220-1202 Hard Questions — 25 Difficult Questions

Question 1

A technician is troubleshooting a wireless network where users report intermittent connectivity. The network uses WPA2-Enterprise with a RADIUS server. The technician notices that the RADIUS server logs show frequent authentication failures from one specific access point. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The access point's RADIUS shared secret is incorrect.. The RADIUS shared secret is a pre-shared key configured on both the access point and the RADIUS server to authenticate the AP itself. If the secret on the specific AP does not match the server's configuration, the server will reject authentication requests from that AP, causing intermittent connectivity for clients associated with it. The logs showing frequent authentication failures from one AP point directly to a mismatch in this shared secret.

Answer

The access point is using a different channel than the others.

Answer

The RADIUS server certificate has expired.

Answer

The clients are using WPA2-PSK instead of WPA2-Enterprise.

Question 2

A company is designing a secure entry for a high-security lab. They need to ensure that only one person can enter at a time and that the person must be authenticated before the second door opens. Which physical security control should be used?

Accepted Answer

Mantrap with smart card and biometric authentication. A mantrap (also called an interlocking door system) is the correct physical security control because it creates a small vestibule with two interlocking doors that prevent more than one person from entering at a time. The requirement for smart card and biometric authentication ensures that the person must be authenticated before the second door opens, providing both identity verification and access control. This design enforces a strict one-person entry sequence and prevents tailgating or piggybacking.

Answer

Turnstile with biometric reader

Answer

Security guard with logbook

Answer

Cipher lock with door alarm

Question 3

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

Accepted Answer

Use Group Policy Preferences to set the local administrator password.. Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Answer

Store the password in a plain text file and have the script read it.

Answer

Embed the password in the script using a variable and run it from a hidden share.

Answer

Use a scheduled task that runs the script as SYSTEM.

Question 4

A security incident occurred on a Windows 10 workstation where an attacker gained administrative access and created several hidden user accounts. You need to ensure no unauthorized accounts exist and that the built-in Administrator account is disabled. Which two tools can you use from the command line to list all user accounts and check the status of the Administrator account?

Accepted Answer

Use 'net user' to list accounts and 'net user Administrator | findstr /i active' to check status.. The 'net user' command lists all local user accounts on a Windows system, which is necessary to identify hidden or unauthorized accounts. Piping 'net user Administrator' through 'findstr /i active' filters the output to show whether the built-in Administrator account is enabled or disabled, as the status line contains 'Active' or 'Account active' depending on the locale. This combination directly fulfills the requirement to list all accounts and check the Administrator account's status from the command line.

Answer

Use 'whoami' to list current user and 'net localgroup Administrators' to see group members.

Answer

Use 'dir C:\Users' to list user profile folders and 'net accounts' to see password policies.

Answer

Use 'gpresult /R' to list applied policies and 'net start' to see running services.

Question 5

A company is experiencing a security incident where an attacker gained access to the internal network via a compromised VPN account. The technician must prevent future attacks. Which two-factor authentication method should the technician implement for VPN access?

Accepted Answer

Implement a time-based one-time password (TOTP) via an authenticator app. Two-factor authentication (2FA) adds a second factor beyond the password, such as a one-time code from an authenticator app. This significantly reduces the risk of account compromise even if the password is stolen.

Answer

Require a complex password with a minimum length of 20 characters

Answer

Restrict VPN access to specific IP addresses

Answer

Enable single sign-on (SSO) with Active Directory

Question 6

A user reports that their Windows 10 PC is infected with malware that keeps reinstalling after removal. You need to boot into a minimal environment to run antivirus scans without malware interference. Which advanced startup option should you use?

Accepted Answer

Safe Mode. Safe Mode (B) loads Windows with a minimal set of drivers and services, preventing malware that runs as a startup program or service from loading. This allows antivirus software to scan and remove the infection without interference, addressing the scenario where malware reinstalls after removal in a normal boot.

Answer

Enable Boot Logging

Answer

Last Known Good Configuration

Answer

Debugging Mode

Question 7

A data center manager wants to implement a physical security control that can detect if a server chassis has been opened without authorization. Which control should they use?

Accepted Answer

Chassis intrusion switch. A chassis intrusion switch is a physical security control, typically a microswitch inside the server chassis, that detects when the chassis cover is opened. Upon detection, it can trigger an alert, log an event in the system's management controller (like IPMI or BMC), or prevent the system from booting. This provides an immediate and active detection mechanism for unauthorized access. While tamper-evident seals provide visual evidence of tampering, a chassis intrusion switch offers a more direct and often automated method of detection.

Answer

Intrusion detection system (IDS) on the network

Answer

Tamper-evident seals

Answer

Video surveillance

Question 8

A technician is performing a routine software update on a finance department server. The change management documentation specifies that the update must be applied during a maintenance window from 2:00 AM to 4:00 AM. At 3:30 AM, the update fails with an error. The technician has no rollback plan documented. What should the technician do?

