220-1202 Practice Test 38 — 15 Questions

Question 1

A company is decommissioning a server that contained encrypted customer financial data. The IT manager wants to ensure the data is destroyed without damaging the hard drives, as they will be reused in test environments. Which method should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Issue a cryptographic erase command to the drive's self-encrypting feature.. The server's hard drives are self-encrypting drives (SEDs) that support the TCG Opal or IEEE 1667 standard. Issuing a cryptographic erase command (e.g., via hdparm --security-erase or a vendor tool) instantly invalidates the media encryption key, rendering all data on the drive permanently inaccessible without physically damaging the drive. This meets the requirement of destroying the encrypted customer financial data while preserving the drives for reuse in test environments.

Answer

Physically shred the drives.

Answer

Perform a standard format and reinstall the OS.

Answer

Use a degausser on the drives.

Question 2

A customer reports that their Windows 11 PC is displaying a 'Low Disk Space' warning on the C: drive. You need to quickly free up space by removing temporary files and system cache. Which administrative tool should you use?

Accepted Answer

Disk Cleanup to delete temporary files and system cache.. Disk Cleanup (cleanmgr.exe) is the built-in Windows tool specifically designed to remove temporary files, system cache, and other unnecessary data to free up disk space. It provides a simple interface to select categories like Temporary Internet Files, Recycle Bin, and Windows Update Cleanup. This directly addresses the customer's need to quickly free space by deleting temp files and cache.

Answer

Defragment and Optimize Drives to consolidate free space.

Answer

Computer Management > Disk Management to shrink the volume.

Answer

Event Viewer to clear application logs.

Question 3

A user reports that their virtual machine, which is used for testing software, suddenly lost network connectivity. The host machine is connected to the internet and can browse websites. The VM is configured with a bridged network adapter. What is the most likely cause of this issue?

Accepted Answer

The VM's DHCP lease has expired and it failed to obtain a new IP address.. In a bridged network configuration, the VM obtains its IP address directly from the same DHCP server as the host (e.g., the home router). If the DHCP lease expires and the VM fails to renew it (due to a network hiccup, DHCP server overload, or misconfigured lease time), the VM will lose its IP address and network connectivity, while the host remains unaffected because it maintains its own active lease. This is the most common cause of isolated VM connectivity loss in a bridged setup.

Answer

The host's firewall is blocking the VM's network traffic.

Answer

The virtual switch on the host has been disabled.

Answer

The VM's operating system is corrupted.

Question 4

A user reports that they can no longer access the internet after installing a new software application. The technician suspects the application modified system settings. Which security feature could have prevented this?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) is the correct answer because it is specifically designed to prevent unauthorized changes to system settings by prompting for administrator approval before allowing software to make modifications that affect system-wide configurations, such as network or security settings. When a new application attempts to modify system settings (e.g., proxy, DNS, or firewall rules) without explicit consent, UAC can block or require elevation, thus preventing the reported internet access issue. This aligns with the scenario where the technician suspects the application altered system settings, as UAC directly controls privilege escalation for such actions.

Answer

Windows Defender Firewall

Answer

BitLocker Drive Encryption

Answer

Windows Defender Antivirus

Question 5

A company is moving to a new office and needs to dispose of 200 fluorescent light tubes from the old ceiling fixtures. What is the legally required and environmentally responsible disposal method?

Accepted Answer

Contact a certified universal waste recycler to pick them up.. Fluorescent light tubes contain mercury, a hazardous substance, so they are classified as universal waste under the Resource Conservation and Recovery Act (RCRA). Option B is correct because certified universal waste recyclers are legally authorized to handle, transport, and recycle mercury-containing lamps, ensuring environmental compliance and safety.

Answer

Break them into small pieces and place them in a sealed bag in the trash.

Answer

Place them in the regular recycling bin for glass.

Answer

Burn them in an industrial incinerator.

Question 6

A company uses a cloud-based file storage service. An employee reports that when they try to upload a large video file, the upload fails after several minutes of progress. The employee's internet connection is stable and other uploads of smaller files work fine. What is the most likely cause of this issue?

Accepted Answer

The file exceeds the maximum upload size allowed by the service.. The most likely cause is that the file exceeds the maximum upload size allowed by the cloud service. Cloud storage providers enforce file size limits to manage bandwidth and storage resources, and a large video file would be rejected after the upload begins if it surpasses this threshold. The fact that smaller uploads succeed and the connection is stable points directly to a file size restriction rather than a network or account issue.

Answer

The employee's computer has insufficient RAM.

Answer

The cloud service's server is temporarily overloaded.

Answer

The employee's account has been suspended.

Question 7

A technician needs to deploy a custom configuration profile to 20 Mac computers in a small office without using a third-party MDM. The profile must enforce Wi-Fi settings and disable iCloud. Which macOS tool can create and sign this configuration profile?

Accepted Answer

Apple Configurator. Apple Configurator is the correct tool because it can create and sign custom configuration profiles (.mobileconfig files) for macOS without requiring a third-party MDM. It allows a technician to specify Wi-Fi settings and restrictions like disabling iCloud, then export the signed profile for manual deployment to the 20 Macs via USB or email.

Answer

System Settings > Profiles

Answer

Terminal with 'profiles' command

Answer

Profile Manager in macOS Server

Question 8

A security incident is reported where a user accidentally deleted a critical script in /usr/local/bin. The script was owned by root and had permissions 755. Which command will restore the script from a backup located in /backup?

