email, which is the defining characteristic of phishing.

Answer

Whaling

Answer

Vishing

Answer

Shoulder surfing