220-1202 Practice Questions 1 — 50 Questions

Question 1

A company is deploying new laptops to remote workers. They need to ensure that if a laptop is stolen, the data on it cannot be accessed. Which two physical security controls should be configured before shipment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Full-disk encryption and a BIOS/UEFI password.. Full-disk encryption protects data at rest, and a BIOS/UEFI password prevents unauthorized booting or tampering with boot settings. This question tests the combination of controls needed for remote device security.

Answer

Cable lock and privacy filter.

Answer

Smart card reader and biometric scanner.

Answer

Asset tracking tag and a Kensington lock slot.

Question 2

A technician is troubleshooting a wireless network where users report intermittent connectivity. The network uses WPA2-Enterprise with a RADIUS server. The technician notices that the RADIUS server logs show frequent authentication failures from one specific access point. What is the most likely cause?

Accepted Answer

The access point's RADIUS shared secret is incorrect.. The RADIUS shared secret is a pre-shared key configured on both the access point and the RADIUS server to authenticate the AP itself. If the secret on the specific AP does not match the server's configuration, the server will reject authentication requests from that AP, causing intermittent connectivity for clients associated with it. The logs showing frequent authentication failures from one AP point directly to a mismatch in this shared secret.

Answer

The access point is using a different channel than the others.

Answer

The RADIUS server certificate has expired.

Answer

The clients are using WPA2-PSK instead of WPA2-Enterprise.

Question 3

A company is designing a secure entry for a high-security lab. They need to ensure that only one person can enter at a time and that the person must be authenticated before the second door opens. Which physical security control should be used?

Accepted Answer

Mantrap with smart card and biometric authentication. A mantrap (also called an interlocking door system) is the correct physical security control because it creates a small vestibule with two interlocking doors that prevent more than one person from entering at a time. The requirement for smart card and biometric authentication ensures that the person must be authenticated before the second door opens, providing both identity verification and access control. This design enforces a strict one-person entry sequence and prevents tailgating or piggybacking.

Answer

Turnstile with biometric reader

Answer

Security guard with logbook

Answer

Cipher lock with door alarm

Question 4

A user reports that their workstation is running slowly and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their system tray that they did not install. What is the most likely security issue?

Accepted Answer

The system has adware installed.. Adware is a type of malware that displays unwanted advertisements, often in the form of pop-ups or browser redirects, and may install toolbars or other unwanted software without the user's consent. The presence of a new toolbar in the system tray and frequent pop-ups even when no browser is open are classic indicators of adware infection, as adware often runs background processes to generate revenue through ad impressions.

Answer

A rootkit has hidden itself in the kernel.

Answer

A ransomware encryption process has started.

Answer

The user's account has been phished and credentials stolen.

Question 5

A small business owner wants to allow their remote employees to securely access a specific internal application without giving them full network access. Which remote access technology should the technician recommend?

Accepted Answer

Application gateway. An application gateway (reverse proxy) is the correct choice because it provides granular, application-layer access control, allowing remote employees to reach a specific internal application without granting them full network-level access. Unlike VPNs that create a tunnel to the entire network, an application gateway authenticates and proxies only the designated application traffic, often using protocols like HTTPS and enforcing policies at Layer 7.

Answer

Site-to-site VPN

Answer

Remote Desktop Services

Answer

SSH tunneling

Question 6

A technician is tasked with installing a new hard drive in a server rack. The rack is located in a cramped, dusty storage room with poor lighting. Which safety practice should the technician prioritize before beginning the installation?

Accepted Answer

Wear a dust mask and use a flashlight to improve visibility.. The scenario describes a cramped, dusty storage room with poor lighting, which creates two immediate hazards: inhalation of dust particles and reduced visibility. Wearing a dust mask protects the technician's respiratory system from airborne particulates, while using a flashlight ensures they can see clearly to avoid accidental contact with components or cables. These measures directly address the environmental risks before any work begins.

Answer

Use a step stool to reach the server rack safely.

Answer

Remove the server from the rack and place it on the floor for easier access.

Answer

Disconnect all power cables in the rack to eliminate electrical hazards.

Question 7

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

Accepted Answer

Use Group Policy Preferences to set the local administrator password.. Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Answer

Store the password in a plain text file and have the script read it.

Answer

Embed the password in the script using a variable and run it from a hidden share.

