220-1202 Practice Test 36 — 15 Questions

Question 1

A security incident is reported: an employee's company-issued Android phone is displaying persistent pop-up ads, even when no browser is open. The employee admits to side-loading a game from an unknown website. What is the most likely cause and best immediate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The side-loaded app is adware; boot into safe mode and uninstall it.. The persistent pop-up ads, even without a browser open, indicate adware behavior typical of malicious apps. Since the employee side-loaded a game from an unknown website, the most likely cause is that the side-loaded app contains adware. Booting into safe mode (which disables third-party apps) and uninstalling the suspicious app is the best immediate action because it removes the adware without data loss, unlike a factory reset.

Answer

The phone has a virus; perform a factory reset immediately.

Answer

The browser is infected; clear the browser cache and data.

Answer

The phone's firmware is compromised; reflash the stock ROM.

Question 2

During a network upgrade, a technician needs to dispose of several old CRT monitors. Which disposal method complies with environmental regulations?

Accepted Answer

Take them to an e-waste recycling center.. CRT monitors contain hazardous materials like lead, phosphorus, and other heavy metals that require specialized handling. Taking them to an e-waste recycling center ensures compliance with environmental regulations such as the Resource Conservation and Recovery Act (RCRA) and local e-waste laws, as these facilities are equipped to safely dismantle and recycle the toxic components.

Answer

Place them in the regular dumpster for pickup.

Answer

Sell them to a scrap metal dealer.

Answer

Remove the glass and dispose of the plastic casing separately.

Question 3

An iOS user is concerned about a lost iPhone and wants to ensure that if the device is erased, it cannot be reactivated without their Apple ID and password. Which iOS security feature provides this protection?

Accepted Answer

Activation Lock, enabled by Find My iPhone.. Activation Lock is the iOS feature that binds a device to the owner's Apple ID, so after an erase the device cannot be reactivated without entering the original Apple ID credentials. It is automatically enabled when Find My iPhone is turned on, which is why the correct answer pairs the two. This directly satisfies the user's requirement that a wiped device remain unusable to a thief.

Answer

Find My iPhone location tracking.

Answer

iCloud Keychain with two-factor authentication.

Answer

Lost Mode in the Find My app.

Question 4

A user reports that their virtual desktop in a VDI environment is extremely slow during peak hours. The technician checks the host server and sees that memory utilization is at 95% and CPU is at 80%. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The host has insufficient memory for the number of VMs. The host's memory utilization at 95% indicates severe memory overcommitment, which forces the hypervisor to use excessive swapping or ballooning to reclaim memory from VMs. This directly causes extreme slowness for all virtual desktops, especially during peak hours when demand is highest. CPU at 80% is high but not as critical as memory exhaustion, which is the primary bottleneck in VDI environments.

Answer

The virtual switch is misconfigured

Answer

The guest OS needs a driver update

Answer

The virtual hard disks are not thin-provisioned

Question 5

A technician needs to create a virtual machine that will host a legacy application requiring Windows XP. The host runs Windows 11. After creating the VM and installing Windows XP, the technician notices that the mouse cursor is lagging and the screen resolution is stuck at 800x600. What should the technician do to resolve this?

Accepted Answer

Install the guest additions for the VM.. The mouse lag and limited screen resolution (800x600) indicate that the VM lacks proper integration with the host, which is resolved by installing guest additions. Guest additions provide optimized drivers for video, mouse, and other hardware, enabling smooth cursor movement and higher resolutions. This is a standard step after installing any guest OS in a hypervisor like Hyper-V or VirtualBox.

Answer

Increase the amount of RAM allocated to the VM.

Answer

Update the host operating system to the latest version.

Answer

Change the VM's network adapter from NAT to bridged.

Question 6

A receptionist holds the door for a person carrying a large box, assuming they work in the building. Later, that person is seen plugging a USB drive into a workstation in the finance department. Which social engineering technique was most likely used to gain initial access?

Accepted Answer

Tailgating. Tailgating involves an unauthorized person gaining physical access to a secure area by following an authorized individual. In this scenario, the receptionist held the door for the person carrying a large box, assuming they worked in the building, which allowed the attacker to bypass physical security controls without authentication.

Answer

Phishing

Answer

Pretexting

Answer

Baiting

Question 7

A small business wants to ensure that all employees use strong passwords that include uppercase, lowercase, numbers, and special characters, and that passwords expire every 60 days. Which tool should be used to enforce these settings on a standalone Windows 10 workstation?

Accepted Answer

Local Security Policy (secpol.msc). The Local Security Policy (secpol.msc) is the correct tool because it provides a centralized interface to configure password policies, such as minimum password length, complexity requirements (uppercase, lowercase, numbers, special characters), and maximum password age (e.g., 60 days). These settings are enforced locally on a standalone Windows 10 workstation through the Security Settings node under Account Policies.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Windows Defender Firewall with Advanced Security

Answer

Device Manager

Question 8

A company policy requires that all sensitive data stored on laptops must be unreadable if the device is lost or stolen. A technician is tasked with implementing a solution that works transparently for users. Which approach should they take?

Accepted Answer

Enable BitLocker drive encryption on each laptop.. BitLocker drive encryption provides full-disk encryption that operates transparently to the user, automatically encrypting all data on the system drive. If the laptop is lost or stolen, the data remains unreadable without the decryption key, satisfying the policy requirement without requiring user intervention.