Accepted Answer

Leave the server in its current state and escalate the issue to the change manager.. The technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Answer

Attempt to roll back the update using the server’s built-in recovery options.

Answer

Continue troubleshooting until the maintenance window ends, then document the failure.

Answer

Reboot the server to clear the error and retry the update.

Question 9

A company is decommissioning a data center and must destroy 1000 HDDs and 200 SSDs. The policy mandates that all data be destroyed on-site and that the drives be rendered physically unusable. Which combination of methods is most efficient?

Accepted Answer

Use a hard drive shredder to shred all drives.. Shredding physically destroys both HDDs and SSDs in a single pass, meeting the policy requirement for on-site destruction and rendering drives physically unusable. Degaussing is ineffective for SSDs due to their flash memory, and overwriting is too slow for 1000 drives and also ineffective for SSDs with TRIM or wear-leveling. Shredding is the most efficient method for mixed media at scale.

Answer

Degauss all drives and then recycle them.

Answer

Overwrite all drives with a three-pass wipe.

Answer

Use a degausser for HDDs and a secure erase for SSDs.

Question 10

A user's Windows 10 laptop is experiencing random restarts, especially under heavy load like gaming or video rendering. The Event Viewer shows multiple 'Kernel-Power 41' critical errors. The CPU temperature is normal, and the power supply is functioning. Which component is most likely causing the issue?

Accepted Answer

The graphics card is overheating.. Kernel-Power 41 errors indicate unexpected shutdowns or restarts. The symptoms of random restarts specifically under heavy load like gaming or video rendering, with normal CPU temperature and a functioning power supply, strongly suggest an issue with the graphics card. Gaming and video rendering heavily utilize the GPU, and if it's overheating (which is not ruled out by the normal CPU temperature), it can cause the system to shut down or restart unexpectedly to prevent damage, leading to a Kernel-Power 41 error.

Answer

The RAM is faulty.

Answer

The motherboard is failing.

Answer

The Windows installation is corrupt.

Question 11

A system administrator needs to change the group ownership of a directory /srv/data and all its contents to 'datagroup'. Which command will accomplish this recursively?

Accepted Answer

chgrp -R datagroup /srv/data. The correct command is `chgrp -R datagroup /srv/data`. The `-R` (or `--recursive`) flag tells `chgrp` to operate on the directory and all its contents, changing the group ownership to 'datagroup'. This directly fulfills the requirement to change group ownership recursively.

Answer

chown datagroup: /srv/data

Answer

chmod -R g+rw /srv/data

Answer

groupmod -R datagroup /srv/data

Question 12

A Windows 11 workstation is infected with ransomware that encrypted user files. The IT security team wants to prevent future infections by restricting which processes can modify files in user profile folders. Which Windows security feature can enforce such restrictions without third-party software?

Accepted Answer

Controlled Folder Access. Controlled Folder Access (CFA) is a Windows Defender Exploit Guard feature that restricts which applications can modify files in protected folders, such as user profile directories. By default, CFA blocks untrusted or unknown processes from writing to or encrypting files in these folders, directly preventing ransomware from encrypting user data without requiring third-party software.

Answer

NTFS permissions set to 'Read-only' for all users.

Answer

AppLocker with a deny rule for unknown executables.

Answer

BitLocker with TPM protection

Question 13

A security incident occurs where an attacker captures the 4-way handshake of a WPA2-PSK network and successfully cracks the passphrase offline. The technician is tasked with preventing this type of attack in the future. Which protocol should the technician implement?

Accepted Answer

WPA3-SAE.. WPA3-SAE (Simultaneous Authentication of Equals) replaces the pre-shared key (PSK) model with a password-authenticated key exchange that is resistant to offline dictionary attacks. Unlike WPA2-PSK, which transmits a hash of the password in the 4-way handshake that can be captured and cracked offline, SAE uses a zero-knowledge proof protocol that prevents an attacker from deriving the password from captured handshake data, even if they have the full handshake.

Answer

WPA2-PSK with a longer passphrase.

Answer

WPA2-Enterprise with PEAP-MSCHAPv2.

Answer

WPA2-PSK with TKIP.

Question 14

A user's iPhone is running iOS 16 and they cannot update to the latest iOS 17 because the 'Software Update' section in Settings shows 'Unable to Check for Update'. The device is connected to Wi-Fi and has sufficient storage. Which advanced troubleshooting step should you take to resolve this update issue?

Accepted Answer

Use a computer with Finder (macOS) or iTunes (Windows) to download and install the update.. When an iPhone displays 'Unable to Check for Update' despite having Wi-Fi and storage, the issue often lies with the device's inability to contact Apple's update servers directly due to network restrictions or corrupted cached update data. Using a computer with Finder (macOS) or iTunes (Windows) bypasses the iPhone's over-the-air (OTA) update mechanism by downloading the full IPSW firmware directly from Apple's servers and installing it via USB, which is a standard advanced troubleshooting step for OTA update failures.

