220-1202 Practice Test 40 — 15 Questions

Question 1

During a routine check, a technician finds that a user's Windows 10 computer has an outdated antivirus that hasn't updated in 3 months. The user claims they never saw any update prompts. What is the most likely reason and the appropriate remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The antivirus subscription has expired; renew it. The most likely reason the antivirus hasn't updated in 3 months, with no prompts seen by the user, is that its subscription/license has expired. When a subscription lapses, the product typically stops receiving definition updates and may suppress or stop showing update prompts. The appropriate remediation is to renew the subscription or replace the antivirus with a supported solution. Note: Windows Defender does rely on Windows Update for definitions, but the scenario describes a separate antivirus product, which updates through its own update mechanism, not the Windows Update service (wuauserv).

Answer

The Windows Update service is disabled; re-enable it and set to automatic

Answer

The user has manually set the antivirus to manual update mode

Answer

The computer is infected with a virus that blocks updates

Question 2

A user reports that their MacBook Pro running macOS Ventura suddenly lost all desktop icons and the menu bar is missing. They can still move the cursor and click on open applications. Which macOS feature or tool should you use to restore the desktop and menu bar?

Accepted Answer

Use Force Quit (Cmd+Option+Esc) and select Finder, then click Relaunch.. The Finder process manages the desktop icons and the menu bar in macOS. When the Finder becomes unresponsive or crashes, relaunching it via Force Quet (Cmd+Option+Esc) restores the desktop environment and menu bar without requiring a full system restart. This is the standard troubleshooting step for a hung Finder that still allows cursor movement and interaction with open applications.

Answer

Restart the MacBook by holding the power button.

Answer

Open Activity Monitor and force quit the WindowServer process.

Answer

Run the command 'sudo killall Dock' in Terminal.

Question 3

A small business owner wants to deploy a custom inventory app to five company-owned iPads. The app is not available on the App Store. Which method should you use to install it?

Accepted Answer

Use Apple Configurator to install the app directly.. Apple Configurator allows IT administrators to install enterprise or custom in-house apps directly onto supervised iOS devices without requiring the App Store. Since the app is not available on the App Store and the iPads are company-owned, Apple Configurator provides a supported, secure method for direct installation using a Mac.

Answer

Download the app from a third-party website and open it in Safari.

Answer

Email the app file to each user and have them install it.

Answer

Enable sideloading in Settings and install via iTunes.

Question 4

A security incident response team needs to identify all files on a system that have the SUID bit set, as these may pose a security risk. Which command should they use?

Accepted Answer

find / -type f -perm -4000. The `-perm -4000` syntax in the `find` command matches files that have the SUID bit set (the 4000 octal permission), regardless of other permission bits. The leading dash (`-`) means 'at least these bits must be set,' so it correctly identifies all files where the SUID bit is enabled. Note that GNU find's `-perm /4000` also matches files with the SUID bit set, since the slash means 'any of these bits must be set' and only one bit is specified; however, `-perm -4000` is the traditional and most widely recognized form for this task.

Answer

find / -type f -perm 0777

Answer

find / -type f -perm 4000

Question 5

A graphic designer is running out of storage space on their MacBook Air. They have a large collection of old design files that they rarely access but want to keep available on demand without manual intervention. Which macOS feature should you enable to automatically free up space?

Accepted Answer

Turn on iCloud Drive and select 'Optimize Mac Storage'. ICloud Drive with 'Optimize Mac Storage' automatically moves rarely accessed files from the local drive to iCloud, keeping them available on demand while freeing up local space. This feature is designed exactly for the scenario of maintaining access to large, infrequently used files without manual intervention, leveraging cloud storage to offload data seamlessly.

Answer

Enable Time Machine to an external drive

Answer

Use Disk Utility to erase and repartition the drive

Answer

Configure a local Time Machine snapshot schedule

Question 6

A technician is investigating a privilege escalation vulnerability. They need to list all files in /usr/bin that have the SUID or SGID bit set and are owned by root. Which single command will achieve this?

Accepted Answer

find /usr/bin -user root -perm /6000. The `find` command with `-perm /6000` matches files where either the SUID (4000) or SGID (2000) bit is set, combined with `-user root` to restrict results to files owned by root. The `/` prefix in the permission mask tells `find` to match any of the specified bits, making it the precise single command for this task.

Answer

find /usr/bin -user root -perm -6000

Answer

find /usr/bin -user root -perm 4000 -o -perm 2000

Answer

ls -la /usr/bin | grep '^...s'

Question 7

A user's MacBook Air running macOS Ventura is experiencing intermittent kernel panics. The crashes seem to occur when the laptop is connected to a specific USB-C hub. Which macOS tool should you use to analyze the crash logs and identify the faulty driver?

Accepted Answer

Console. The Console app is the correct tool because it provides a centralized interface for viewing all system logs, including kernel panic reports (stored in /Library/Logs/DiagnosticReports). When a kernel panic occurs, macOS generates a .panic file containing stack traces and loaded kext (kernel extension) information. By examining these logs in Console, you can identify the specific kext or driver (e.g., a USB hub driver) that triggered the panic, especially when the crash is hardware-dependent like this USB-C hub scenario.

Answer

System Information

Answer

Activity Monitor

Answer

Terminal with 'sudo dmesg' command

Question 8

A user reports that their Mac running macOS Ventura frequently asks for the admin password when trying to change network settings, even though they are the only user. They want this to stop. What is the most secure way to address this?

