220-1202 Practice Test 44 — 15 Questions

Question 1

A small business wants to ensure that only authorized employees can access the file server from their laptops. Each laptop has a unique hardware ID. Which logical security method should be implemented to enforce this restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable MAC address filtering on the network switch or router.. MAC address filtering on the network switch or router allows the administrator to create an access control list (ACL) that permits only specific hardware MAC addresses to connect to the network. Since each laptop has a unique hardware ID (MAC address), this method directly ties network access to the authorized devices, ensuring only those laptops can reach the file server. This is a logical security control implemented at Layer 2 of the OSI model.

Answer

Require a complex password for the file server share.

Answer

Install a host-based firewall on each laptop.

Answer

Disable the guest account on the file server.

Question 2

A user complains that their laptop battery drains quickly and the device gets very hot. The battery is a lithium-ion type and is three years old. What is the most environmentally responsible recommendation?

Accepted Answer

Replace the battery with a compatible model and recycle the old battery at a certified e-waste facility.. It directly addresses the user's complaint (battery degradation causing heat and poor runtime) while ensuring responsible disposal of the hazardous lithium-ion battery. Recycling at a certified e-waste facility prevents toxic materials from entering landfills and allows recovery of valuable metals, aligning with environmental best practices.

Answer

Replace the entire laptop with a new Energy Star model.

Answer

Remove the battery and run the laptop only on AC power.

Answer

Continue using the laptop until the battery fails completely.

Question 3

A user reports that their smartphone cannot connect to the office Wi-Fi, but other devices can. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The technician checks the phone's settings and sees that it is configured for WPA2-PSK. What is the most likely reason for the connection failure?

Accepted Answer

The phone is using the wrong security protocol.. The phone is configured for WPA2-PSK (Pre-Shared Key), but the office network uses WPA2-Enterprise with PEAP-MSCHAPv2. WPA2-Enterprise requires 802.1X authentication with a RADIUS server, using EAP methods like PEAP-MSCHAPv2, while WPA2-PSK uses a single shared passphrase. The mismatch in security protocols prevents the phone from completing the 4-way handshake, causing the connection failure.

Answer

The phone's Wi-Fi antenna is damaged.

Answer

The router's SSID is hidden.

Answer

The phone's MAC address is filtered.

Question 4

During a security audit, you discover that a user's workstation has an unauthorized application running. You need to terminate the process immediately from the command line. The process name is 'malware.exe'. Which command should you use?

Accepted Answer

taskkill /IM malware.exe /F. The `taskkill` command with the `/IM` (image name) and `/F` (force) flags is the standard Windows CLI method to forcibly terminate a process by its executable name. This directly stops 'malware.exe' without requiring the process ID, making it the appropriate tool for immediate termination during a security incident.

Answer

tasklist /FI "IMAGENAME eq malware.exe"

Answer

net stop malware

Answer

shutdown /r /t 0

Question 5

A technician is configuring a new Windows 10 workstation for a user who handles sensitive financial data. The company policy mandates that the screen lock after 5 minutes of inactivity and require a password on wake. Which settings should the technician configure?

Accepted Answer

Configure the screen saver to start after 5 minutes and check 'On resume, display logon screen.'. The screen saver with 'On resume, display logon screen' enforces a lock after 5 minutes of inactivity and requires a password to unlock. This directly meets the policy requirement for screen lock and password on wake. The power plan display timeout only turns off the display but does not lock the session, so it does not require a password to resume.

Answer

Set the power plan to turn off the display after 5 minutes.

Answer

Enable the 'Require password on wakeup' setting in the power plan only.

Answer

Set the computer to sleep after 5 minutes and require a password on wake.

Question 6

A technician is configuring a new server room and needs to ensure that only authorized personnel can physically access it. The company wants a solution that does not require replacement of keys or cards if one is lost. Which access control method best meets this requirement?

Accepted Answer

Implement a biometric fingerprint reader. A biometric fingerprint reader authenticates based on a unique physical characteristic of the person, so there is no key, card, or token that can be lost and need replacing. If a user is removed, their biometric template is simply deleted from the system, and no physical credential reissue is required. This directly satisfies the requirement of not replacing keys or cards when one is lost.

Answer

Use a combination lock

Answer

Install a smart card system

Answer

Use a keypad with a PIN code

Question 7

A user complains that their Android phone's battery drains quickly after installing a new weather app. The phone is warm to the touch even when idle. What should you do to resolve this?

Accepted Answer

Check battery usage in Settings to see which app is consuming power.. The symptoms—rapid battery drain and a warm phone even when idle—strongly indicate a rogue app consuming excessive CPU or network resources in the background. Checking battery usage in Settings (typically under Battery > Battery Usage or similar) will identify the exact app responsible, allowing you to force-stop, uninstall, or restrict its background activity. This is the standard first diagnostic step for battery issues on Android, as it provides concrete data rather than guessing.

Answer

Replace the battery immediately.

Answer

Perform a factory reset to remove all apps.

Answer

Update the phone's operating system to the latest version.

Question 8

A user reports that their computer is displaying a message claiming their files are encrypted and they must pay 0.5 Bitcoin to a specific address to regain access. The user cannot open any documents or photos. What is the first step the technician should take to respond to this incident?