Answer

Use a scheduled task that runs the script as SYSTEM.

Question 8

A small business owner wants to replace their old wireless router because guests have been using the network to access inappropriate content. The owner wants to isolate guest traffic from the main business network and enforce content filtering. Which combination of wireless security and features should the technician recommend?

Accepted Answer

WPA2-PSK with a guest network enabled and content filtering via OpenDNS.. WPA2-PSK with a guest network creates a separate VLAN or subnet that isolates guest traffic from the main business network, preventing guests from accessing internal resources. Content filtering via OpenDNS provides DNS-level filtering to block inappropriate content without requiring additional hardware, addressing both isolation and content control requirements.

Answer

WPA3-Personal with MAC address filtering.

Answer

WPA2-Enterprise with a RADIUS server and no guest network.

Answer

WEP encryption with a hidden SSID.

Question 9

A small office wants to dispose of 20 old CRT monitors. The local landfill does not accept e-waste. Which disposal method is both legal and environmentally responsible?

Accepted Answer

Contact a certified e-waste recycling company to pick them up.. CRT monitors contain hazardous materials like lead and phosphor, making them e-waste that cannot be disposed of in regular trash. Certified e-waste recycling companies follow environmental regulations to safely dismantle and recycle these components, ensuring legal compliance and responsible handling.

Answer

Place them in the dumpster behind the office after hours.

Answer

Break them down and put the plastic and metal in separate recycling bins.

Answer

Sell them to a scrap metal dealer.

Question 10

A company policy requires that all web traffic be filtered to block known malicious sites. You need to implement this on the network without installing software on each client. What should you configure?

Accepted Answer

Configure a DNS filtering service on the router or DNS server. A DNS filtering service works at the network level by resolving domain names against a blocklist of known malicious sites. By configuring this on the router or DNS server, all client traffic is filtered transparently without requiring any software installation on individual workstations, which satisfies the policy requirement.

Answer

Enable Windows Defender Firewall on each workstation

Answer

Install a browser extension on all computers

Answer

Set the browser security level to high

Question 11

A technician is troubleshooting a Windows 10 PC that was infected with a rootkit. After booting from a rescue disk and running a scan, the rootkit is removed, but the system is still unstable. What should the technician do next to ensure the system is fully remediated?

Accepted Answer

Run the System File Checker (SFC) tool to repair corrupted files.. After removing a rootkit, the system may have corrupted system files that cause instability. Running the System File Checker (SFC) tool with the 'sfc /scannow' command scans protected system files and replaces corrupted versions with cached copies from the Windows side-by-side store, directly addressing file integrity issues left by the rootkit.

Answer

Reinstall the operating system from scratch.

Answer

Disable System Restore and delete all restore points.

Answer

Perform a disk cleanup to remove temporary files.

Question 12

A user reports that their Windows 10 PC is infected with malware that prevents the Task Manager from opening. You need to terminate a suspicious process from the command line. Which command should you use to forcefully end a process by its name?

Accepted Answer

taskkill /IM malware.exe /F. The `taskkill` command with the `/IM` (image name) parameter targets a process by its executable name, and the `/F` flag forcefully terminates it. This is the appropriate tool when Task Manager is disabled by malware, as it directly ends the process from the command line without relying on GUI interaction.

Answer

tasklist /v

Answer

shutdown /r /t 0

Answer

regedit /e backup.reg

Question 13

A company is experiencing a security incident where an attacker gained access to the internal network via a compromised VPN account. The technician must prevent future attacks. Which two-factor authentication method should the technician implement for VPN access?

Accepted Answer

Implement a time-based one-time password (TOTP) via an authenticator app. Two-factor authentication (2FA) adds a second factor beyond the password, such as a one-time code from an authenticator app. This significantly reduces the risk of account compromise even if the password is stolen.

Answer

Require a complex password with a minimum length of 20 characters

Answer

Restrict VPN access to specific IP addresses

Answer

Enable single sign-on (SSO) with Active Directory

Question 14

A technician is troubleshooting a user's inability to access a specific website. The user can access other websites without issue. The technician wants to check the route packets take to the problematic server and identify where the connection fails. Which command should be used?

