220-1202 Practice Test 47 — 15 Questions

Question 1

A user reports that their Windows 10 laptop takes an unusually long time to boot and frequently shows a 'Preparing Automatic Repair' screen before finally loading the desktop. Which Windows tool should be used first to diagnose and potentially fix the boot process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the System File Checker (SFC) from an elevated Command Prompt.. The 'Preparing Automatic Repair' loop and slow boot often indicate corruption in critical boot files, such as the Boot Configuration Data (BCD) or system files. Running System File Checker (SFC) from an elevated Command Prompt scans and repairs protected system files, addressing the root cause without data loss. This is the first-line diagnostic tool for boot integrity issues before escalating to more destructive methods.

Answer

Perform a full system restore from a backup made last month.

Answer

Use the Disk Cleanup tool to remove temporary files.

Answer

Reinstall Windows using the 'Reset this PC' option.

Question 2

A security incident has occurred: an employee's workstation was used to access unauthorized websites. The manager wants to review recent web browsing history and application usage. Which administrative tool can provide a comprehensive timeline of user activity on the Windows 10 system?

Accepted Answer

Event Viewer to examine Security and Application logs for user activity.. Event Viewer is the correct administrative tool because it consolidates Security logs (e.g., event ID 4624 for logons, 4648 for explicit logon attempts) and Application logs that record user activity such as web browsing and application launches. By filtering these logs, a manager can reconstruct a timeline of user actions on the Windows 10 system, including unauthorized website access.

Answer

Performance Monitor to create a trace of user actions.

Answer

Task Scheduler to view past task executions.

Answer

Local Users and Groups to check user group memberships.

Question 3

A technician is investigating a security incident where a user's virtual machine was compromised. The technician suspects that the VM was infected with malware that spread from the host. Which virtualization security best practice would have prevented this?

Accepted Answer

Keep the hypervisor and host OS updated with security patches.. Keeping the hypervisor and host OS updated with security patches is a fundamental virtualization security best practice that prevents malware from exploiting known vulnerabilities in the hypervisor layer. In this scenario, the malware spread from the host to the VM, indicating a hypervisor-level compromise that patching would have mitigated. Regular patching closes the attack vector that allows host-to-VM infection, such as vulnerabilities in the hypervisor's management interface or device emulation code.

Answer

Enable snapshots for all VMs.

Answer

Use a Type 2 hypervisor for better isolation.

Answer

Assign more virtual CPUs to the VM.

Question 4

A graphic designer reports that their MacBook Pro running macOS Monterey suddenly shows a gray screen with a folder icon containing a question mark at startup. They have important client files on the internal SSD. What is the most likely cause of this issue?

Accepted Answer

macOS cannot locate a valid boot volume or system folder. The gray screen with a folder icon containing a question mark indicates that the Mac's startup process cannot locate a valid boot volume or system folder. This is a classic symptom of a missing or corrupted boot loader, damaged system files, or a disconnected internal SSD, which prevents macOS from finding the required bootable system.

Answer

The user’s Time Machine backup has failed

Answer

The firmware password is enabled

Answer

The user’s login keychain is corrupted

Question 5

A technician is troubleshooting a Windows 10 workstation that fails to boot. The technician suspects a problem with the boot configuration data (BCD). Which two commands can be used to rebuild the BCD? (Choose two.)

Accepted Answer

bootrec /rebuildbcd. The two commands that rebuild the BCD are bootrec /rebuildbcd and bcdboot. bootrec /rebuildbcd scans for Windows installations and rebuilds the BCD store, while bcdboot creates or repairs the BCD and boot files from a specified Windows directory. The other commands either back up, fix the boot sector, or fix the MBR, but do not rebuild the BCD.

Answer

bootrec /fixboot

Answer

bootrec /fixmbr

Answer

bcdedit /export

Question 6

A user reports that their Windows 11 laptop takes several minutes to reach the desktop after signing in, and the desktop icons and taskbar appear one by one. No error messages are displayed. You open Task Manager and see that disk usage is at 100% for several minutes after logon. Which Windows tool should you use first to identify the specific startup program causing the delay?

Accepted Answer

Task Manager > Startup tab. Task Manager's Startup tab is the built-in tool that specifically lists programs set to run at logon and provides an impact rating based on resource usage. Since the symptom is slow logon with high disk usage, checking this tab lets you quickly identify and disable the offending startup app. Other tools are either too broad or focus on the wrong object.

Answer

System Configuration (msconfig) > Services tab

Answer

Event Viewer > Windows Logs > Application

Answer

Performance Monitor with a Data Collector Set

Question 7

A user reports that after installing a new third-party backup utility, their Windows 11 computer takes several minutes to reach the desktop and shows a black screen with a spinning circle. The user wants to keep the backup utility but needs faster boot times. A technician opens Task Manager and notices the backup utility has a 'High' startup impact. Which of the following should the technician do FIRST to resolve the slow boot?

Accepted Answer

Disable the backup utility in the Startup tab of Task Manager.. Task Manager's Startup tab shows the impact of each startup program. When a specific application is flagged as high impact and the timing correlates with its installation, disabling that startup entry is the most direct and least disruptive fix. It preserves the application for manual use and avoids unnecessary system-wide changes.

Answer

Perform a clean boot using msconfig and disable all non-Microsoft services.

Answer

Use msconfig to set the computer to Safe Boot with minimal services.

Answer

Run the System File Checker (sfc /scannow) to repair corrupted system files.

Question 8

A help desk technician receives a Windows 11 laptop that displays a message that the operating system cannot be found at startup. The drive is detected in firmware, and the technician wants to rebuild the boot configuration without reinstalling Windows. Which command should be run from the Windows Recovery Environment?

