220-1202 Practice Test 35 — 15 Questions

Question 1

A technician needs to map a network drive to a shared folder on a file server for a user who frequently works remotely. The share path is \\Server\Data. Which command would you use to persistently map this drive as drive letter Z:?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

net use Z: \Server\Data /persistent:yes. The `net use` command is used to map a network share to a drive letter, and the `/persistent:yes` switch ensures the mapping is reconnected automatically after a reboot or network interruption, which is essential for a user who works remotely. The syntax `net use Z: \Server\Data /persistent:yes` correctly specifies the drive letter, UNC path, and persistence flag.

Answer

net user Z: \Server\Data /add

Answer

chkdsk Z: /f

Answer

ipconfig /renew

Question 2

A user reports that their virtual machine running on a Type 2 hypervisor is extremely slow. The host machine has 16 GB of RAM, and the VM is configured with 8 GB. The host's task manager shows 90% memory usage. What should the technician do to improve the VM's performance?

Accepted Answer

Reduce the amount of RAM allocated to the VM to 4 GB.. The host is experiencing 90% memory pressure, meaning the host OS is starved of RAM. A Type 2 hypervisor (like VMware Workstation or VirtualBox) relies on the host OS to manage memory; if the host is paging heavily, the VM will also suffer. Reducing the VM’s allocated RAM from 8 GB to 4 GB frees memory for the host, reducing swapping and improving overall VM performance.

Answer

Increase the number of virtual CPUs assigned to the VM.

Answer

Change the virtual disk from thin to thick provisioning.

Answer

Enable hyper-threading on the host CPU.

Question 3

A user reports that their computer is running slowly and they suspect a virus. After scanning, the technician finds malware that has encrypted several files. The technician decides to wipe the drive and reinstall the OS. What should be done to ensure the malware is completely removed before data destruction?

Accepted Answer

Use a secure erase utility that overwrites the entire drive including the boot sector.. When malware has encrypted files and the decision is to wipe and reinstall, a secure erase utility that overwrites the entire drive — including the boot sector — ensures no remnants of the malware survive. The boot sector is a common hiding place for bootkits and ransomware persistence mechanisms, so it must be included in the wipe. This is the only option that guarantees complete removal before OS reinstallation.

Answer

Run a quick format and then reinstall the OS.

Answer

Delete the encrypted files and run a registry cleaner.

Answer

Use System Restore to revert to a previous state.

Question 4

A technician is helping a customer configure a new laptop. The customer mentions they received a pop-up on their old computer warning of a virus and a phone number to call for support. The customer called the number and gave remote access to a 'technician' who then installed several programs. What social engineering attack occurred?

Accepted Answer

Tech support scam. A tech support scam occurs when attackers impersonate technical support (often via pop-ups with fake virus warnings and phone numbers) to convince victims to call, then persuade them to grant remote access and install malicious software or pay for fake services. The scenario — pop-up warning, phone number, remote access, and installed programs — matches this attack pattern exactly. It is a form of social engineering that exploits fear and urgency.

Answer

Shoulder surfing

Answer

Phishing

Answer

Dumpster diving

Question 5

A small business owner calls for support because all of their files on the server have been renamed with a .encrypted extension, and a text file named 'README_TO_DECRYPT.txt' appears on the desktop demanding a Bitcoin payment. What is the first step the technician should take?

Accepted Answer

Disconnect the server from the network.. Ransomware encrypts files and often maintains a command-and-control channel to spread laterally across the network. Disconnecting the server from the network immediately isolates it, preventing further encryption of shared drives and blocking communication with the attacker's infrastructure. This containment step must precede any scanning, restoration, or negotiation.

Answer

Pay the ransom to get the decryption key immediately.

Answer

Run a full antivirus scan on the server.

Answer

Restore files from a recent backup immediately.

Question 6

A user reports that their Windows 10 laptop shows a 'Your license will expire soon' watermark on the desktop. They recently replaced the motherboard. Which Control Panel applet should you use to re-activate Windows?

Accepted Answer

System. The System applet (also known as 'System Properties' or 'About' in Settings) is the correct Control Panel location to view and manage Windows activation status. After replacing the motherboard, Windows 10 detects a significant hardware change and may require re-activation. The System applet provides a 'Change product key' or 'Activate Windows' link to enter a new or existing license key, or to use the activation troubleshooter to re-activate with a digital license tied to a Microsoft account.

Answer

Device Manager

Answer

User Accounts

Answer

Network and Sharing Center

Question 7

A company is implementing a new policy to prevent tailgating at the main entrance. Which physical security control should they deploy?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of a small space with two sets of interlocking doors, designed to allow only one person through at a time and prevent tailgating. It is the specific control deployed to stop unauthorized individuals from following an authorized person through an entrance. Cameras, biometric readers, and badge readers do not by themselves prevent tailgating.

Answer

Security cameras

Answer

Biometric reader

Answer

Badge reader

Question 8

During a security audit, a technician discovers that an employee used a hammer to destroy several old hard drives. The drives are now in pieces, but the organization's policy mandates 'secure data destruction' for compliance. Which additional step should the technician take?

Accepted Answer

Visually inspect the platters for scratches and breaks, then shred any intact platters.. Physical destruction via hammering may leave intact platters or fragments that still hold readable data, so the technician must verify the platters are actually damaged and shred any that remain intact. This ensures the destruction is truly secure and compliant with the 'secure data destruction' policy. Documentation alone does not guarantee data is unrecoverable.

Answer

Document the destruction and consider it complete.

Answer

Use a degausser on the remaining pieces.

