220-1202 Practice Test 32 — 15 Questions

Question 1

A user reports that after installing a free PDF converter from an advertisement, their browser homepage changed and they see constant pop-ups for antivirus software. A malware scan found PUPs (Potentially Unwanted Programs). What is the best next step to fully remove the unwanted software and restore browser settings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a dedicated adware removal tool and then reset the browser.. PUPs often embed deeply into browser settings and registry entries that a standard uninstall or System Restore may not fully remove. A dedicated adware removal tool targets these specific traces, and resetting the browser ensures all malicious extensions, search providers, and homepage hijacks are cleared, restoring default security configurations.

Answer

Run System Restore to a point before installation.

Answer

Manually delete the program from Program Files.

Answer

Disable the browser's JavaScript and ActiveX.

Question 2

During a routine security audit, you find that several workstations have the same local administrator password. The company policy requires unique passwords for each machine. Which tool or method should you use to enforce unique local administrator passwords across the domain?

Accepted Answer

Deploy Microsoft LAPS (Local Administrator Password Solution).. Microsoft LAPS (Local Administrator Password Solution) is the correct tool because it automatically manages local administrator passwords on domain-joined computers, storing them in Active Directory and rotating them to unique values per machine. This directly enforces the policy of unique local admin passwords without manual intervention, using the `AdmPwd` extension and Group Policy to configure password complexity and rotation intervals.

Answer

Use Group Policy to set a standard local admin password.

Answer

Enable BitLocker on each workstation.

Answer

Disable the local administrator account on all workstations.

Question 3

During a software installation, a technician receives a pop-up warning that the application requires administrator privileges. The user is logged in with a standard account. What is the most appropriate action for the technician to take?

Accepted Answer

Right-click the installer and select 'Run as administrator', then enter admin credentials.. The technician can use the 'Run as administrator' feature to supply administrative credentials for a one-time elevated installation without changing the user's account type. This adheres to the principle of least privilege, maintaining security by not permanently elevating the standard user's rights.

Answer

Ask the user to log in with an administrator account and install the software.

Answer

Temporarily add the user to the Administrators group, install, then remove them.

Answer

Cancel the installation and escalate to a senior technician.

Question 4

After a power outage, a Windows 10 computer boots to a black screen with the message 'Bootmgr is missing'. The technician has a Windows installation USB. Which repair command should be used to rebuild the Boot Configuration Data (BCD)?

Accepted Answer

Run 'bootrec /rebuildbcd'.. The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is corrupted or missing. The 'bootrec /rebuildbcd' command scans all disks for Windows installations and prompts you to add them to a new BCD store, directly rebuilding the BCD. This is the correct repair for a missing or corrupt BCD, which is the specific cause of this error.

Answer

From the recovery command prompt, run 'bootrec /fixmbr'.

Answer

Run 'bootrec /fixboot'.

Answer

Run 'sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows'.

Question 5

During a security audit, a technician discovers that a company's wireless network uses WEP encryption. The network has been in place for 10 years and still uses the original router. What is the most immediate security risk?

Accepted Answer

WEP keys can be easily cracked using tools like Aircrack-ng.. WEP encryption is fundamentally flawed because it uses the RC4 cipher with a weak initialization vector (IV) that is transmitted in plaintext. Tools like Aircrack-ng can capture enough IVs (typically 20,000–40,000) to derive the WEP key within minutes, regardless of key length. This makes the network trivially vulnerable to unauthorized access and data decryption, which is the most immediate and exploitable risk.

Answer

The router may not support modern encryption protocols.

Answer

The router's firmware is likely outdated and vulnerable to exploits.

Answer

WEP does not support WPA2-PSK, so clients must use a different protocol.

Question 6

A user reports that their Windows 10 PC is infected with a virus that keeps reappearing after removal. The technician boots into Safe Mode, runs a full antivirus scan, and removes the threat. However, after rebooting normally, the virus returns. What is the most likely reason?

Accepted Answer

The virus has a persistence mechanism, such as a scheduled task or registry run key.. The virus likely uses a persistence mechanism such as a scheduled task (via schtasks.exe) or a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to re-infect the system after boot. Safe Mode may bypass some of these mechanisms, but a normal boot re-triggers them, allowing the virus to reinstall itself even after the initial removal.

Answer

The antivirus definitions are outdated.

Answer

The user is re-downloading the virus from the same source.

Answer

The virus is a polymorphic variant that changes its signature.

Question 7

A malicious script is suspected to have changed permissions on critical system files. The administrator needs to restore the /etc/passwd file to its default permissions, which are 644. The file is currently 777. Which command will set the correct permissions?

Accepted Answer

chmod 644 /etc/passwd. Chmod 644 /etc/passwd sets the permissions to rw-r--r--, which is the standard for /etc/passwd. This removes the world-writable and executable bits.

Answer

chmod 600 /etc/passwd

Answer

chmod 755 /etc/passwd

Answer

chmod 444 /etc/passwd

Question 8

A technician is troubleshooting a network switch that has stopped working. Upon arrival, the technician notices a strong smell of burnt plastic and sees that the power cable is melted near the connector. What is the most appropriate safety action?

