220-1202 Practice Test 31 — 15 Questions

Question 1

A user reports that they can no longer access their encrypted files after a recent password change. The files were encrypted using EFS on a Windows 10 Pro workstation. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user did not back up their EFS certificate before changing the password.. EFS (Encrypting File System) uses a per-user certificate that is tied to the user's password hash. When a user changes their password without first backing up the EFS certificate, the system may lose access to the private key because the certificate's master key is encrypted with the old password hash. Without a backup of the certificate and private key, the encrypted files become permanently inaccessible.

Answer

The user changed the password via Ctrl+Alt+Del, which invalidates the EFS certificate.

Answer

The user's account was removed from the local Administrators group during the password change.

Answer

The hard drive has a hardware failure that corrupted the encrypted files.

Question 2

A technician discovers that a Windows 10 workstation has been infected with a fileless malware that resides in memory. Traditional antivirus scans have not detected it. Which approach should the technician use to remove this type of malware?

Accepted Answer

Boot from a rescue disk and perform an offline scan.. Fileless malware resides entirely in memory (RAM) and does not write persistent files to disk, so traditional antivirus scans that rely on file signatures cannot detect it. Booting from a rescue disk (e.g., a bootable USB or CD with an offline scanner) loads a clean operating system that bypasses the infected Windows environment, allowing the scanner to inspect memory and terminate the malware without the malware being able to hide or protect itself. This offline approach ensures the malware's process cannot interfere with the scan, making it the correct remediation method.

Answer

Run a full antivirus scan in normal mode.

Answer

Use the Windows Malicious Software Removal Tool (MSRT) in Safe Mode.

Answer

Restore the system from a backup taken before the infection.

Question 3

A user reports that a scheduled backup script on their Windows 10 workstation runs every day but fails to complete. The script uses PowerShell to copy files to a network share. When the user runs the script manually from an elevated PowerShell prompt, it works. What is the most likely cause of the failure?

Accepted Answer

The scheduled task is not set to run with highest privileges.. The scheduled task runs under the SYSTEM account by default, which lacks the necessary permissions to access network resources or perform administrative file operations. Running the script manually from an elevated PowerShell prompt works because the user has the required privileges. Setting the task to 'Run with highest privileges' elevates the SYSTEM account to have the same rights as an administrator, resolving the access issue.

Answer

The script file extension is .ps1 instead of .bat.

Answer

The network share is mapped as a drive letter, which is not available during system startup.

Answer

PowerShell execution policy is set to Restricted for the SYSTEM account.

Question 4

A user calls the help desk because their computer is running slowly and they see a fake antivirus program warning that their system is infected. The user cannot close the warning window. Which type of malware is this, and what is the best removal approach?

Accepted Answer

Rogue antivirus; boot into Safe Mode with Networking and run Malwarebytes.. The symptoms—a fake antivirus warning that cannot be closed—are classic indicators of rogue antivirus (scareware). This type of malware mimics legitimate security software to trick users into paying for unnecessary services. The best removal approach is to boot into Safe Mode with Networking, which loads only essential drivers and services, preventing the rogue program from auto-starting, then run Malwarebytes to detect and remove the threat.

Answer

Ransomware; pay the fee to remove the warning.

Answer

Spyware; run a full scan in normal mode.

Answer

Adware; uninstall the program from Control Panel.

Question 5

A technician receives an email that appears to be from the company's HR department asking them to click a link to update their direct deposit information. The email contains several grammatical errors and the sender's domain is 'company-hr.com' instead of the official 'company.com'. What is the most effective way to confirm this is a phishing attempt?

Accepted Answer

Forward the email to the company's security team for analysis.. Forwarding the suspicious email to the company's security team allows trained analysts to inspect headers, attachments, and URLs in a sandboxed environment without exposing the technician to risk. This aligns with organizational incident response procedures for phishing, as the security team can verify the sender domain (e.g., SPF/DKIM/DMARC failures) and determine if the email is malicious.

Answer

Reply to the email asking for verification.

