220-1202 Practice Test 46 — 15 Questions

Question 1

A technician is troubleshooting a network issue for a remote employee. The employee's internet connection is unstable, and the technician suspects the home router. The employee is not technical and becomes defensive when the technician asks about their router setup. Which approach is MOST effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Say, 'Let's work together to check a few things on your router to improve your connection.'. It uses a collaborative, non-confrontational approach that respects the employee's lack of technical knowledge and defuses defensiveness. By saying 'Let's work together,' the technician invites the employee to participate without blame, making it easier to guide them through checking the router's configuration (e.g., verifying Wi-Fi channel congestion, checking for firmware updates, or reviewing DHCP lease times) without requiring the employee to understand technical details. This aligns with CompTIA's emphasis on professionalism and effective communication in remote troubleshooting.

Answer

Tell the employee that their router is probably cheap and needs replacement.

Answer

Ask the employee to run a command prompt command without explanation.

Answer

Escalate the issue to a senior technician without further attempts.

Question 2

During a security incident response, you discover that a user's browser has a rogue extension that exfiltrates data to a remote server. The extension was installed after the user clicked a fake update prompt on a website. What vulnerability was exploited?

Accepted Answer

Social engineering.. The attack exploited the user's trust and lack of caution, not a technical flaw in the browser or web application. The user was tricked into installing a rogue extension by clicking a fake update prompt, which is a classic social engineering technique that manipulates human psychology rather than exploiting code vulnerabilities.

Answer

A zero-day vulnerability in the browser.

Answer

An insecure direct object reference (IDOR) vulnerability.

Answer

A cross-site request forgery (CSRF) attack.

Question 3

After installing a new application, a user's Windows 10 system fails to boot and displays a 'Bootmgr is missing' error. Which command-line tool should you use from the Windows Recovery Environment to repair the boot configuration?

Accepted Answer

bootrec. The 'Bootmgr is missing' error indicates that the Boot Manager (bootmgr) is corrupted or the Boot Configuration Data (BCD) is damaged. The bootrec command, specifically with the /FixBoot, /FixMbr, and /RebuildBcd switches, is designed to repair the boot configuration and restore the boot manager from the Windows Recovery Environment.

Answer

diskpart

Answer

sfc /scannow

Answer

chkdsk /f

Question 4

A company wants to secure its server room door so that only authorized personnel can enter. They need a system that can be quickly revoked if an employee leaves and that logs entry attempts. Which physical security control best meets these requirements?

Accepted Answer

An electronic key card system.. An electronic key card system meets both requirements: access can be instantly revoked by deactivating the card in the central database, and each entry attempt is logged with a timestamp and card ID. This provides granular, auditable access control without the need to physically change locks or share codes.

Answer

A combination lock with a shared code.

Answer

A biometric fingerprint scanner.

Answer

A physical key and lock system.

Question 5

A security analyst discovers that a user's workstation has been compromised by a rootkit that hides its processes from Task Manager. The rootkit is not detected by the installed antivirus. Which step is most effective for remediation?

Accepted Answer

Boot from a rescue disk and perform an offline antivirus scan.. A rootkit that hides its processes from Task Manager and evades the installed antivirus operates at a deep level within the operating system, often in kernel mode. Booting from a rescue disk (e.g., a live CD/USB with an offline scanner) loads a clean operating system environment, preventing the rootkit from loading and allowing the antivirus to scan the infected system's files without interference. This offline approach is the most effective remediation step when the rootkit is actively hiding from the installed AV in the normal OS context.

Answer

Run a full antivirus scan in Safe Mode.

Answer

Use System Restore to revert to a previous state.

Answer

Reinstall the operating system from the recovery partition.

Question 6

A customer reports that their computer is emitting a loud, continuous beep and the monitor shows no display. The technician suspects a hardware issue. What is the most important safety step to take before opening the case?

Accepted Answer

Unplug the power cord from the wall outlet.. The most important safety step before opening a computer case is to unplug the power cord from the wall outlet. This ensures complete disconnection from the AC mains, eliminating the risk of electric shock from exposed internal components, such as the power supply unit (PSU) capacitors, which can hold a dangerous charge even when the system is off. While other steps like wearing an anti-static wrist strap are good practices, they do not address the primary hazard of lethal voltage.

Answer

Put on anti-static wrist strap and grounding mat.

Answer

Press the power button to discharge residual power.

Answer

Wear safety goggles to protect eyes from debris.

Question 7

A technician is decommissioning a server room and finds several old cathode ray tube (CRT) monitors that still work. The company wants to dispose of them responsibly. What should the technician do?

Accepted Answer

Contact a certified CRT recycler for pickup and recycling.. CRT monitors contain leaded glass and other hazardous materials (e.g., phosphors, barium) that are classified as universal waste under the Resource Conservation and Recovery Act (RCRA). Disposing of them in a dumpster or donating them for non-certified reuse can violate environmental regulations. A certified CRT recycler ensures the monitors are dismantled safely, with leaded glass separated and recycled in compliance with EPA guidelines.

Answer

Sell the monitors to a local thrift store for reuse.

Answer

Break the glass tubes to reduce volume and then place them in a dumpster.

Answer

Donate the monitors to a school art department for projects.

Question 8

A user calls the help desk complaining that their browser homepage keeps changing to a site they did not set, and they cannot change it back. You remotely check and find no malware. What is the most likely cause?

