220-1202 Practice Test 33 — 15 Questions

Question 1

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Group Policy to allow only the specific USB device by hardware ID, then remove the allowance after use. It uses Group Policy to enforce a device installation restriction by hardware ID, allowing only the specific USB device while blocking all others. This maintains the security policy's intent by preventing unauthorized devices while granting temporary, auditable access. After use, removing the allowance restores the full block without domain-wide disruption.

Answer

Disable the USB blocking Group Policy for the entire domain

Answer

Give the manager a company-approved USB drive and tell them to use it only once

Answer

Create a local admin account on the manager's workstation and disable the USB block locally

Question 2

During a routine security scan, a technician finds that a user's workstation has an open port 3389 that is accessible from the internet. The user denies enabling Remote Desktop. What is the most likely security implication and immediate action?

Accepted Answer

Disable the Remote Desktop service and block port 3389 at the firewall immediately.. Port 3389 is the default port for Remote Desktop Protocol (RDP). An open RDP port accessible from the internet is a critical security risk because it exposes the workstation to brute-force attacks, credential theft, and remote exploitation (e.g., BlueKeep, CVE-2019-0708). The immediate action is to disable the Remote Desktop service and block port 3389 at the firewall, as the user denies enabling it, indicating possible unauthorized activation or malware.

Answer

The port is likely used by a legitimate application; no action is needed.

Answer

Change the RDP listening port to a non-standard port to hide it.

Answer

Enable Network Level Authentication (NLA) on the workstation.

Question 3

A company requires that all sensitive data be encrypted when stored on laptops. Which technology should be implemented to ensure data is protected even if a laptop is stolen?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption provides full-volume encryption that protects all data on the system drive, including the operating system, applications, and user files. Even if a laptop is stolen and the hard drive is removed, the data remains inaccessible without the correct recovery key or authentication credentials, ensuring compliance with data protection requirements.

Answer

File-level encryption using EFS

Answer

TPM chip only

Answer

Secure Boot

Question 4

A customer reports that their laptop was stolen from a locked office over the weekend. The office door uses a standard key lock, and the laptop was not physically secured. Which physical security control would have most likely prevented this theft?

Accepted Answer

Attach a cable lock to the laptop. A cable lock physically tethers the laptop to a fixed object such as a desk or wall mount, directly preventing removal from the premises. Since the laptop was stolen from a locked office, the failure was the lack of a physical tether, not the door lock itself. A cable lock is the specific physical control designed to deter and prevent laptop theft.

Answer

Use a smart card reader on the door

Answer

Install a security camera in the hallway

Answer

Enable BitLocker on the laptop

Question 5

A customer reports that after a recent software update, their accounting application crashes every time they try to generate a report. The technician checks the change log and finds no record of any update being approved for that application. What should the technician do first?

Accepted Answer

Document the unauthorized change and escalate it to the change advisory board.. The technician found an unauthorized change (the update) with no approval record. The first step in change management is to document and escalate the unauthorized change to the Change Advisory Board (CAB) to assess impact, determine root cause, and authorize remediation. Restoring or reinstalling without CAB approval could violate change control policies and introduce additional risks.

Answer

Restore the application from the last known good backup.

Answer

Uninstall the update and reinstall the previous version of the application.

Answer

Contact the software vendor to request a patch for the crash.

Question 6

A user reports that their Windows 10 laptop suddenly shows a black screen with a movable mouse cursor after logging in. They can press Ctrl+Alt+Del to open the security screen. Which troubleshooting step should you perform first to restore the desktop?

Accepted Answer

Press Ctrl+Alt+Del, open Task Manager, then run a new task and type 'explorer.exe'.. A black screen with a visible, movable mouse cursor after login is the classic symptom of explorer.exe failing to start — the shell process that renders the desktop, taskbar, and Start menu. Since Ctrl+Alt+Del still opens the security screen, the OS kernel and session manager are healthy, so the fastest fix is to launch Task Manager and manually start explorer.exe via File > Run new task. This restores the desktop immediately without rebooting or risking data loss.

Answer

Boot into Safe Mode and run System File Checker (sfc /scannow).

Answer

Perform a system restore to a point before the issue started.

Answer

Check the display driver by pressing Windows+P and switching display modes.

Question 7

A company is implementing a new policy that requires users to authenticate using both a password and a one-time code sent to their mobile phone. What type of authentication factor is the one-time code?

Accepted Answer

Something you have. A one-time code sent to a mobile phone is a possession factor because it requires the user to have physical access to the registered device to receive the code. This is categorized as 'something you have,' distinct from knowledge factors like passwords and inherence factors like fingerprints.

Answer

Something you are

Answer

Something you know

Answer

Somewhere you are

Question 8

A security incident occurred where an employee's workstation was infected with ransomware. The IT manager wants to ensure that all future workstations have Controlled Folder Access enabled to protect critical data from unauthorized changes. Which Windows Security applet should be used to configure this?

Accepted Answer

Windows Security > Virus & threat protection > Manage ransomware protection. Controlled Folder Access (CFA) is a Windows Defender Exploit Guard feature that protects user folders (Documents, Pictures, Desktop, etc.) from unauthorized modification by untrusted applications, and it is configured under Windows Security > Virus & threat protection > Manage ransomware protection. This is the only applet in the Windows Security UI that exposes the ransomware-specific protections including Controlled Folder Access and OneDrive folder protection. Enabling it here allows admins to whitelist trusted apps while blocking ransomware from encrypting protected directories.