Accepted Answer

tracert example.com. The `tracert` command (short for 'trace route') is the correct tool because it sends ICMP Echo Request packets with incrementally increasing TTL (Time to Live) values, causing each router along the path to reply with an ICMP Time Exceeded message. This reveals the exact hop-by-hop path to the destination and pinpoints where the connection fails, which is precisely what the technician needs to diagnose a site-specific outage.

Answer

ping -t example.com

Answer

nslookup example.com

Answer

netstat -an

Question 15

A user reports that their Windows 10 PC is infected with malware that keeps reinstalling after removal. You need to boot into a minimal environment to run antivirus scans without malware interference. Which advanced startup option should you use?

Accepted Answer

Safe Mode. Safe Mode (B) loads Windows with a minimal set of drivers and services, preventing malware that runs as a startup program or service from loading. This allows antivirus software to scan and remove the infection without interference, addressing the scenario where malware reinstalls after removal in a normal boot.

Answer

Enable Boot Logging

Answer

Last Known Good Configuration

Answer

Debugging Mode

Question 16

A technician is tasked with securing a shared office printer that stores sensitive documents on its hard drive. The printer is in an open area. Which physical security measure should be prioritized to protect the data on the printer?

Accepted Answer

Place the printer in a locked room. The most effective physical security measure to protect sensitive data on a printer's hard drive in an open area is to control physical access to the device itself. Placing the printer in a locked room prevents unauthorized individuals from physically removing the hard drive or accessing the printer's internal components, which is the primary threat in an open area. While encryption and secure release are important, they do not mitigate the risk of physical theft or tampering with the storage medium.

Answer

Enable secure print release with a PIN

Answer

Encrypt the printer's hard drive

Answer

Use a cable lock on the printer

Question 17

A user reports that their Windows 10 PC is running slowly and they see many background processes in Task Manager. You need to identify which processes are consuming the most CPU and memory resources without installing any additional software. Which built-in Windows tool should you use?

Accepted Answer

Task Manager. Task Manager (Option C) is the correct built-in tool because it provides a real-time, sortable list of all running processes, displaying their CPU and memory usage directly on the Processes tab. This allows you to quickly identify which processes are consuming the most resources without needing to install additional software, as the user specifically requested.

Answer

Performance Monitor

Answer

Resource Monitor

Answer

System Configuration (msconfig)

Question 18

A user has accidentally deleted several important files from their Documents folder on their Mac running macOS Ventura. They need to recover them immediately. Which built-in macOS tool should you guide them to use first?

Accepted Answer

The Trash folder in the Dock.. When files are deleted from the Documents folder on macOS, they are first moved to the Trash, not permanently erased. The Trash folder in the Dock provides immediate access to these files, allowing the user to drag them back to their original location or use the 'Put Back' context menu option. This is the fastest and simplest recovery method before considering any backup or advanced tools.

Answer

Time Machine from the menu bar.

Answer

Terminal with the 'cd' and 'ls' commands.

Answer

System Settings > General > Storage.

Question 19

A user reports that their Android phone's battery drains rapidly after a recent app update. They have already tried restarting the device. Which of the following should a technician recommend FIRST to diagnose the issue?

Accepted Answer

Check battery usage in Settings to identify the app consuming the most power.. The first step in diagnosing rapid battery drain after an app update is to use the built-in battery usage tool in Android Settings. This tool provides a per-app breakdown of power consumption, allowing the technician to identify which specific app is consuming excessive energy without making invasive changes. Restarting the device already failed to resolve the issue, so checking battery stats is the logical next step before any destructive or restrictive actions.

Answer

Perform a factory reset.

Answer

Replace the battery immediately.

Answer

Disable all background data.

Question 20

A user on a corporate iOS device complains that they cannot install a required business app from the App Store because the device is 'supervised' and shows a message that installation is blocked. What is the most likely reason and solution?

Accepted Answer

The device has a configuration profile that disables App Store installs; update the MDM policy. The 'supervised' status on iOS devices is an MDM-enforced mode that allows granular restrictions. The error message about installation being blocked indicates a configuration profile or MDM policy specifically disables App Store installations. Updating the MDM policy to allow installs is the correct solution, as it directly addresses the restriction without compromising supervision.

Answer

The user needs to sign out of iCloud and sign back in

Answer

Perform a factory reset to remove supervision

Answer

Enable 'Allow Untrusted Shortcuts' in Settings