Accepted Answer

Turn off the circuit breaker supplying the outlet.. The strong smell of burnt plastic and melted power cable indicate an electrical fault that could cause a fire or electric shock. Turning off the circuit breaker (Option B) is the most appropriate safety action because it disconnects power at the source, eliminating the risk of arcing or electrocution before any physical contact is made with the damaged equipment.

Answer

Unplug the power cable from the switch.

Answer

Replace the power cable with a new one.

Answer

Spray the cable with a Class C fire extinguisher.

Question 9

A technician is troubleshooting an Android tablet that cannot connect to a corporate Wi-Fi network. Other devices connect fine. The tablet shows 'Saved, secured' but no IP address. What is the most likely cause?

Accepted Answer

The tablet has a static IP address configured that conflicts with the network.. The tablet shows 'Saved, secured' but has no IP address, indicating it successfully associated and authenticated with the Wi-Fi network but failed to obtain an IP address via DHCP. A static IP configuration that conflicts with the network's DHCP scope or subnet prevents the device from receiving a valid lease, causing the IP assignment failure while other devices using DHCP connect normally.

Answer

The Wi-Fi adapter is faulty.

Answer

The corporate network requires a VPN profile that is missing.

Answer

The tablet's MAC address is blocked by the router.

Question 10

A user's iOS device is running out of storage, and they want to offload unused apps without deleting documents and data. Which iOS feature should be recommended, and where is it configured?

Accepted Answer

Use 'Offload Unused Apps' in Settings > General > iPhone Storage. The 'Offload Unused Apps' feature automatically removes app binaries when storage is low, but preserves the app's documents and data. This is configured in Settings > General > iPhone Storage, where users can also manually offload individual apps. It directly addresses the user's requirement to free up space without losing personal data.

Answer

Enable 'Optimize iPhone Storage' in Photos settings

Answer

Manually delete apps from the Home Screen

Answer

Configure iCloud Storage to offload app data

Question 11

A small business owner wants to ensure that only authorized users can log into their Windows 10 workstations. They need a tool to create and manage user accounts and set password policies. Which administrative tool should you use?

Accepted Answer

Local Users and Groups. Local Users and Groups (lusrmgr.msc) is the snap-in for managing user accounts, groups, and local security policies on a standalone Windows system. It allows creating, modifying, and deleting users and setting password requirements.

Answer

Computer Management

Answer

Group Policy Editor

Answer

Task Scheduler

Question 12

After a malware infection, a user's Windows 10 PC has several suspicious scheduled tasks that run at startup. Which administrative tool should you use to review and disable these tasks?

Accepted Answer

Task Scheduler to examine the task library and disable suspicious entries.. The Task Scheduler (taskschd.msc) is the correct administrative tool to review and disable suspicious scheduled tasks because it provides a centralized library of all tasks, including their triggers, actions, and conditions. After a malware infection, attackers often create persistent scheduled tasks that run at startup; using Task Scheduler, you can navigate to the Task Scheduler Library, locate the malicious entries, and disable or delete them directly without affecting the core Task Scheduler service.

Answer

Services console to stop the 'Task Scheduler' service.

Answer

Resource Monitor to see which tasks are currently running.

Answer

Windows Firewall with Advanced Security to block the tasks' network access.

Question 13

A customer reports that their office printer is emitting a strong, acrid smell and producing distorted prints. The printer uses a fuser unit that has been in service for five years. What should you recommend as the most environmentally responsible action?

Accepted Answer

Replace only the fuser unit and recycle the old one through a certified e-waste recycler.. The fuser unit is a consumable component that degrades over time, and replacing only the faulty fuser while recycling the old one through a certified e-waste recycler minimizes electronic waste. This approach addresses the root cause (a worn-out fuser) without discarding the entire printer, which would generate unnecessary e-waste and violate environmental best practices.

Answer

Replace the entire printer with a new Energy Star model.

Answer

Continue using the printer until it fails completely.

Answer

Disassemble the printer and dispose of all parts in the general trash.

Question 14

A security auditor discovers that a company's data destruction logs show only a quick format was performed on drives before disposal. The drives contained personally identifiable information (PII). What is the primary risk?

Accepted Answer

The PII data is still recoverable from the drives.. A quick format only clears the file system metadata (e.g., the Master File Table on NTFS) and marks the drive's sectors as available for new data, but it does not overwrite the actual data stored in those sectors. Because the PII data remains physically on the platters or NAND cells, it can be easily recovered using file recovery tools or forensic software. This makes the data destruction process incomplete and poses a severe compliance and privacy risk.

Answer

The drives may not boot properly after disposal.

Answer

The drives could be reused without any issues.

Answer

The drives will no longer hold a magnetic charge.

Question 15

During a security audit, you find that a company's server room door is propped open with a trash can to allow airflow. What is the most immediate physical security risk in this scenario?

Accepted Answer

Unauthorized personnel can enter the server room. The most immediate physical security risk of a propped-open server room door is that it completely bypasses access control mechanisms (e.g., badge readers, PIN pads, biometric scanners). This allows any unauthorized person—whether an employee without clearance, a visitor, or an intruder—to enter the server room undetected, potentially leading to theft, vandalism, or data breaches. Physical security controls are the first line of defense, and an open door nullifies them instantly.

Answer

Increased dust entering the server room

Answer

Fire suppression system may not work

Answer

The door closer will wear out faster