Answer

Windows Security > Firewall & network protection

Answer

Windows Security > App & browser control

Answer

Windows Security > Device security

Question 9

A customer reports that their desktop computer is running extremely slowly, and they see frequent pop-up advertisements even when no browser is open. Task Manager shows a process named 'svch0st.exe' consuming 95% CPU. Which type of malware is most likely causing these symptoms?

Accepted Answer

Adware. The combination of frequent pop-up advertisements appearing even when no browser is open, plus a suspicious process named 'svch0st.exe' (a typosquat of the legitimate svchost.exe) consuming 95% CPU, is the classic signature of adware. Adware is designed to inject and display unwanted advertisements, often through background processes that masquerade as system files. The misspelled process name is a deliberate attempt to evade detection by blending in with legitimate Windows services.

Answer

Ransomware

Answer

Rootkit

Answer

Spyware

Question 10

A customer brings in a laptop that they want to recycle, but they are concerned about personal data. The laptop has a 256GB SSD and the customer wants to keep the laptop functional for resale. Which method should the technician recommend?

Accepted Answer

Use the 'Reset this PC' option with the 'Remove everything and clean the drive' setting.. The 'Reset this PC' option with 'Remove everything and clean the drive' performs a secure erase that overwrites the drive, making data recovery difficult while keeping the laptop functional for resale. This satisfies both the customer's data security concern and the desire to resell the working laptop. Physical destruction or degaussing would render the drive unusable, and a standard format does not securely erase data.

Answer

Remove the SSD and physically destroy it, then sell the laptop without a drive.

Answer

Use a degausser on the SSD.

Answer

Perform a standard format and reinstall Windows.

Question 11

After deploying a new application to 50 workstations, several users report that the application crashes on launch. You need to quickly check if the application is running on a remote computer. Which command should you use?

Accepted Answer

tasklist /S remotePC. The `tasklist /S remotePC` command queries the running processes on a remote computer named remotePC, allowing the technician to verify whether the application is running. This is the correct built-in Windows CLI tool for remote process enumeration, and it can be combined with `/U` and `/P` for credentials if needed. It directly addresses the need to quickly check application status on a remote workstation.

Answer

regsvr32 /s C:\App\core.dll

Answer

ipconfig /flushdns

Answer

chkdsk C:

Question 12

A technician is troubleshooting a Windows 10 computer that randomly restarts without any error message. The system does not create a minidump file. Which advanced startup option should be disabled in the System Properties to help capture the error for analysis?

Accepted Answer

Automatic restart. Disabling 'Automatically restart' in System Properties > Advanced > Startup and Recovery ensures that when a bug check (BSOD) occurs, Windows stays on the blue screen instead of rebooting, giving the technician time to read the stop code and allowing the dump file to be written. This is the standard step when a machine reboots without leaving a minidump.

Answer

Fast Startup

Answer

Write an event to the system log

Answer

Small memory dump (256 KB)

Question 13

An organization wants to ensure that even if a laptop is stolen, the data on the hard drive cannot be read. The laptop runs Windows 10 Pro and is used by employees who travel frequently. Which security feature should be enabled?

Accepted Answer

Enable BitLocker Drive Encryption on the system drive.. BitLocker Drive Encryption is the correct choice because it encrypts the entire system drive at the block level, using AES encryption (typically 128-bit or 256-bit) with a TPM (Trusted Platform Module) to protect the encryption keys. This ensures that if the laptop is stolen, the hard drive cannot be removed and read from another system, as the data remains encrypted without the correct authentication (e.g., TPM + PIN or recovery key).

Answer

Set a strong BIOS/UEFI password.

Answer

Configure a screensaver password with a short timeout.

Answer

Use EFS to encrypt individual files and folders.

Question 14

A technician is troubleshooting a remote user's inability to connect to the corporate network via VPN. The user can ping the VPN server's public IP address. Which step should the technician take next to isolate the issue?

Accepted Answer

Check the VPN client logs for errors. Since the user can already ping the VPN server's public IP, basic network reachability is confirmed, so the next logical step is to examine the VPN client logs for errors such as authentication failures, certificate issues, or negotiation problems. This isolates whether the issue is at the VPN protocol/authentication layer rather than the network layer. Rebooting the modem, disabling the firewall, or reinstalling the client are premature and could disrupt the environment without diagnostic value.

Answer

Reboot the user's modem

Answer

Disable the user's firewall

Answer

Reinstall the VPN client software

Question 15

A customer reports that their computer shuts down unexpectedly after a few minutes of use. The system feels hot to the touch, and the fan is running loudly. What is the most appropriate first step for a technician to take to ensure safety while diagnosing the issue?

Accepted Answer

Unplug the computer, let it cool for 30 minutes, then inspect for dust or fan failure.. The system is overheating, so the safe first step is to remove power and allow the components to cool before opening the case. Touching or working on a hot CPU/heatsink risks burns and can damage components. Once cooled, the technician can inspect for dust buildup, fan failure, or blocked airflow — the most common causes of the described symptoms.

Answer

Immediately open the case and touch the CPU heatsink to check temperature.

Answer

Spray compressed air into the vents while the system is running to clear dust.

Answer

Replace the power supply unit immediately to fix the overheating.