220-1202 Practice Test 27 — 15 Questions

Question 1

A customer complains that their new smartphone connects to their home Wi-Fi but has no internet access. The router is configured with WPA2-PSK and a 64-character pre-shared key. Other devices work fine. What is the most likely cause?

Accepted Answer

The smartphone is using a wrong or mistyped Wi-Fi password.. WPA2-PSK with a 64-character key is extremely long and easy to mistype. The smartphone likely has an incorrect password stored, so it authenticates to the router but fails to get an IP address because the router rejects the mismatched key during the 4-way handshake.

Answer

The smartphone's Wi-Fi antenna is faulty.

Answer

The router's DHCP server has run out of IP addresses.

Answer

The smartphone's DNS settings are misconfigured.

Question 2

A technician is setting up a wireless network for a small office that handles sensitive client data. The office has a mix of modern laptops and a few legacy printers that only support WEP. What should the technician do to maintain security while keeping the printers functional?

Accepted Answer

Create a separate VLAN for the printers using WEP and a strong passphrase, and keep the main network on WPA2.. WEP is deprecated due to severe vulnerabilities. The best practice is to isolate legacy devices on a separate VLAN with WEP and use a strong passphrase, while the main network uses WPA2 or WPA3. This limits exposure of sensitive data.

Answer

Enable WEP on the main router and set a complex 128-bit key.

Answer

Replace the printers with modern ones that support WPA2.

Answer

Set the router to mixed mode (WEP + WPA2) and use a single SSID.

Question 3

A user reports that their corporate laptop can connect to the guest Wi-Fi network but not to the internal corporate network. Both networks use WPA2-Enterprise with 802.1X. The laptop works fine on other corporate networks. What is the most likely issue?

Accepted Answer

The corporate network's RADIUS certificate has expired or is untrusted.. WPA2-Enterprise uses RADIUS for authentication. A common issue is that the laptop's certificate for the corporate network has expired or is not trusted by the specific RADIUS server. Guest networks often use simpler authentication like PSK, which bypasses certificate requirements.

Answer

The laptop's wireless card is faulty.

Answer

The corporate network is using a different SSID than expected.

Answer

The laptop's Wi-Fi profile is configured for WPA2-Personal instead of Enterprise.

Question 4

During a security audit, a technician discovers that a small office's wireless router is still using WPA-TKIP. The office has 20 devices, including some older smartphones that cannot support WPA2. What should the technician recommend to improve security without replacing all devices?

Accepted Answer

Upgrade the router to support WPA2 and configure it to use WPA2-PSK with AES encryption.. WPA-TKIP is vulnerable and should be replaced. The best approach is to upgrade the router to support WPA2 and use WPA2-PSK with AES, which is backward-compatible with most devices. If some devices truly cannot support WPA2, they should be replaced or isolated.

Answer

Keep WPA-TKIP but enable MAC address filtering to block unauthorized devices.

Answer

Change the SSID to something non-descript and disable SSID broadcast.

Answer

Switch to WPA3 and set up a separate guest network for older devices.

Question 5

A technician is configuring a new wireless network for a school. The network must support hundreds of student devices simultaneously and provide strong security. The school wants to use a single SSID with individual logins for students. Which security protocol should the technician choose?

Accepted Answer

WPA3-Enterprise with 192-bit encryption.. WPA3-Enterprise with 192-bit encryption is the most secure option for environments requiring individual authentication and high traffic. It provides stronger encryption and protection against dictionary attacks compared to WPA2-Enterprise.

Answer

WPA2-PSK with a long passphrase.

Answer

WPA2-Enterprise with 802.1X and RADIUS.

Answer

WPA3-Personal with SAE.

Question 6

A user reports that their laptop frequently disconnects from the office Wi-Fi and reconnects after a few seconds. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. Other users do not experience this issue. What is the most likely cause?

Accepted Answer

The RADIUS server is rejecting the laptop's certificate intermittently.. PEAP-MSCHAPv2 is prone to authentication timeouts if the RADIUS server is slow or if the client's certificate validation fails. This can cause periodic disconnects. The issue is specific to the client's configuration or certificate trust.

Answer

The laptop's wireless driver is outdated.

Answer

The office Wi-Fi channel is congested.

Answer

The laptop's power saving mode is turning off the Wi-Fi adapter.

Question 7

A company's security policy requires all wireless traffic to be encrypted with AES. A technician is configuring a new access point and sees the following options: WPA2-PSK (TKIP), WPA2-PSK (AES), WPA3-SAE, and WEP. Which option should the technician select?

Accepted Answer

WPA3-SAE. WPA3-SAE uses AES encryption by default and is the most secure option. It also provides forward secrecy and protection against offline dictionary attacks. The policy requires AES, and WPA3 meets that while being the latest standard.

Answer

WPA2-PSK (TKIP)

Answer

WPA2-PSK (AES)

Answer

WEP

Question 8

A network administrator is investigating a security incident where an attacker captured the 4-way handshake of a WPA2-PSK network and successfully cracked the passphrase. Which protocol change would most effectively prevent this type of attack in the future?

