220-1202 Hard Questions — 25 Difficult Questions

Question 1

During a routine check, a technician finds that a user's Windows 10 computer has an outdated antivirus that hasn't updated in 3 months. The user claims they never saw any update prompts. What is the most likely reason and the appropriate remediation?

Accepted Answer

The Windows Update service is disabled; re-enable it and set to automatic. Outdated antivirus often results from the update service being disabled or misconfigured. Checking the Windows Update or antivirus update service ensures that automatic updates can run, preventing future lapses.

Answer

The antivirus subscription has expired; renew it

Answer

The user has manually set the antivirus to manual update mode

Answer

The computer is infected with a virus that blocks updates

Question 2

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

Accepted Answer

Use a Group Policy to allow only the specific USB device by hardware ID, then remove the allowance after use. Group Policy can be used to block all USB storage by default, but you can create an exception by allowing specific devices via device ID or by using a more granular policy. The best approach is to temporarily grant access to the specific device, then reapply the block.

Answer

Disable the USB blocking Group Policy for the entire domain

Answer

Give the manager a company-approved USB drive and tell them to use it only once

Answer

Create a local admin account on the manager's workstation and disable the USB block locally

Question 3

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

Accepted Answer

Disable the account to prevent further access.. The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Answer

Reset the account password and enable MFA.

Answer

Review the server logs to determine the extent of the breach.

Answer

Notify the employee's manager and HR department.

Question 4

A company deploys a custom app via MDM to Android devices. Users report that the app crashes immediately upon launch. The app works fine on the developer's test device. What is the most likely cause?

Accepted Answer

The app requires a specific Android API level that is not present on the deployed devices.. App crashes on deployment often stem from missing dependencies or incompatible API levels. The most common cause is that the target devices are running an older Android version than the app's minimum SDK. The technician should check the app's manifest requirements against the device OS version.

Answer

The MDM profile is corrupt and needs to be re-pushed.

Answer

The devices have insufficient storage space.

Answer

The app is not signed with the correct enterprise certificate.

Question 5

A technician is tasked with decommissioning a server that contains a RAID array of hard drives. The drives are still functional, but the data must be securely erased. What is the most secure method to ensure data cannot be recovered?

Accepted Answer

Use a degausser to erase the magnetic data on the drives.. Degaussing destroys the magnetic field on the platters, making data unrecoverable. Physical destruction is also secure, but degaussing is the most efficient for bulk drives. Simply reformatting or overwriting may leave recoverable data.

Answer

Perform a quick format of each drive.

Answer

Overwrite the drives with zeros using a low-level format.

Answer

Physically destroy the drives with a hammer.

Question 6

A technician is installing a new UPS (Uninterruptible Power Supply) in a server rack. The UPS is heavy and must be mounted securely. What is the most important safety consideration during installation?

Accepted Answer

Use a lifting team or mechanical lift to position the UPS.. The UPS is a heavy piece of equipment, and improper lifting can cause serious injury or damage. Using a lifting team or mechanical lift ensures safe handling and prevents back strain, crush injuries, or dropping the unit, which is the primary safety concern during physical installation.

Answer

Ensure the UPS is connected to a grounded outlet before mounting.

Answer

Verify that the UPS batteries are charged before installation.

Answer

Install the UPS at the top of the rack for better airflow.

Question 7

A technician is tasked with disposing of a server that contains multiple SAS hard drives. The company's data destruction policy mandates that drives must be rendered unreadable by any means. Which combination of methods ensures compliance?

Accepted Answer

Use a degausser on each drive and then shred them.. For maximum security, physical destruction (shredding) is the most reliable method. Degaussing works for HDDs but not SSDs. Combining shredding with degaussing is redundant but ensures compliance. The correct answer involves physical destruction, as it renders the media completely unusable and data unrecoverable.

Answer

Perform a full format on each drive.

Answer

Overwrite each drive with zeros using a software tool.

Answer

Remove the drives and store them in a locked cabinet.

Question 8

A company is moving to a new office and needs to dispose of 200 fluorescent light tubes from the old ceiling fixtures. What is the legally required and environmentally responsible disposal method?

