220-1202 Practice Test 34 — 15 Questions

Question 1

A user reports that their Windows 10 desktop is running very slowly, especially when opening multiple applications. They have 8 GB of RAM and a traditional hard drive. Task Manager shows that memory usage is consistently at 90% or higher. Which component is most likely the bottleneck and what is the best upgrade?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The RAM is the bottleneck; add more RAM.. Task Manager showing memory usage consistently at 90% or higher with 8 GB of RAM indicates the system is memory-constrained, causing excessive paging to the traditional hard drive and slowing application launches. Adding more RAM directly addresses the bottleneck by reducing paging and allowing multiple applications to reside in memory simultaneously.

Answer

The CPU is the bottleneck; upgrade to a faster processor.

Answer

The hard drive is the bottleneck; upgrade to an SSD.

Answer

The graphics card is the bottleneck; upgrade to a dedicated GPU.

Question 2

A technician is tasked with migrating a physical server running a legacy OS that does not support virtualization drivers. The technician needs to ensure the OS can boot and run in a virtual machine. Which of the following steps is most critical before performing the physical-to-virtual (P2V) conversion?

Accepted Answer

Use a P2V tool that can inject the correct HAL and storage drivers for the hypervisor. Legacy operating systems that predate virtualization support lack the HAL (Hardware Abstraction Layer) and mass-storage drivers needed to boot on a hypervisor's virtual hardware. A P2V tool with driver-injection capability (such as VMware vCenter Converter or Microsoft Disk2vhd paired with offline driver injection) rewrites the HAL and installs the correct virtual SCSI/IDE/NIC drivers so the OS can start inside the VM. Without this step the converted image typically blue-screens with a STOP 0x0000007B INACCESSIBLE_BOOT_DEVICE error.

Answer

Increase the physical server's RAM before conversion

Answer

Ensure the legacy OS has the latest service pack installed

Answer

Create a full backup of the physical server

Question 3

A small business has a shared Windows 10 workstation that multiple employees use. They want to ensure that each user's desktop settings, files, and application data are completely isolated and that users cannot access each other's data. Which feature should you configure to achieve this?

Accepted Answer

Create standard local user accounts and set NTFS permissions on each user's profile folder.. Creating standard local user accounts and setting NTFS permissions on each user's profile folder ensures that each user has a separate profile and that file system ACLs prevent users from accessing each other's data. Windows automatically creates a separate user profile directory under C:\Users for each account, and NTFS permissions by default restrict access to the owner and administrators.

Answer

Enable the built-in Guest account for all users.

Answer

Join the computer to a domain and use roaming profiles.

Answer

Enable BitLocker on the system drive.

Question 4

A company’s change management policy requires all changes to be approved by the Change Advisory Board (CAB) before implementation. A technician applies an emergency security patch to a critical server without CAB approval because the vulnerability is being actively exploited. What should the technician do after applying the patch?

Accepted Answer

Document the change and submit an emergency change request for retroactive approval.. In change management, emergency changes are allowed when there is an urgent security or operational need, but they must be documented and submitted for retroactive approval by the CAB. The technician should document the change and submit an emergency change request so the change is recorded and reviewed after the fact. This maintains accountability while addressing the active exploit.

Answer

Wait for the next CAB meeting to report the change.

Answer

Revert the patch and wait for CAB approval.

Answer

Delete the change log entry to avoid accountability.

Question 5

A user reports that after a recent Windows update, their computer now boots to a blue screen with the error 'INACCESSIBLE_BOOT_DEVICE'. They need to get back to work quickly. Which Windows recovery tool should you use first to attempt a repair?

Accepted Answer

Startup Repair. Startup Repair is the correct first tool because INACCESSIBLE_BOOT_DEVICE is a boot-level failure typically caused by a missing or misconfigured boot device driver, corrupted BCD, or changed storage controller mode after an update. Startup Repair automatically scans for and fixes these boot configuration and driver issues without user intervention, making it the fastest first attempt.

Answer

System Restore

Answer

Reset this PC

Answer

Command Prompt (chkdsk /f)

Question 6

A technician is configuring a kiosk computer that will be used by the public to access a specific website. The technician wants to prevent users from navigating to other sites or changing browser settings. Which browser feature should be enabled?

Accepted Answer

Enable kiosk mode.. Kiosk mode is specifically designed to lock a browser or application into a single-purpose session, restricting navigation to only the allowed website and preventing users from changing browser settings, accessing the address bar, or opening new tabs. In Microsoft Edge, kiosk mode can be configured via assigned access or the --kiosk command-line flag, and it enforces a locked-down experience ideal for public terminals. This directly meets the requirement of preventing users from navigating elsewhere or altering configuration.

Answer

Enable private browsing mode.

Answer

Enable parental controls.

Answer

Disable the address bar via group policy.

Question 7

A user reports that their system is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice that their default search engine has changed without their permission. Which type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware is software that automatically displays or downloads advertising material, typically in the form of pop-ups, redirects, and browser modifications. The combination of persistent pop-ups outside a browser session plus an unauthorized change to the default search engine is the classic adware signature, often bundled with freeware or browser hijackers.

Answer

Virus

Answer

Ransomware

Answer

Rootkit

Question 8

A user reports that their Windows 11 computer is infected with ransomware. Files are encrypted and a ransom note is displayed. The user has a backup from two days ago stored on an external drive that was disconnected after the backup. What is the best course of action to recover the data?