Accepted Answer

A recently installed program modified the browser settings during installation.. Many legitimate software installers include bundled programs or browser extensions that modify the default homepage, search provider, or new tab page as part of their installation routine. Even without malware, these changes are often made via registry keys (e.g., HKCU\Software\Microsoft\Internet Explorer\Main\Start Page) or browser policy files, and the user may not have unchecked the relevant option during setup. Since no malware was found, a recently installed program is the most likely cause of the unwanted homepage change.

Answer

The user's browser profile is corrupted.

Answer

The user's DNS settings are being hijacked by the ISP.

Answer

The browser's shortcut target is pointing to a different URL.

Question 9

A user receives an email from what appears to be their bank, asking them to click a link and verify their account due to suspicious activity. The email contains several spelling errors and the link points to an unfamiliar domain. What type of attack is this?

Accepted Answer

Phishing. This is a classic phishing attack because the email is a mass, unsolicited message that impersonates a trusted entity (the bank) and uses social engineering to trick the recipient into clicking a malicious link. The presence of spelling errors and an unfamiliar domain are hallmark indicators of a generic phishing attempt, not a targeted attack. Phishing typically relies on volume and deception rather than personalized reconnaissance.

Answer

Spear phishing

Answer

Whaling

Answer

Vishing

Question 10

A small business owner reports that after upgrading their wireless router to a newer model, their older laptops running Windows 7 cannot connect to the Wi-Fi network. The new router is configured with WPA3-Personal. Which of the following is the most likely reason for the connectivity failure?

Accepted Answer

The laptops' wireless adapters do not support WPA3.. WPA3-Personal is a newer wireless security protocol that requires hardware support in the wireless adapter. Older laptops running Windows 7 typically have legacy wireless adapters that only support WPA2 or earlier protocols. Since the router is configured to use WPA3 only, the laptops' adapters cannot negotiate a connection, resulting in failure.

Answer

The router's SSID is hidden.

Answer

The router is broadcasting on a 5 GHz band only.

Answer

The laptops have incorrect DNS settings.

Question 11

A security analyst discovers that an attacker has been using a compromised VPN account to access the corporate network. The account belongs to a former employee who was terminated two weeks ago. Which of the following should the analyst do immediately to prevent further unauthorized access?

Accepted Answer

Disable the former employee's VPN account. Disabling the former employee's VPN account immediately stops the attacker from using the compromised credentials to access the corporate network. This is the most direct and effective action to prevent further unauthorized access, as the account is the vector being exploited. Other steps like log review or server reconfiguration are important but secondary to cutting off the active attack path.

Answer

Review the VPN logs to determine the extent of the breach

Answer

Change the VPN server's shared secret

Answer

Notify the former employee about the security incident

Question 12

A user calls the help desk because their workstation is running very slowly and they notice unusual network activity. You suspect ransomware. What should you do first to contain the threat?

Accepted Answer

Disconnect the workstation from the network immediately.. Disconnecting the workstation from the network immediately is the correct first step because ransomware often uses network propagation mechanisms (e.g., SMB, RDP) to encrypt shared drives and spread to other systems. By isolating the machine at the physical or logical layer, you prevent lateral movement and further encryption of network resources, which is the primary containment priority in a suspected ransomware incident.

Answer

Run a full antivirus scan on the affected workstation.

Answer

Back up all files to an external drive before taking action.

Answer

Restart the computer and boot into Safe Mode.

Question 13

A company's cloud-based CRM application is experiencing intermittent outages. The IT team suspects a distributed denial-of-service (DDoS) attack. Which cloud characteristic is most directly impacted by such an attack?

Accepted Answer

Availability. A DDoS attack floods the CRM application with malicious traffic, overwhelming its resources and causing service disruption. This directly impacts the cloud characteristic of availability, which ensures that services remain accessible to authorized users when needed. In cloud computing, availability is often measured by uptime percentages and is critical for business continuity.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 14

After a failed Windows Update, a Windows 10 system repeatedly attempts to install the update and fails. You need to stop the Windows Update service and delete the temporary update files from the command line. Which two commands, in order, should you use? (Select the first command from the options.)

Accepted Answer

net stop wuauserv. The correct first command is 'net stop wuauserv' because it stops the Windows Update service (wuauserv), which prevents the system from continuing to attempt the failed update installation. After stopping the service, you can then delete the temporary update files from the SoftwareDistribution folder using commands like 'del /f /s /q %systemroot%\SoftwareDistribution\*' or 'rmdir /s /q %systemroot%\SoftwareDistribution'. This two-step process is the standard method to clear a stuck update state.

Answer

sfc /scannow

Answer

dism /online /cleanup-image /restorehealth

Answer

taskkill /IM svchost.exe /F

Question 15

A technician is reviewing the change management log and finds that a previous change to the email server was marked as 'completed' but the email service has been intermittent since then. The technician suspects the change was not fully tested. Which step in the change management process was most likely skipped?

Accepted Answer

A post-implementation review was not conducted. A post-implementation review (PIR) is the step where the change is verified to have met its objectives without causing adverse effects. Since the email service became intermittent after the change was marked 'completed', the lack of a PIR means the change was not validated in production, allowing the underlying issue to go undetected. In the CompTIA change management process, the PIR ensures that the change has been fully tested and that any residual problems are identified and addressed before the change is closed.

Answer

The change request was not submitted

Answer

The change was not approved by the CAB

Answer

The rollback plan was not documented