Accepted Answer

Contact a certified universal waste recycler to pick them up.. Fluorescent light tubes contain mercury, a hazardous substance, so they are classified as universal waste under the Resource Conservation and Recovery Act (RCRA). Option B is correct because certified universal waste recyclers are legally authorized to handle, transport, and recycle mercury-containing lamps, ensuring environmental compliance and safety.

Answer

Break them into small pieces and place them in a sealed bag in the trash.

Answer

Place them in the regular recycling bin for glass.

Answer

Burn them in an industrial incinerator.

Question 9

A change advisory board (CAB) approves a network switch replacement, but the technician discovers during implementation that the new switch requires a different firmware version than documented. The change plan does not include a rollback for this scenario. What is the best course of action?

Accepted Answer

Stop the implementation and contact the CAB for a revised change plan.. When an undocumented deviation occurs during a change, the technician should halt the implementation and contact the CAB for guidance. Proceeding without approval risks network instability, and the CAB can provide a revised plan or approve the firmware change.

Answer

Proceed with the firmware update and document the change afterward.

Answer

Use the old switch firmware on the new switch to match the documentation.

Answer

Implement the switch and create a separate change request for the firmware.

Question 10

A technician is performing a routine software update on a finance department server. The change management documentation specifies that the update must be applied during a maintenance window from 2:00 AM to 4:00 AM. At 3:30 AM, the update fails with an error. The technician has no rollback plan documented. What should the technician do?

Accepted Answer

Leave the server in its current state and escalate the issue to the change manager.. Option B is correct because the technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Answer

Attempt to roll back the update using the server’s built-in recovery options.

Answer

Continue troubleshooting until the maintenance window ends, then document the failure.

Answer

Reboot the server to clear the error and retry the update.

Question 11

A technician is troubleshooting a recurring network outage that occurs every Tuesday at 3 PM. After reviewing the change log, the technician finds that a scheduled backup job runs at that time. What is the best course of action?

Accepted Answer

Document the correlation and propose a change to the backup schedule.. This question tests the ability to correlate documented changes with incidents. The best action is to update the documentation to reflect the impact and then work with the change advisory board to reschedule the backup or mitigate the outage.

Answer

Disable the backup job immediately to restore network stability.

Answer

Increase the network bandwidth to accommodate the backup traffic.

Answer

Ignore the issue since the backup is a critical process.

Question 12

A company is experiencing a security incident where an attacker gained access to the internal network via a compromised VPN account. The technician must prevent future attacks. Which two-factor authentication method should the technician implement for VPN access?

Accepted Answer

Implement a time-based one-time password (TOTP) via an authenticator app. Two-factor authentication (2FA) adds a second factor beyond the password, such as a one-time code from an authenticator app. This significantly reduces the risk of account compromise even if the password is stolen.

Answer

Require a complex password with a minimum length of 20 characters

Answer

Restrict VPN access to specific IP addresses

Answer

Enable single sign-on (SSO) with Active Directory

Question 13

A security analyst discovers that an attacker has been using a compromised VPN account to access the corporate network. The account belongs to a former employee who was terminated two weeks ago. Which of the following should the analyst do immediately to prevent further unauthorized access?

Accepted Answer

Disable the former employee's VPN account. The immediate priority is to disable the compromised account to stop the attack. This is a critical security incident that requires swift action. While investigating the breach and reviewing logs are important, they come after containing the threat. Changing the VPN server password is not sufficient if the account itself is still active.

Answer

Review the VPN logs to determine the extent of the breach

Answer

Change the VPN server's shared secret

Answer

Notify the former employee about the security incident

Question 14

A company requires that all remote access sessions be recorded for compliance purposes. The current VPN solution does not support session recording. Which of the following additional technologies can be integrated to capture and store remote desktop sessions?

Accepted Answer

Implement a Remote Desktop Gateway with session recording software. A Remote Desktop Gateway (RD Gateway) can be configured to broker and log RDP sessions, and when combined with a session recording solution, it can capture all activity. VPN alone does not provide session recording, and other methods like VNC or SSH typically lack built-in recording features.

Answer

Use SSH tunneling for all remote access

Answer

Configure the VPN to use PPTP instead of L2TP

Answer

Deploy a VNC server on each remote workstation

Question 15

A technician is writing a Python script to automate the cleanup of user profiles on a Windows server. The script must iterate through all user profile folders in 'C:\Users', check the last modified date, and delete profiles older than 90 days. Which scripting concept is essential for this task?