Accepted Answer

Change the user account type from Standard to Administrator in Users & Groups. Changing the user account type from Standard to Administrator in System Settings > Users & Groups grants the user the necessary privileges to modify network settings without repeated authentication prompts. On macOS Ventura, only administrator accounts can unlock network preferences by default; a standard user is prompted for admin credentials each time. This is the most secure approach because it avoids disabling security features like SIP or FileVault.

Answer

Disable System Integrity Protection (SIP)

Answer

Use the 'security authorizationdb' command to remove the requirement

Answer

Turn off FileVault

Question 9

A user complains that their MacBook Air running macOS Monterey frequently runs out of memory and slows down when they have multiple browser tabs and apps open. They want to see which processes are consuming the most memory without installing third-party software. Which macOS tool should you instruct them to use?

Accepted Answer

Activity Monitor from the Utilities folder.. Activity Monitor (option D) is the built-in macOS utility that provides real-time monitoring of CPU, memory, energy, disk, and network usage. It allows users to view memory pressure, list processes sorted by memory consumption, and identify resource hogs without any third-party software. This directly addresses the user's need to see which processes are consuming the most memory.

Answer

Force Quit Applications window (Cmd+Option+Esc).

Answer

System Preferences > Memory.

Answer

Terminal with the 'top' command.

Question 10

A server administrator needs to grant a junior technician the ability to reset user passwords on a Windows Server 2019 domain controller, but without giving them full administrative rights. Which administrative tool should be used to delegate this specific permission?

Accepted Answer

Active Directory Users and Computers and use the Delegation of Control Wizard.. The Delegation of Control Wizard in Active Directory Users and Computers is the correct tool because it allows an administrator to grant specific permissions, such as resetting user passwords, to a non-administrative user without granting full administrative rights. This wizard modifies the ACL on the selected organizational unit (OU) or container, enabling granular control over tasks like password resets while preserving security boundaries.

Answer

Local Security Policy to assign the 'Reset passwords' user right.

Answer

Group Policy Management Console to create a policy that allows password resets.

Answer

Computer Management to add the technician to the 'Account Operators' group.

Question 11

A technician is troubleshooting a Mac that fails to boot and displays a prohibitory symbol (a circle with a slash). The user had recently installed a new third-party SSD. What is the most likely cause?

Accepted Answer

The SSD is not properly connected or is incompatible with the Mac’s storage controller. The prohibitory symbol indicates that the Mac cannot locate a valid operating system on the startup disk. Since the user recently installed a third-party SSD, the most likely cause is that the drive is either not properly connected (e.g., loose SATA or NVMe cable) or is incompatible with the Mac's storage controller (e.g., using a PCIe 4.0 SSD in a Mac that only supports PCIe 3.0, or a non-Apple NVMe drive lacking the required firmware for macOS). This prevents the Mac from reading the boot loader or system files.

Answer

The SSD is formatted as NTFS

Answer

The user’s home folder is corrupted

Answer

The Mac’s NVRAM needs resetting

Question 12

A helpdesk technician is assisting a user who is unable to find a file named 'notes.txt' they saved earlier. The user is in their home directory. Which command will search the entire filesystem for this file?

Accepted Answer

find / -name notes.txt. The `find / -name notes.txt` command starts at the root directory (`/`) and recursively searches the entire filesystem for a file named exactly 'notes.txt'. The `-name` option performs a case-sensitive match on the filename, and the starting point `/` ensures all mounted filesystems are included.

Answer

locate notes.txt

Answer

grep notes.txt /

Answer

find ~ -name notes.txt

Question 13

During a forensic investigation, a technician needs to recover files that a user deleted from their Mac's internal SSD several days ago. The Trash has been emptied. Which macOS feature or tool should be attempted first to recover these files?

Accepted Answer

Restore from a Time Machine backup. Time Machine is the built-in macOS backup feature that automatically creates incremental backups of the system. If a Time Machine backup was made before the files were deleted, the user can browse the backup timeline and restore the deleted files directly, even after the Trash has been emptied. This is the simplest and most reliable first step because it does not require specialized tools or risk overwriting data.

Answer

Use the Terminal command 'fs_usage' to locate the deleted files

Answer

Run Disk Utility First Aid on the SSD

Answer

Use a third-party file recovery tool immediately

Question 14

A system administrator needs to find all files in /var/log that have been modified in the last 24 hours to check for recent activity. Which command accomplishes this?

Accepted Answer

find /var/log -mtime -1. The `find` command with `-mtime -1` searches for files whose content (modification time) was changed within the last 24 hours. This is exactly what the administrator needs to check for recent activity in /var/log.

Answer

find /var/log -atime -1

Answer

find /var/log -ctime -1

Answer

find /var/log -mmin -1440

Question 15

A technician needs to search for any file in /etc that contains the string 'Password' (case-insensitive). Which command should be used?

Accepted Answer

grep -ri 'Password' /etc. The `grep -ri` command performs a recursive (`-r`) case-insensitive (`-i`) search for the string 'Password' across all files under the `/etc` directory. This matches the requirement exactly: case-insensitive search for any file containing the string.

Answer

grep -r 'Password' /etc

Answer

find /etc -name '*Password*'

Answer

locate Password | grep /etc