Accepted Answer

rsync -a /backup/script.sh /usr/local/bin/. The `rsync -a` command uses archive mode, which preserves ownership, permissions, timestamps, and other attributes when restoring the script from /backup to /usr/local/bin. Since the script was owned by root and had permissions 755, `-a` ensures these attributes are retained, which is critical for a system script in /usr/local/bin. A plain `cp` (Option B) would not preserve ownership or permissions, and `cp -p` (Option C) only preserves attributes when the user has sufficient privilege to set them; it is not the standard tool for restoring a root-owned file. `mv` (Option A) simply moves the backup file and does not restore it while preserving the original attributes.

Answer

mv /backup/script.sh /usr/local/bin/

Answer

cp /backup/script.sh /usr/local/bin/

Answer

cp -p /backup/script.sh /usr/local/bin/

Question 9

A user calls the help desk, frantic because they received an email from what appears to be the CEO asking them to urgently purchase $500 in gift cards for a client and reply with the codes. The email address looks slightly off, and the signature is missing the usual legal disclaimer. What type of social engineering attack is this most likely an example of?

Accepted Answer

Phishing. This is a classic example of phishing, specifically a subtype known as spear phishing or whaling, because the attacker impersonates a high-level executive (the CEO) to trick the user into performing a financial action. The telltale signs are the slightly off email address (spoofed domain or lookalike character) and the missing legal disclaimer, which are common indicators of a fraudulent email designed to harvest credentials or money. Phishing relies on social engineering to bypass technical controls by exploiting human trust and urgency.

Answer

Shoulder surfing

Answer

Tailgating

Answer

Pretexting

Question 10

During a security audit, you discover that a Windows 10 workstation has a weak local administrator password. The company policy requires all local admin passwords to be at least 12 characters with complexity. Which tool can enforce this policy for all future password changes on that workstation?

Accepted Answer

Local Security Policy (secpol.msc). B is correct because the Local Security Policy (secpol.msc) includes the 'Password Policy' settings under Account Policies, where you can configure minimum password length (12 characters) and password complexity requirements. These settings are enforced by the Local Security Authority (LSA) for all future password changes on the workstation, directly aligning with the company policy.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Registry Editor (regedit)

Answer

Windows Defender Firewall with Advanced Security

Question 11

A technician is tasked with disposing of a large batch of optical discs (CD-Rs and DVD-Rs) that contain archived customer records. The company policy requires data to be unrecoverable. Which disposal method is most appropriate?

Accepted Answer

Shred the discs using an industrial cross-cut shredder.. Industrial cross-cut shredding physically destroys the optical discs (CD-Rs and DVD-Rs), rendering the data unrecoverable. Unlike magnetic media, optical discs store data as physical pits in a dye layer, so degaussing or overwriting is ineffective. Shredding ensures compliance with data destruction policies requiring unrecoverable data.

Answer

Use a degausser to demagnetize the discs.

Answer

Overwrite the discs with a disk-wiping tool.

Answer

Perform a quick format on the discs.

Question 12

A small business is upgrading its workstations and needs to dispose of 20 old hard drives that contain confidential payroll records. The company wants the lowest-cost method that ensures data cannot be recovered. Which disposal method should be recommended?

Accepted Answer

Drill holes through the platters of each drive.. Drilling holes through the platters physically destroys the magnetic surfaces, making data recovery impossible without specialized cleanroom equipment. This is the lowest-cost method that guarantees destruction because it directly damages the storage medium beyond repair, unlike degaussing which may not work on modern SSDs or high-coercivity drives.

Answer

Use a degausser on each drive.

Answer

Perform a standard format on each drive.

Answer

Reformat the drives and install a fresh OS.

Question 13

A technician is deploying laptops for a sales team that works remotely from coffee shops and client sites. The laptops contain sensitive customer data. Which physical security control is most practical for these mobile devices?

Accepted Answer

Attach a cable lock to the laptop. A cable lock is the most practical physical security control for mobile devices used in public spaces because it physically secures the laptop to a fixed object, preventing theft. Unlike software or authentication measures, a cable lock directly addresses the risk of the device being physically taken, which is the primary threat when working in coffee shops or client sites.

Answer

Install a laptop tracking software

Answer

Use a biometric fingerprint reader on the laptop

Answer

Require a smart card for login

Question 14

A helpdesk technician receives a call from an employee who says their smart card stopped working for building access. The employee is in a hurry and asks the technician to remotely disable the card and issue a temporary PIN for the day. What should the technician do first?

Accepted Answer

Ask the employee to visit the security office in person with a photo ID.. Smart card credentials for physical access are typically managed by a separate physical security system (e.g., an access control server), not the helpdesk's IT identity management system. The technician cannot remotely disable the card or issue a temporary PIN without proper authorization and verification of the caller's identity. The standard procedure is to require in-person verification with a photo ID at the security office to prevent social engineering attacks.

Answer

Disable the smart card and provide a temporary PIN as requested.

Answer

Reset the smart card remotely and test it with a badge reader.

Answer

Send a temporary PIN via email to the employee's company address.

Question 15

A user reports that their computer is infected with a virus that has encrypted all their personal files and left a text file with instructions to pay a ransom. The technician has verified the infection is ransomware. The company has a backup policy. What is the best course of action to recover the data?

Accepted Answer

Restore the files from a recent backup after removing the malware.. The company has a backup policy, meaning a recent, clean backup should exist. Restoring from backup after removing the ransomware ensures data recovery without paying criminals or relying on unreliable decryption tools. This aligns with best practices for ransomware incidents: isolate, remove, then restore from verified backups.

Answer

Pay the ransom and hope the decryption key is provided.

Answer

Use a ransomware decryption tool from a reputable source.

Answer

Reinstall the operating system and hope the files become accessible.