Accepted Answer

A for loop to iterate over folders. This question tests understanding of loops, conditionals, and file system operations in a scripting language. A 'for' loop is needed to iterate through each folder, combined with an 'if' statement to check the date condition. Without a loop, the script would only process one folder. Error handling is important but not the core concept for iteration.

Answer

Error handling with try-except

Answer

A while loop with a counter

Answer

A function to calculate date difference

Question 16

A technician is troubleshooting a network issue and needs to access the user's computer remotely. The user is in a different city and speaks with a heavy accent, making communication difficult. The technician has trouble understanding the user's description of the error. What is the best approach?

Accepted Answer

Ask the user to type the error message in a chat window to avoid miscommunication.. This question tests adaptability and respectful communication when language barriers exist. The correct answer uses a collaborative, patient approach to ensure understanding without causing embarrassment.

Answer

Speak slowly and loudly, repeating each question until the user understands.

Answer

Ask the user to transfer the call to a colleague who speaks English more clearly.

Answer

Proceed with remote access without further communication, assuming you can diagnose the issue visually.

Question 17

You are troubleshooting a Windows 10 PC that fails to boot with the error 'Boot Configuration Data is missing.' Which built-in tool can you use from the Windows Recovery Environment to rebuild the BCD store?

Accepted Answer

Bootrec.exe. Bootrec.exe is the correct built-in tool for rebuilding the Boot Configuration Data (BCD) store from the Windows Recovery Environment (WinRE). The specific command 'bootrec /rebuildbcd' scans all disks for Windows installations and allows you to rebuild the BCD store, directly addressing the 'Boot Configuration Data is missing' error. Other tools like SFC, Diskpart, and CHKDSK do not have the capability to reconstruct the BCD store.

Answer

System File Checker (sfc /scannow)

Answer

Diskpart

Answer

CHKDSK

Question 18

A technician needs to deploy a custom Windows 10 image to 50 identical workstations. The image must include specific drivers, applications, and settings. Which tool should the technician use to create and manage the deployment image?

Accepted Answer

System Preparation Tool (Sysprep). System Preparation Tool (Sysprep) is used to generalize a Windows installation so it can be imaged and deployed to multiple computers. DISM is used to capture and apply images, but Sysprep is required to prepare the OS for imaging. Windows PE is a minimal OS for deployment tasks, not for creating the image. Windows ADK includes deployment tools but Sysprep is the specific tool for image preparation.

Answer

Deployment Image Servicing and Management (DISM)

Answer

Windows Preinstallation Environment (Windows PE)

Answer

Windows Assessment and Deployment Kit (Windows ADK)

Question 19

A user is unable to change their desktop background because the option is grayed out. You suspect a Group Policy setting is enforcing a specific wallpaper. Which Control Panel tool would you use to check if a Group Policy is applied, and what is the specific path to verify this setting?

Accepted Answer

Administrative Tools > Local Security Policy. The Administrative Tools in Control Panel provides access to 'Local Security Policy' or 'Group Policy Management' for advanced users. However, the quickest way to check applied policies is to run 'rsop.msc' from the Run dialog, which is not in Control Panel. The correct answer tests knowledge that Administrative Tools contains shortcuts to policy editors, but the specific tool is not directly in Control Panel. The best choice is Administrative Tools > Local Security Policy or Group Policy Editor, depending on Windows edition.

Answer

System > Advanced system settings > Performance

Answer

Personalization > Background

Answer

Ease of Access Center > Make the computer easier to see

Question 20

A user reports that they cannot install a signed driver for a new graphics card because Windows displays a 'Windows can't verify the publisher of this driver software' error. You need to adjust the driver signing enforcement settings to allow installation. Which Control Panel tool allows you to change driver signing behavior?

Accepted Answer

System > Advanced system settings > Hardware > Device Installation Settings. The System applet's 'Advanced system settings' includes a 'Hardware' tab with 'Device Installation Settings'. However, driver signing enforcement is configured via 'Startup and Recovery' or by using the 'bcdedit' command. The correct answer is System > Advanced system settings > Hardware > Device Installation Settings, which lets you choose whether to automatically download drivers and allow unsigned drivers.

Answer

Device Manager

Answer

Programs and Features > Turn Windows features on or off

Answer

Administrative Tools > Services