Answer

Click the link to see if it looks legitimate.

Answer

Call the phone number listed in the email signature.

Question 6

A technician is configuring a Windows 10 kiosk system that will run a single application in a public library. The kiosk must automatically log on and start the app without any user interaction. Which security setting combination is required?

Accepted Answer

Configure 'Automatic logon' in the registry and enable 'Assigned Access' for the kiosk account. Configuring 'Automatic logon' in the registry (via the WinLogon key) allows the kiosk to boot directly to the desktop without user interaction, while enabling 'Assigned Access' restricts the kiosk account to running only a single specified Universal Windows Platform (UWP) app, preventing access to the rest of the system. This combination meets the requirement for an unattended, single-application kiosk in a public library.

Answer

Enable 'Sticky Keys' and configure the 'Ease of Access' settings

Answer

Set the 'Shutdown: Allow system to be shut down without having to log on' policy

Answer

Enable 'User Account Control: Run all administrators in Admin Approval Mode'

Question 7

A technician is configuring a new employee's laptop and needs to ensure that only approved applications can run. The company wants to prevent users from installing unauthorized software. Which security control should be implemented?

Accepted Answer

Configure an application whitelist using AppLocker.. AppLocker is a Windows security feature that allows administrators to create rules that explicitly permit only approved applications to run, effectively blocking all others. This is the correct control for preventing unauthorized software installation because it enforces an application whitelist at the kernel level, overriding user permissions. Standard User accounts or antivirus alone cannot prevent execution of approved-but-unauthorized binaries, making AppLocker the precise solution for this requirement.

Answer

Enable Windows Defender real-time protection.

Answer

Set the user account as a Standard User.

Answer

Disable the Windows Store.

Question 8

A user in the accounting department cannot print to a network printer that other users can access. They are running Windows 10. When they try to print, they get a message: 'Windows cannot connect to the printer. Access is denied.' What is the most likely cause of this issue?

Accepted Answer

The user does not have permission to use the printer.. The error message 'Access is denied' specifically indicates a permissions issue at the printer or print server level, not a connectivity or hardware problem. Since other users can print successfully, the printer and network are functional, isolating the cause to the user's lack of permission to use the printer. In Windows, printer permissions are managed via the Security tab in printer properties, where the 'Print' permission must be granted to the user or their group.

Answer

The printer driver is corrupt on the user's computer.

Answer

The network cable is unplugged from the user's computer.

Answer

The printer is out of paper or toner.

Question 9

A company deploys a fleet of Android tablets that need to be configured so that only pre-approved apps can be installed, and the Google Play Store must be hidden from users. The tablets are not enrolled in an MDM. Which Android feature can be used to achieve this without third-party software?

Accepted Answer

Use a free kiosk app that utilizes Android's Lock Task Mode to pin approved apps and hide the launcher.. None of the provided options achieve the desired configuration without third-party software. Option B mentions using a free kiosk app, which is a third-party software, thus violating the requirement. The correct approach would be to use Android's native Lock Task Mode directly via Developer Options or Android Management APIs, which does not require any third-party app. The other options (A, C, D) do not restrict app installation to pre-approved apps or are reversible.

Answer

Enable Guest Mode and restrict app installation via parental controls.

Answer

Boot the device into Safe Mode and disable the Play Store from there.

Answer

Remove the Google account from the device and disable the Play Store via Settings > Apps.

Question 10

While configuring a new Windows 11 workstation, you need to ensure that a legacy application can always run with administrative privileges without prompting the user. The user is a standard user. What is the best way to accomplish this?

Accepted Answer

Create a scheduled task that runs with the highest privileges and launches the application at user logon.. Forcing a legacy app to run as administrator without UAC prompts for a standard user requires creating a scheduled task that runs with elevated privileges. The task can be set to run at user logon or on demand, and the application is launched by the task with the stored admin credentials. This bypasses UAC while maintaining security for the standard user account.

Answer

Set the application's compatibility mode to 'Run this program as an administrator' and grant the user full control over the program's folder.

