220-1202 Practice Test 27 — 15 Questions

Question 1

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the account to prevent further access.. The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Answer

Reset the account password and enable MFA.

Answer

Review the server logs to determine the extent of the breach.

Answer

Notify the employee's manager and HR department.

Question 2

A customer reports that their Windows 10 laptop is displaying pop-up ads even when no browser is open. They suspect a malware infection. Which of the following should you do first to remediate this issue?

Accepted Answer

Disconnect the network cable, boot into Safe Mode, then run a full antivirus scan.. The first step in malware remediation is to disconnect from the network to prevent further communication with command-and-control servers. Then boot into Safe Mode to prevent malicious processes from loading, and run a full antivirus scan. This isolates the threat before attempting removal.

Answer

Run a full antivirus scan while the system is connected to the internet.

Answer

Perform a System Restore to a point before the pop-ups started.

Answer

Immediately reinstall Windows 10 to ensure complete removal.

Question 3

A user reports that their external hard drive is no longer recognized by Windows. They suspect it might be infected with malware from a previous connection. You run a security scan and find no threats. What is the most likely cause of the drive not being recognized?

Accepted Answer

The USB controller driver is corrupted or outdated.. When a drive is not recognized after a suspected malware incident, the issue is often driver-related or due to a corrupted file system, not necessarily malware. Reinstalling or updating the USB controller driver in Device Manager can resolve recognition issues. The correct answer is to check Device Manager for driver issues.

Answer

The drive is permanently damaged by malware.

Answer

The user needs to format the drive to remove malware.

Answer

Windows Firewall is blocking the external drive.

Question 4

A technician is troubleshooting a Windows 10 PC that was infected with a rootkit. After booting from a rescue disk and running a scan, the rootkit is removed, but the system is still unstable. What should the technician do next to ensure the system is fully remediated?

Accepted Answer

Run the System File Checker (SFC) tool to repair corrupted files.. After removing a rootkit, the system may have corrupted system files that cause instability. Running the System File Checker (SFC) tool with the 'sfc /scannow' command scans protected system files and replaces corrupted versions with cached copies from the Windows side-by-side store, directly addressing file integrity issues left by the rootkit.

Answer

Reinstall the operating system from scratch.

Answer

Disable System Restore and delete all restore points.

Answer

Perform a disk cleanup to remove temporary files.

Question 5

A security incident occurred where an unauthorized user accessed a workstation. You need to review the event logs to determine when the breach happened. Which Control Panel applet would you use to launch the Event Viewer?

Accepted Answer

Administrative Tools. Administrative Tools is the Control Panel applet that provides access to advanced system tools, including Event Viewer. To investigate a security breach, you would open Administrative Tools and then launch Event Viewer to review security logs for unauthorized access events. This is the correct path because Event Viewer is not directly listed in the main Control Panel categories; it is nested within Administrative Tools.

Answer

System

Answer

Security and Maintenance

Answer

Device Manager

Question 6

A small business owner wants to ensure that if a laptop is stolen, the data on the drive cannot be read. The laptop runs Windows 11 Pro. What is the most appropriate remediation?

Accepted Answer

Enable BitLocker on the system drive. BitLocker is the native full-disk encryption feature in Windows 11 Pro that encrypts the entire system drive, including the operating system, applications, and all user data. If the laptop is stolen, the data on the drive remains unreadable without the recovery key or TPM authentication, even if the drive is removed and attached to another computer. This directly addresses the requirement to prevent data access after theft.

Answer

Set a strong BIOS password

Answer

Install an antivirus with anti-theft features

Answer

Use a cloud backup service

Question 7

A company's security policy requires that all Windows 10 workstations automatically install critical updates as soon as they are released. However, users must not be forced to restart during work hours. Which Windows Update setting should you configure to meet these requirements?

Accepted Answer

Set Active Hours to cover the workday. Configuring Active Hours in Windows Update allows you to specify the time range during which the system should not automatically restart after installing updates. By setting Active Hours to cover the entire workday, critical updates can be downloaded and installed automatically, but the required restart is deferred until outside those hours, meeting both the security policy and the user experience requirement.

Answer

Defer feature updates

Answer

Set the connection as metered

Answer

Configure Windows Update to 'Notify to schedule restart'

Question 8

A user reports that their cloud-based virtual desktop (VDI) is disconnecting frequently. The user's internet connection is stable, and other cloud services work fine. The technician checks the VDI's resource usage and finds that the virtual machine's RAM is consistently at 95% usage. What should the technician do to resolve the disconnections?

Accepted Answer

Increase the amount of RAM allocated to the VDI.. This scenario tests advanced troubleshooting of VDI performance. High memory usage can cause the VM to become unresponsive, leading to disconnections. Increasing the VM's RAM allocation directly addresses the resource bottleneck. Reducing RAM would worsen the problem, and network or GPU issues are not indicated.

Answer

Reduce the amount of RAM allocated to the VDI.

Answer

Reinstall the VDI client software on the user's device.

Answer

Enable GPU acceleration for the VDI.