Answer

Run a data recovery tool on the pieces to see if data remains.

Question 9

A user calls the help desk frustrated because their laptop will not connect to the company Wi-Fi. They say they have tried restarting the laptop but it still does not work. The technician suspects the wireless adapter driver may be corrupt. What is the best first step for the technician to take?

Accepted Answer

Ask the user if they see any error messages or if other devices connect to the Wi-Fi.. The best first step is to ask the user if they see any error messages or if other devices can connect to the Wi-Fi, because this gathers critical diagnostic information before taking any action. It helps determine whether the issue is isolated to the laptop or affects the entire network, and whether there are specific error codes that point to driver, authentication, or hardware problems. This aligns with the troubleshooting methodology of identifying the problem and establishing a theory before implementing a solution.

Answer

Remotely reinstall the wireless adapter driver.

Answer

Tell the user to bring the laptop to the IT office for a physical inspection.

Answer

Escalate the ticket to the network team immediately.

Question 10

A user on a Windows 10 Pro workstation complains that they cannot change their desktop background or theme, and several personalization settings are grayed out. The computer is not joined to a domain. Which Group Policy or local policy setting is most likely causing this restriction?

Accepted Answer

The 'Prevent changing desktop background' policy.. The 'Prevent changing desktop background' policy is the correct answer because it specifically blocks users from modifying the desktop wallpaper, which matches the symptom of grayed-out personalization settings. This policy is found under User Configuration > Administrative Templates > Control Panel > Personalization and directly disables the Desktop Background option in Settings. When enabled, the user cannot change the background image, solid color, or slideshow, even on a non-domain-joined machine via local Group Policy.

Answer

The 'Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands' policy.

Answer

The 'Prohibit access to Control Panel and PC settings' policy.

Answer

The 'Turn off all Windows Spotlight features' policy.

Question 11

A technician discovers that a user has been sharing their login credentials with coworkers to allow them to access a shared drive. The company's security policy prohibits password sharing. What is the most effective way to prevent this behavior while still allowing necessary access?

Accepted Answer

Configure the shared drive permissions using security groups and add the coworkers to the appropriate group.. Configuring the shared drive permissions using security groups and adding the coworkers to the appropriate group is the most effective solution because it grants necessary access through proper authorization rather than credential sharing. This follows the principle of least privilege and eliminates the need for users to share passwords. It also provides an auditable, manageable access control mechanism.

Answer

Disable the user's account and create a generic shared account for the drive.

Answer

Implement a Group Policy that forces password changes every 30 days.

Answer

Send a company-wide email reminding users not to share passwords.

Question 12

A technician is troubleshooting a network issue and needs to access the user's computer remotely. The user is in a different city and speaks with a heavy accent, making communication difficult. The technician has trouble understanding the user's description of the error. What is the best approach?

Accepted Answer

Ask the user to type the error message in a chat window to avoid miscommunication.. When verbal communication is unreliable due to accent or language barriers, switching to a text-based channel such as chat lets the user type the exact error message, eliminating mishearing and providing a precise, copyable record of the issue. This is the most professional and effective approach.

Answer

Speak slowly and loudly, repeating each question until the user understands.

Answer

Ask the user to transfer the call to a colleague who speaks English more clearly.

Answer

Proceed with remote access without further communication, assuming you can diagnose the issue visually.

Question 13

A user receives an email with a link that appears to be from their bank, asking them to verify their account. The link leads to a page that looks exactly like the bank's login page. What type of attack is this?

Accepted Answer

A phishing attack.. This scenario describes a phishing attack, where the attacker sends a deceptive email impersonating a trusted entity (the bank) to trick the user into clicking a malicious link. The link leads to a fraudulent website that mimics the legitimate bank login page, designed to capture the user's credentials. Phishing exploits social engineering rather than technical vulnerabilities, relying on the user's trust and inattention to detail.

Answer

A man-in-the-middle attack.

Answer

A ransomware attack.

Answer

A cross-site scripting (XSS) attack.

Question 14

A technician is tasked with decommissioning a server that contains a RAID array of hard drives. The drives are still functional, but the data must be securely erased. What is the most secure method to ensure data cannot be recovered?

Accepted Answer

Physically destroy the drives with a hammer.. Physically destroying the drives (e.g., shredding or hammering the platters) is the most secure method to ensure data cannot be recovered because it makes the magnetic media physically unreadable. Degaussing can randomize magnetic domains but is not guaranteed to work on all modern drives (especially high-coercivity or helium-filled drives) and does not work on SSDs. A quick format only removes logical references to data, and a zero-fill overwrite can leave residual data recoverable. For decommissioning functional drives where the goal is absolute unrecoverability, physical destruction is the strongest option.

Answer

Perform a quick format of each drive.

Answer

Overwrite the drives with zeros using a low-level format.

Answer

Use a degausser to erase the magnetic data on the drives.

Question 15

A user complains that their Mac running macOS Big Sur suddenly shows a message 'Your system has run out of application memory' and applications crash frequently. Activity Monitor shows high memory pressure. What is the most effective built-in tool to diagnose the cause?

Accepted Answer

Activity Monitor. Activity Monitor is the correct tool because it provides real-time metrics on memory pressure, including the 'Memory Pressure' graph, which indicates whether the system is efficiently using memory or thrashing. High memory pressure, combined with the 'Your system has run out of application memory' alert, points to excessive memory usage or a memory leak, which Activity Monitor can pinpoint by sorting processes by memory consumption.

Answer

Console

Answer

Disk Utility

Answer

System Information