Answer

Set a BIOS password on each laptop.

Answer

Implement a folder-level password policy using EFS.

Answer

Configure a screensaver password with a 1-minute timeout.

Question 9

A technician is setting up a new wireless network for a small office. They want to ensure that only company-issued devices can connect, and that data transmitted over the air is encrypted. Which combination of settings should they use?

Accepted Answer

WPA3 with AES encryption and MAC address filtering.. WPA3 with AES encryption provides the strongest wireless security standard, ensuring robust data confidentiality and integrity. MAC address filtering adds an additional layer of access control, allowing only company-issued devices (with pre-approved MAC addresses) to connect, which aligns with the requirement to restrict access to authorized devices.

Answer

WPA2 with TKIP encryption and SSID broadcast disabled.

Answer

WEP with 128-bit key and a strong password.

Answer

Open network with a captive portal requiring employee login.

Question 10

A security incident occurred where an unauthorized user gained access to a workstation. The security team needs to review detailed logs of all user logon attempts, including successful and failed logins, for the past 48 hours. Which administrative tool and specific log should you access to provide this information?

Accepted Answer

Event Viewer > Windows Logs > Security. Windows records all authentication events — successful and failed logons, logoffs, and account changes — in the Security log, accessible via Event Viewer under Windows Logs > Security. Key event IDs include 4624 (successful logon), 4625 (failed logon), 4634 (logoff), and 4648 (logon using explicit credentials). Reviewing this log for the past 48 hours gives the analyst the complete authentication timeline needed for the incident investigation.

Answer

Event Viewer > Windows Logs > System

Answer

Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager

Answer

Computer Management > System Tools > Shared Folders > Sessions

Question 11

A user reports that their Windows 11 laptop can see the office Wi-Fi network but fails to connect, displaying 'Can't connect to this network'. Other users with the same laptop model connect without issues. The network uses WPA2-PSK with AES. What should you check first?

Accepted Answer

Forget the network on the laptop and reconnect by entering the passphrase again.. When a Windows 11 laptop can see the SSID but fails with 'Can't connect to this network' while identical hardware works fine, the most likely cause is a corrupted saved profile or a stale/wrong passphrase cached on that specific machine. Forgetting the network and re-entering the passphrase clears the stored credentials and forces a fresh WPA2-PSK 4-way handshake, which resolves the majority of these single-device failures.

Answer

Update the wireless adapter driver.

Answer

Change the router's security protocol to WPA3.

Answer

Disable the firewall on the laptop.

Question 12

A technician is tasked with deploying a virtual machine for a new employee. The VM will run a Linux distribution and needs to be isolated from the corporate network but still have internet access for updates. Which network configuration should the technician choose for the VM?

Accepted Answer

NAT (Network Address Translation). NAT (Network Address Translation) allows the VM to access the internet through the host's IP address while keeping the VM on a private subnet, effectively isolating it from the corporate network. The host acts as a router, translating the VM's private IP to the host's external IP for outbound traffic, which meets the requirement of internet access for updates without direct corporate network connectivity.

Answer

Bridged networking

Answer

Host-only networking

Answer

Internal networking

Question 13

A technician is configuring a new server and follows a documented standard operating procedure (SOP). After completion, the technician realizes the SOP is outdated and omits a critical security setting. What should the technician do?

Accepted Answer

Apply the missing setting and update the SOP to include it.. The technician discovered a security gap in the SOP that could leave the server vulnerable. The proper action is to immediately apply the missing critical security setting to protect the server, then update the SOP to reflect the correct procedure. This aligns with change management best practices where security findings take precedence over outdated documentation, and the SOP must be corrected to prevent future misconfigurations.

Answer

Ignore the missing setting since the SOP was followed.

Answer

Submit a change request to update the SOP without applying the setting.

Answer

Revert the server configuration and wait for an updated SOP.

Question 14

A user reports that their Windows 10 computer is displaying a message that 'Windows Defender Antivirus is turned off' even though they have not disabled it. They have also noticed that they cannot open the Windows Security app. What is the most likely cause?

Accepted Answer

The computer is infected with malware. When a user sees 'Windows Defender Antivirus is turned off' and cannot open the Windows Security app, the most likely cause is malware that has disabled the antivirus and blocked access to security settings to prevent removal. Malware often modifies registry keys or terminates Windows Defender services (e.g., WinDefend) to evade detection, and it may also corrupt or block the Windows Security Center UI (SecurityHealthService.exe). This is a common symptom of ransomware or trojans that specifically target Windows Defender.

Answer

Windows Defender is disabled via Group Policy

Answer

Windows needs a critical update

Answer

User Account Control is blocking the app

Question 15

A user reports that their Windows 10 PC shows a 'Low Disk Space' warning on the C: drive. You need to free up space by removing temporary files, system cache, and previous Windows installations. Which tool provides a guided cleanup for these items?

Accepted Answer

Disk Cleanup. Disk Cleanup (cleanmgr.exe) is the built-in Windows tool specifically designed to free disk space by removing temporary files, system cache, and previous Windows installations. It provides a guided, checkbox-driven interface that lets users select categories such as 'Temporary Internet Files', 'Delivery Optimization Files', and 'Windows Update Cleanup' (which includes previous Windows installations). This makes it the correct choice for the described scenario.

Answer

Disk Management

Answer

Defragment and Optimize Drives

Answer

Storage Spaces