Accepted Answer

Disconnect the computer from the network and restore files from the external backup.. The correct action is to isolate the machine from the network to prevent further spread or command-and-control communication, then restore the encrypted files from the offline external backup, which was disconnected after the last good backup and is therefore unaffected by the ransomware. Restoring from a clean, disconnected backup is the only reliable recovery method that does not reward attackers or risk re-infection.

Answer

Pay the ransom to get the decryption key.

Answer

Run a full antivirus scan to remove the ransomware and then restore files.

Answer

Use System Restore to revert the system to a previous state.

Question 9

A user reports receiving a phone call from someone claiming to be from 'Microsoft Support' saying their computer has a virus and asking for remote access to fix it. The user did not grant access. What type of attack was attempted?

Accepted Answer

Vishing. Vishing is voice phishing — a social engineering attack conducted over the phone where the attacker impersonates a trusted entity (here, 'Microsoft Support') to manipulate the victim into granting remote access or revealing information. The scenario describes a phone call, which is the defining characteristic of vishing. Because the user did not grant access, the attempt was unsuccessful, but the attack type is still vishing.

Answer

Phishing

Answer

Smishing

Answer

Pretexting

Question 10

During a software deployment, a technician needs to ensure that a company-issued Android device automatically connects to the corporate Wi-Fi network and disables the camera for security. Which mobile OS tool should be used to enforce these policies?

Accepted Answer

Deploy a Mobile Device Management (MDM) profile. A Mobile Device Management (MDM) profile is the correct tool because MDM solutions (e.g., Intune, Workspace ONE) push configuration policies to enrolled devices, including Wi-Fi profiles that auto-connect to corporate networks and restriction policies that disable the camera. This enforces the requirements centrally and persistently across the fleet. The other options are manual, user-level, or non-persistent workarounds.

Answer

Use the Android Debug Bridge (ADB) to manually set Wi-Fi and camera permissions

Answer

Configure the device's built-in Guest Mode

Answer

Install a third-party camera-blocking app from the Play Store

Question 11

A small business is deploying a new time-tracking application to five workstations. The technician needs to ensure the installation is standardized and repeatable. Which documentation should the technician create before starting the deployment?

Accepted Answer

A step-by-step installation guide with screenshots.. A step-by-step installation guide with screenshots is the correct documentation because it makes the deployment standardized and repeatable across all five workstations. It captures exact settings, order of operations, and expected screens so any technician can reproduce the install identically. This directly satisfies the requirement for consistency and reduces configuration drift.

Answer

A list of user passwords for the application.

Answer

A detailed network topology diagram.

Answer

A copy of the software license agreement.

Question 12

During a software deployment, a technician must dispose of 50 unused software license CDs. The CDs are still sealed. What is the most environmentally friendly way to handle them?

Accepted Answer

Donate them to a local school or non-profit that can use them.. Donating still-sealed, unused software license CDs to a school or non-profit is the most environmentally friendly option because it extends the product's useful life and avoids generating waste entirely. Reuse sits at the top of the EPA's waste hierarchy — above recycling and far above disposal or incineration. Since the media is sealed and licensed, it retains full value for a recipient organization.

Answer

Throw them in the general office trash bin.

Answer

Shred them and put the pieces in the recycling bin.

Answer

Burn them in an incinerator to generate energy.

Question 13

A user calls the help desk saying that every time they click a link in an email, their browser opens a page that says 'Your computer is infected! Call this number.' They are unable to close the page normally. What type of attack is this, and what is the first step you should take?

Accepted Answer

Tech support scam; force close the browser using Task Manager, then run a security scan. The symptoms — a browser page claiming the computer is infected and demanding a phone call, plus inability to close the page normally — are classic indicators of a tech support scam, often delivered via malvertising or malicious ads. The immediate first step is to force-close the browser (e.g., via Task Manager) to stop the script, then run a security scan to check for any payload or persistence. Changing passwords or disconnecting the network may be appropriate later, but the question asks for the first step.

Answer

Phishing attack; immediately change the user's email password

Answer

Browser hijacker; run a full antivirus scan immediately

Answer

Drive-by download; disconnect the computer from the network

Question 14

A technician is tasked with removing malware from a Windows 10 computer that has a Trojan horse that downloaded additional payloads. The technician has already run a full antivirus scan and removed the Trojan, but the computer still exhibits suspicious network activity. What should the technician do next?

Accepted Answer

Run a second opinion malware scanner such as Malwarebytes.. Even after removing the Trojan with a full antivirus scan, the computer may still have residual malware components (e.g., backdoors, keyloggers, or downloaders) that the primary scanner missed. Running a second opinion scanner like Malwarebytes uses a different detection engine and signature database, increasing the chance of identifying and removing these hidden threats. This step is critical because the suspicious network activity indicates an active infection that the first scan failed to fully eradicate.

Answer

Reimage the computer immediately.

Answer

Reset the web browser settings to default.

Answer

Disable all startup programs in Task Manager.

Question 15

A customer calls the help desk stating that their computer displays 'Bootmgr is missing' and will not start Windows. You suspect the Boot Configuration Data (BCD) is corrupted. Which command-line tool should you use from the Windows Recovery Environment to repair the BCD?

Accepted Answer

bootrec /rebuildbcd. 'Bootmgr is missing' indicates the Windows Boot Manager cannot locate the Boot Configuration Data (BCD) store, and 'bootrec /rebuildbcd' is the dedicated Windows RE command that scans for Windows installations and rebuilds the BCD from scratch. Running it from the Recovery Environment's command prompt restores the boot entries needed to start Windows. This is the standard CompTIA-prescribed fix for BCD corruption.

Answer

chkdsk /r

Answer

sfc /scannow

Answer

diskpart