Accepted Answer

bootrec /rebuildbcd. The missing operating system message on a detected drive usually means the Boot Configuration Data store lacks a valid entry. Rebuilding it with bootrec /rebuildbcd from the recovery environment re-creates the Windows Boot Manager entry and restores startup without a full reinstall.

Answer

chkdsk C: /f /r

Answer

sfc /scannow

Answer

bootrec /fixmbr

Question 9

A user reports that when they connect to the corporate Wi-Fi at a coffee shop, a browser warning appears stating the site's certificate is not trusted. The user is able to browse the internet but sees the warning on every HTTPS site. A technician suspects an on-path attack. Which of the following should the technician check FIRST to confirm the presence of an on-path attack?

Accepted Answer

The certificate chain presented by the browser to see if it is issued by an unknown or self-signed certificate authority.. The certificate chain is the most direct evidence of an on-path attack because the attacker must present a certificate to intercept TLS traffic. If the certificate is self-signed or issued by an untrusted CA, the browser will warn the user. DNS or ARP checks might reveal other attack vectors, but the certificate warning specifically indicates TLS interception, so examining the certificate chain confirms the attack.

Answer

The DNS server settings on the user's device and compare them to the corporate DNS servers.

Answer

The ARP cache on the user's device to look for duplicate MAC addresses.

Answer

The Wi-Fi encryption type configured on the user's device to ensure it is using WPA3.

Question 10

A technician is preparing to dispose of several old hard drives that contain sensitive company data. The organization's data destruction policy requires physical destruction. Which of the following methods are appropriate for physically destroying the drives? (Choose two.)

Accepted Answer

Incineration. Shredding and incineration are both physical destruction methods that render the drive unusable and data unrecoverable. Degaussing, overwriting, and low-level formatting are logical or magnetic erasure methods that do not physically destroy the media. Therefore, only shredding and incineration satisfy the policy requirement for physical destruction.

Answer

Low-level formatting

Answer

Overwriting

Answer

Degaussing

Question 11

A technician is troubleshooting a Windows 10 workstation that is running very slowly. The technician suspects a malware infection. Which of the following should the technician do FIRST according to best practices for malware removal?

Accepted Answer

Quarantine the system by disconnecting it from the network.. The first step in malware removal is to quarantine the infected system by disconnecting it from the network. This prevents the malware from spreading to other systems and stops any remote communication. Only after isolation should the technician proceed with scanning, removal, and recovery. Educating the user and restoring from backup are subsequent steps.

Answer

Restore the system from a known good backup.

Answer

Educate the end user about safe browsing habits.

Answer

Run a full antivirus scan immediately.

Question 12

A technician is troubleshooting a Windows 10 workstation that frequently becomes unresponsive. The user reports that the system slows down dramatically after a few hours of use, and the technician suspects a memory leak or resource exhaustion. The technician opens Task Manager and switches to the Performance tab. Which two counters should the technician monitor to confirm the suspicion? (Choose two.)

Accepted Answer

Memory usage percentage. Memory usage percentage and available memory are the two counters that directly reflect physical memory consumption and availability. A memory leak causes memory usage to climb and available memory to shrink over time, matching the reported slowdown. CPU utilization, disk queue length, and GPU usage can be affected indirectly but do not confirm memory exhaustion as directly as the memory-specific counters.

Answer

Disk queue length

Answer

CPU utilization

Answer

GPU usage

Question 13

A user reports that after installing a new third-party disk cleanup utility, Windows 11 randomly displays a blue screen with the stop code CRITICAL_PROCESS_DIED. The system boots normally in Safe Mode, and the issue does not occur there. Which of the following is the BEST first step to resolve the issue?

Accepted Answer

Uninstall the third-party disk cleanup utility in Safe Mode.. The crash appeared only after installing a third-party cleanup tool and does not occur in Safe Mode, which strongly indicates a problematic third-party driver or service. Uninstalling that utility in Safe Mode removes the offending component directly. Broader repairs like SFC, System Restore, or memory testing are either unnecessary or address causes not supported by the evidence.

Answer

Run System File Checker (SFC) with the /scannow parameter.

Answer

Perform a System Restore to a point before the utility was installed.

Answer

Run the Windows Memory Diagnostic tool to test for faulty RAM.

Question 14

A technician is preparing to replace a failed hard drive in a user's desktop PC. The drive contains sensitive company data. The technician wants to ensure proper disposal of the old drive and maintain data security. Which of the following TWO actions should the technician take? (Choose two.)

Accepted Answer

Use a software tool to perform a secure erase or wipe.. The correct actions are to physically destroy the drive or use a software tool to perform a secure erase/wipe. Both methods ensure that sensitive data cannot be recovered. Standard format, partition deletion, or storage alone do not provide adequate data sanitization. These steps align with data security best practices for storage media disposal.

Answer

Run a standard format on the drive before disposal.

Answer

Delete all partitions and recreate a single empty partition.

Answer

Store the drive in a secure cabinet until it can be reused.

Question 15

A user reports that their Windows 11 laptop occasionally shows a blue screen with the stop code CRITICAL_PROCESS_DIED. The issue occurs randomly, about once every two days. The user has not installed any new hardware or software recently. Which of the following should a technician perform FIRST to troubleshoot this issue?

Accepted Answer

Run the System File Checker (SFC) utility.. CRITICAL_PROCESS_DIED indicates that a critical system process has terminated unexpectedly, often due to corrupted system files. Running System File Checker (SFC) is a standard first step because it can repair those files without data loss. Other options are either too invasive or target the wrong subsystem, making SFC the most appropriate initial action.

Answer

Update the graphics card driver to the latest version.

Answer

Replace the hard drive with a new solid-state drive (SSD).

Answer

Perform a clean installation of Windows 11.