Accepted Answer

Disconnect the computer from the network.. Disconnecting the computer from the network is the first containment step to prevent ransomware from spreading to other systems or exfiltrating data. Ransomware often has worm-like propagation and command-and-control communication, so isolating the host immediately limits damage. This aligns with standard incident response containment procedures.

Answer

Pay the ransom to recover the files immediately.

Answer

Run a full antivirus scan to remove the malware.

Answer

Reboot the computer into Safe Mode.

Question 9

A technician is investigating a security incident where a user's credentials were stolen. The user says they only logged into their email from a coffee shop Wi-Fi. The technician notices that the browser was not using HTTPS for the login page. What is the most likely attack method used?

Accepted Answer

Man-in-the-middle attack.. A man-in-the-middle (MITM) attack occurs when an attacker intercepts communications between the user and the server, often on unsecured public Wi-Fi. Because the login page was not using HTTPS, credentials were transmitted in cleartext, allowing the attacker to capture them. This is the classic scenario for credential theft on open networks.

Answer

Cross-site scripting (XSS) attack.

Answer

DNS spoofing attack.

Answer

Brute force attack.

Question 10

A company is migrating to a new cloud-based system and needs to dispose of old tape backup cartridges that contain years of financial data. The tapes are magnetic media. Which disposal method is most appropriate for this media type?

Accepted Answer

Overwrite the tapes with a bulk eraser.. A bulk eraser generates a strong magnetic field that completely demagnetizes magnetic tape media, rendering all data unrecoverable while allowing the tape to be reused. This is the standard sanitization method for magnetic media like tape cartridges. It satisfies data disposal requirements without destroying the media.

Answer

Reformat the tapes using a tape drive.

Answer

Incinerate the tapes in a certified facility.

Answer

Delete the files from the tape catalog.

Question 11

A customer reports that their Android phone's screen is unresponsive to touch after a drop. They can still hear notifications and see the display. Which built-in tool should you use to test the touchscreen functionality without relying on third-party apps?

Accepted Answer

Diagnostics Mode (e.g., *#0*#). Diagnostics Mode (accessed via codes like *#0*# on Samsung devices) is a built-in hardware test menu that includes a dedicated touchscreen test where you draw on a grid to verify every region of the digitizer responds. It runs at the firmware level, independent of the Android OS and any third-party apps, so it isolates whether the unresponsiveness is a hardware fault (digitizer damage from the drop) versus a software issue. Because the display and audio still work, the drop likely damaged the touch digitizer specifically, and Diagnostics Mode is the correct tool to confirm that.

Answer

Safe Mode

Answer

Developer Options

Answer

Factory Reset

Question 12

A technician is writing a Python script to automate the cleanup of user profiles on a Windows server. The script must iterate through all user profile folders in 'C:\Users', check the last modified date, and delete profiles older than 90 days. Which scripting concept is essential for this task?

Accepted Answer

A for loop to iterate over folders. A for loop is essential for iterating over all user profile folders in 'C:\Users'. The script needs to process each folder one by one to check the last modified date and delete if older than 90 days. A for loop is the standard construct for iterating over a collection of items, such as directories.

Answer

Error handling with try-except

Answer

A while loop with a counter

Answer

A function to calculate date difference

Question 13

A change advisory board (CAB) approves a network switch replacement, but the technician discovers during implementation that the new switch requires a different firmware version than documented. The change plan does not include a rollback for this scenario. What is the best course of action?

Accepted Answer

Stop the implementation and contact the CAB for a revised change plan.. When implementation reveals a deviation from the approved change plan and no rollback exists for the new condition, the technician must stop and return to the CAB for a revised plan. Change management requires that work proceed only within the approved scope with a defined backout; proceeding without one violates the process and risks an unrecoverable outage.

Answer

Proceed with the firmware update and document the change afterward.

Answer

Use the old switch firmware on the new switch to match the documentation.

Answer

Implement the switch and create a separate change request for the firmware.

Question 14

A customer says that when they click a link in an email, it opens a website that looks exactly like their bank's login page, but the URL starts with 'http://' instead of 'https://'. What is the most likely security concern?

Accepted Answer

The email contains a phishing link.. A website that mimics a bank's login page but uses 'http://' instead of 'https://' is a classic phishing indicator, as legitimate banks always use HTTPS with a valid certificate. The lack of TLS means credentials submitted would be sent in cleartext to attackers. This is the most likely security concern in the scenario.

Answer

The website is using an expired SSL certificate.

Answer

The user's browser is infected with adware.

Answer

The user's DNS server has been compromised.

Question 15

A technician is tasked with upgrading the operating system on ten identical workstations. The change advisory board has approved the upgrade. After completing the first workstation, the technician notices the new OS causes a critical line-of-business application to fail. What should the technician do next?

Accepted Answer

Report the failure to the change advisory board and pause further upgrades.. When a pilot upgrade reveals a critical application failure, the change advisory board (CAB) must be informed because the approved change no longer meets its success criteria. Pausing further upgrades prevents the same failure from affecting the remaining nine workstations and allows the CAB to reassess, request a rollback plan, or approve a remediation. This follows ITIL change management principles.

Answer

Continue upgrading the remaining workstations since the change was approved.

Answer

Restore the first workstation to the previous OS and complete the rest without changes.

Answer

Research a hotfix for the application and apply it to all workstations.