Accepted Answer

Upgrade to WPA3-SAE.. WPA3-SAE uses Simultaneous Authentication of Equals (SAE), which provides forward secrecy. This means that even if an attacker captures the handshake, they cannot crack the passphrase offline because the handshake does not contain enough information to derive the key.

Answer

Switch to WPA2-Enterprise with 802.1X and a RADIUS server.

Answer

Increase the WPA2-PSK passphrase length to 63 characters.

Answer

Enable MAC address filtering on the access point.

Question 9

A technician is troubleshooting a wireless network where users report intermittent connectivity and slow speeds. The network uses WPA2-Enterprise with EAP-TLS and certificate-based authentication. The technician notices that the RADIUS server logs show frequent certificate validation failures. What is the most likely root cause?

Accepted Answer

Client devices have expired or untrusted certificates.. EAP-TLS requires both the server and client to present valid certificates. If the client certificates are expired or not trusted by the RADIUS server, authentication will fail. This causes intermittent disconnects as clients attempt to reauthenticate.

Answer

The access point's firmware is outdated, causing packet loss.

Answer

The RADIUS server's certificate has expired.

Answer

The wireless channel is overlapping with neighboring networks.

Question 10

A user reports that their system is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice that their default search engine has changed without their permission. Which type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware is designed to display unwanted advertisements and can modify browser settings, causing pop-ups and search engine hijacking. Unlike a virus or worm, adware does not typically replicate itself or require a host file to spread. The symptoms described—pop-ups outside the browser and unauthorized search engine changes—are classic signs of adware infection.

Answer

Virus

Answer

Ransomware

Answer

Rootkit

Question 11

During a routine security audit, a technician discovers that a user's workstation has a program that records keystrokes and periodically sends the data to an external server. The user denies installing any software recently. Which type of malware is this?

Accepted Answer

Keylogger. A keylogger is a type of spyware that records keystrokes to capture sensitive information like passwords. It often operates stealthily without the user's knowledge, matching the scenario where the user did not install anything. Spyware is the broader category, but keylogger is the specific variant described.

Answer

Trojan horse

Answer

Worm

Answer

Ransomware

Question 12

A small business owner calls for support because all of their files on the server have been renamed with a .encrypted extension, and a text file named 'README_TO_DECRYPT.txt' appears on the desktop demanding a Bitcoin payment. What is the first step the technician should take?

Accepted Answer

Disconnect the server from the network.. The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Paying the ransom is discouraged as it does not guarantee data recovery and funds criminal activity. After isolation, the technician can assess the damage and attempt recovery from backups.

Answer

Pay the ransom to get the decryption key immediately.

Answer

Run a full antivirus scan on the server.

Answer

Restore files from a recent backup immediately.

Question 13

A user reports that their computer is infected with a virus and they have been trying to remove it using a free online scanner, but the problem persists. The technician suspects the malware may have disabled the antivirus software. Which safe mode should the technician use to run a full system scan?

Accepted Answer

Safe Mode with Networking. Safe Mode with Networking allows the technician to boot with minimal drivers and services while still having network access to download updated antivirus definitions or removal tools. Safe Mode alone does not provide network access, which is often needed to get the latest malware signatures. This mode also prevents many malware variants from loading, making removal easier.

Answer

Safe Mode

Answer

Safe Mode with Command Prompt

Answer

Last Known Good Configuration

Question 14

A technician is troubleshooting a Windows 10 workstation that displays a fake security alert claiming the system is infected and prompting the user to call a toll-free number. The user cannot close the alert window or open Task Manager. Which type of malware is causing this behavior, and what is the best removal approach?

Accepted Answer

It is a tech support scam; boot into Safe Mode with Networking and run an anti-malware scan.. This is a classic tech support scam, a form of scareware that locks the browser or desktop to trick users into calling a fake support number. The best removal approach is to boot into Safe Mode with Networking, then run a malware removal tool like Malwarebytes. This bypasses the malware's ability to block Task Manager and allows the technician to clean the system.

Answer

It is a rootkit; use a rootkit removal tool from within Windows.

Answer

It is ransomware; pay the fee to remove the alert.

Answer

It is a worm; disconnect the network and reinstall the operating system.

Question 15

A technician is removing malware from a Windows 10 PC and wants to ensure that no remnants remain in the registry or startup folders. After running an antivirus scan and deleting infected files, which additional step should the technician perform?

Accepted Answer

Check and clean startup entries using MSConfig or Autoruns.. After removing malware, it is critical to check and clean startup entries using tools like MSConfig or Autoruns to prevent the malware from reloading on reboot. Malware often adds entries to the registry Run keys or the Startup folder to persist. Simply deleting files may leave these entries intact, allowing the malware to reinstall itself.

Answer

Run the Windows Memory Diagnostic tool.

Answer

Disable System Restore to free up disk space.

Answer

Update all device drivers to the latest versions.