Answer

Reset All Settings from General > Reset.

Answer

Restore the iPhone using an iCloud backup.

Answer

Disable iCloud Private Relay in iCloud settings.

Question 15

During a network upgrade, a technician finds a box of old NICs, cables, and small electronic components that are no longer needed. The company has no formal e-waste policy. What should the technician do?

Accepted Answer

Research local e-waste recycling facilities and present a disposal plan to the manager for approval.. In the absence of a formal e-waste policy, the technician must act responsibly by researching local e-waste recycling facilities and presenting a disposal plan to the manager for approval. This aligns with environmental best practices and regulatory compliance, as improper disposal of electronic components can violate local laws and harm the environment. The technician should not unilaterally dispose of or sell the items without management authorization.

Answer

Throw the items in the dumpster since they are small and the company has no policy.

Answer

Store the items indefinitely in a closet until a policy is created.

Answer

Sell the items online as a lot to a recycler.

Question 16

A security incident occurred when an employee disposed of a hard drive by throwing it in the trash. The hard drive contained unencrypted customer data. Which two practices should have been followed to prevent this environmental and security breach? (Choose two.)

Accepted Answer

Degauss the hard drive before disposal.. Option A is correct because degaussing exposes the drive to a strong magnetic field that destroys the magnetic domains holding the data, rendering the hard drive's contents unrecoverable before disposal. Option B is correct because placing the drive in a secure shredding bin for e-waste ensures the media is physically destroyed by an approved vendor, preventing both data remanence and improper environmental disposal. Option C is not sufficient because a quick format only rewrites file system metadata and leaves the underlying data blocks recoverable with forensic tools. Option D is also inadequate because deleting files and emptying the Recycle Bin only removes references to the data, not the data itself, so the unencrypted customer information would still be recoverable from the discarded drive.

Answer

Perform a quick format of the drive before disposal.

Answer

Delete the files and empty the Recycle Bin.

Question 17

A technician is installing a new UPS (Uninterruptible Power Supply) in a server rack. The UPS is heavy and must be mounted securely. What is the most important safety consideration during installation?

Accepted Answer

Use a lifting team or mechanical lift to position the UPS.. The UPS is a heavy piece of equipment, and improper lifting can cause serious injury or damage. Using a lifting team or mechanical lift ensures safe handling and prevents back strain, crush injuries, or dropping the unit, which is the primary safety concern during physical installation.

Answer

Ensure the UPS is connected to a grounded outlet before mounting.

Answer

Verify that the UPS batteries are charged before installation.

Answer

Install the UPS at the top of the rack for better airflow.

Question 18

A user reports that their iPhone's flashlight is not working, and the camera app shows a black screen. Other apps function normally. The device is up-to-date and has been restarted. What is the most likely hardware-related issue?

Accepted Answer

The camera module or its flex cable is damaged.. The simultaneous failure of the flashlight and camera strongly points to a shared hardware component failure. Both the camera module and the LED flash are typically integrated on the same flex cable assembly or share a common power management IC. Since other apps function normally and the device has been restarted, a hardware fault in the camera module or its flex cable is the most likely cause.

Answer

The battery is failing and cannot provide enough power.

Answer

The camera app is corrupted; reinstall it.

Answer

The iOS has a bug that affects the camera and flashlight.

Question 19

A technician is preparing to deploy a security patch to 50 workstations. The change request has been approved, and the patch has been tested on a pilot group. During the deployment, five workstations fail to install the patch. What should the technician do next according to change management best practices?

Accepted Answer

Halt the deployment and execute the rollback plan for the failed workstations. According to change management best practices, when a deployment encounters failures, the immediate priority is to halt the deployment to prevent further issues and then execute the rollback plan to restore the failed workstations to their previous known-good state. This ensures stability and minimizes disruption, as the rollback plan was already defined and approved as part of the change request. Continuing or forcing the patch could lead to system instability or security vulnerabilities.

Answer

Continue deploying to the remaining workstations and troubleshoot the failures later

Answer

Force the patch to install using administrative tools

Answer

Submit a new change request for the failed workstations

Question 20

During a security audit, a technician finds that a user's workstation was infected with malware after the user inserted a USB drive found in the parking lot. The drive was labeled 'Employee Salary Info Q4'. What social engineering principle did the attacker exploit?

Accepted Answer

Baiting. Baiting is the correct answer because the attacker exploited the victim's curiosity by leaving a malware-infected USB drive in a visible location, labeled with an enticing message ('Employee Salary Info Q4'). When the user inserted the drive, the malware executed automatically (e.g., via Autorun.inf in Windows), compromising the workstation. This is a classic baiting attack, which relies on offering something desirable to trick the victim into performing a risky action.

Answer

Scarcity

Answer

Pretexting

Answer

Tailgating