Answer

Disable User Account Control (UAC) via the Control Panel.

Answer

Add the user to the local Administrators group.

Question 11

A user reports that after a recent Windows update, the 'Local Users and Groups' snap-in is missing from the Computer Management console. The user needs to add a new local user account. Which administrative tool should be used to complete this task?

Accepted Answer

Run lusrmgr.msc from the Run dialog.. The 'Local Users and Groups' snap-in is a Microsoft Management Console (MMC) component that can be launched directly by running lusrmgr.msc from the Run dialog. This command opens the Local Users and Groups manager, which allows you to create, modify, and delete local user accounts and groups without needing the Computer Management console. Since the snap-in is missing from the console due to the update, using the standalone MMC command is the correct workaround.

Answer

Open the Services console (services.msc) and restart the 'User Manager' service.

Answer

Use the Disk Management tool to create a new user volume.

Answer

Open the Registry Editor and modify the SAM registry hive.

Question 12

A user's Windows 10 laptop fails to boot and shows 'INACCESSIBLE_BOOT_DEVICE' blue screen error. The technician suspects a recent driver update for the storage controller. Which recovery environment command can be used to disable the problematic driver from loading?

Accepted Answer

Run 'bcdedit /set {default} safeboot minimal' from the recovery command prompt.. The 'INACCESSIBLE_BOOT_DEVICE' error often occurs after a faulty storage controller driver update. Booting into Safe Mode with minimal drivers can bypass the problematic driver. The command 'bcdedit /set {default} safeboot minimal' configures the boot loader to start Windows in Safe Mode on the next restart, loading only essential drivers and services, which allows the technician to roll back or uninstall the offending driver.

Answer

Run 'diskpart' and then 'clean' to wipe the disk.

Answer

Run 'chkdsk /f' to fix file system errors.

Answer

Run 'bootrec /fixboot' to repair the boot sector.

Question 13

A user reports that their Android phone's Bluetooth keeps disconnecting from their car's hands-free system. The technician has already cleared the Bluetooth cache and re-paired the devices. What should the technician do NEXT?

Accepted Answer

Update the car's infotainment system firmware.. After basic troubleshooting (cache clear and re-pair) fails, the next logical step is to check for firmware updates on the car's infotainment system. Bluetooth connectivity issues between a phone and a car are often caused by incompatibilities or bugs in the car's Bluetooth stack, which can be resolved by updating the car's firmware. The technician should prioritize updating the car's system before considering hardware replacement or more drastic phone resets.

Answer

Perform a factory reset on the phone.

Answer

Replace the phone's Bluetooth antenna.

Answer

Disable Bluetooth power saving mode on the phone.

Question 14

A help desk technician receives a complaint that a shared network printer is no longer accessible after a scheduled firmware update was applied to the print server last night. The change was documented but no rollback plan was included. What should the technician do first?

Accepted Answer

Restore the print server to its previous firmware version.. The scheduled firmware update directly caused the printer to become inaccessible, and without a documented rollback plan, reverting to the previous firmware version is the safest and most immediate way to restore service. This aligns with change management best practices, which prioritize backing out a failed change before troubleshooting further, as the root cause is clearly the firmware update.

Answer

Reboot the print server to clear any temporary errors.

Answer

Submit a new change request to update the firmware again.

Answer

Disable the printer in Active Directory and re-add it.

Question 15

A technician is tasked with disposing of several old UPS batteries from a server room. What is the most environmentally responsible method?

Accepted Answer

Take them to a local battery recycling center.. UPS batteries contain hazardous materials such as lead and sulfuric acid, which must be handled through specialized recycling processes to prevent environmental contamination. Local battery recycling centers are equipped to safely extract and reuse these materials, complying with regulations like the Resource Conservation and Recovery Act (RCRA) in the U.S.

Answer

Place them in the regular dumpster for pickup.

Answer

Burn them in an incinerator to recover energy.

Answer

Store them indefinitely in a sealed container.