Question 9

During a software deployment, you need to create a script that runs automatically every time a user logs into their Windows 10 domain-joined computer. Which tool should you use to configure this task?

Accepted Answer

Task Scheduler. Task Scheduler is the correct tool because it allows you to create a task that triggers on a specific event, such as user logon. You can set the trigger to 'At log on' for any user or a specific user, and the task will run automatically each time the user logs into the Windows 10 domain-joined computer. This is the native Windows mechanism for scheduling scripts or programs to run at logon without requiring additional configuration.

Answer

Group Policy Management Console

Answer

Local Group Policy Editor

Answer

Windows PowerShell ISE

Question 10

A user reports that their Windows 11 laptop's battery drains quickly even when idle. They have already checked for background apps and power-hungry processes. Which single Settings page can you use to generate a detailed battery usage report showing which apps and hardware have consumed the most power over the last 24 hours?

Accepted Answer

Settings > System > Power & battery > Battery usage. The correct tool is 'Battery usage' under Settings > System > Power & battery. This page provides a graph and detailed list of app and hardware power consumption, which can help identify the cause of rapid drain.

Answer

Settings > System > Power & battery > Battery saver

Answer

Control Panel > Power Options > Edit Plan Settings

Answer

Settings > Privacy & security > Diagnostics & feedback

Question 11

A small business owner wants to ensure that all company laptops are protected in case of theft. They need a solution that encrypts the entire hard drive and requires a pre-boot PIN. Which security feature should you implement?

Accepted Answer

Enable BitLocker with a TPM + startup PIN.. BitLocker with a TPM + startup PIN provides full-disk encryption and requires a pre-boot authentication PIN, meeting the requirement to protect the entire hard drive in case of theft. The TPM validates system integrity, and the PIN must be entered before the OS loads, preventing unauthorized access even if the drive is removed.

Answer

Enable EFS (Encrypting File System) on the Documents folder.

Answer

Set a BIOS password.

Answer

Install a third-party antivirus with encryption.

Question 12

A customer reports that their printer is not working after a recent Windows update. The technician suspects a driver issue. Which of the following is the BEST way to handle this situation while maintaining customer satisfaction?

Accepted Answer

Say you will research the issue and call them back within an hour with steps.. It demonstrates professional communication and sets realistic expectations. The technician acknowledges the issue, commits to researching the specific driver compatibility problem caused by the Windows update, and promises a follow-up within a defined timeframe. This approach maintains customer trust and avoids making promises or taking actions without a clear plan.

Answer

Tell the customer that Windows updates often break things and they should avoid updates.

Answer

Ask the customer to try unplugging the printer and plugging it back in.

Answer

Immediately remote into their computer and start checking settings without explaining.

Question 13

A company is migrating from Windows 10 to Windows 11 on several workstations. You need to verify that each computer meets the minimum hardware requirements, including TPM 2.0 and Secure Boot capability, before deploying the upgrade. Which built-in tool should you run on each machine to generate a compatibility report?

Accepted Answer

Windows 11 PC Health Check app (downloaded from Microsoft).. The Windows 11 PC Health Check app is the official Microsoft tool designed specifically to verify compatibility with Windows 11, including TPM 2.0 and Secure Boot capability. It generates a detailed compatibility report, making it the correct built-in tool for this pre-upgrade validation task.

Answer

System Information (msinfo32.exe) and manually check the System Summary for TPM and Secure Boot status.

Answer

Deployment Imaging and Servicing Management (DISM) with the /Get-CurrentEdition option.

Answer

System Restore (rstrui.exe) to revert to a previous state if the upgrade fails.

Question 14

A security incident occurred on a Windows 10 workstation where an unauthorized user gained access. The technician needs to review detailed security events, such as logon attempts and file access, to determine the scope of the breach. Which tool should the technician use to examine these logs?

Accepted Answer

Event Viewer. Event Viewer is the correct tool because it provides a centralized, detailed log of security-related events, including logon attempts (Event ID 4624 for successful logons, 4625 for failed logons) and file access audits (Event ID 4663). These logs are essential for forensic analysis to determine the scope of a breach on a Windows 10 workstation.

Answer

Resource Monitor

Answer

Performance Monitor

Answer

Local Security Policy

Question 15

A customer reports that their Windows 10 desktop shows a black screen with a movable cursor after logging in. They can press Ctrl+Alt+Del and open Task Manager. Which process should be restarted from Task Manager to restore the desktop and taskbar?

Accepted Answer

Restart the 'Windows Explorer' process in Task Manager.. The black screen with a movable cursor after login, combined with the ability to open Task Manager via Ctrl+Alt+Del, indicates that the Windows shell (explorer.exe) has crashed or is not running. Restarting the 'Windows Explorer' process from Task Manager (File > Run new task > 'explorer.exe') reloads the desktop, taskbar, and File Explorer, restoring the graphical user interface. This is the standard recovery step for a missing shell in Windows 10.

Answer

End the 'svchost.exe' process group.

Answer

Start the 'winlogon.exe' process.

Answer

Run 'msconfig' from the Run dialog to enable normal startup.