220-1202 Multiple Select — 10 Questions

Question 1

A security incident occurred when an employee disposed of a hard drive by throwing it in the trash. The hard drive contained unencrypted customer data. Which two practices should have been followed to prevent this environmental and security breach? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Degauss the hard drive before disposal.. Option A is correct because degaussing exposes the drive to a strong magnetic field that destroys the magnetic domains holding the data, rendering the hard drive's contents unrecoverable before disposal. Option B is correct because placing the drive in a secure shredding bin for e-waste ensures the media is physically destroyed by an approved vendor, preventing both data remanence and improper environmental disposal. Option C is not sufficient because a quick format only rewrites file system metadata and leaves the underlying data blocks recoverable with forensic tools. Option D is also inadequate because deleting files and emptying the Recycle Bin only removes references to the data, not the data itself, so the unencrypted customer information would still be recoverable from the discarded drive.

Answer

Perform a quick format of the drive before disposal.

Answer

Delete the files and empty the Recycle Bin.

Question 2

A technician is troubleshooting a Windows 10 workstation that fails to boot. The technician suspects a problem with the boot configuration data (BCD). Which two commands can be used to rebuild the BCD? (Choose two.)

Accepted Answer

bootrec /rebuildbcd. The two commands that rebuild the BCD are bootrec /rebuildbcd and bcdboot. bootrec /rebuildbcd scans for Windows installations and rebuilds the BCD store, while bcdboot creates or repairs the BCD and boot files from a specified Windows directory. The other commands either back up, fix the boot sector, or fix the MBR, but do not rebuild the BCD.

Answer

bootrec /fixboot

Answer

bootrec /fixmbr

Answer

bcdedit /export

Question 3

A technician is preparing to dispose of several old hard drives that contain sensitive company data. The organization's data destruction policy requires physical destruction. Which of the following methods are appropriate for physically destroying the drives? (Choose two.)

Accepted Answer

Incineration. Shredding and incineration are both physical destruction methods that render the drive unusable and data unrecoverable. Degaussing, overwriting, and low-level formatting are logical or magnetic erasure methods that do not physically destroy the media. Therefore, only shredding and incineration satisfy the policy requirement for physical destruction.

Answer

Low-level formatting

Answer

Overwriting

Answer

Degaussing

Question 4

A technician is troubleshooting a Windows 10 workstation that frequently becomes unresponsive. The user reports that the system slows down dramatically after a few hours of use, and the technician suspects a memory leak or resource exhaustion. The technician opens Task Manager and switches to the Performance tab. Which two counters should the technician monitor to confirm the suspicion? (Choose two.)

Accepted Answer

Memory usage percentage. Memory usage percentage and available memory are the two counters that directly reflect physical memory consumption and availability. A memory leak causes memory usage to climb and available memory to shrink over time, matching the reported slowdown. CPU utilization, disk queue length, and GPU usage can be affected indirectly but do not confirm memory exhaustion as directly as the memory-specific counters.

Answer

Disk queue length

Answer

CPU utilization

Answer

GPU usage

Question 5

A technician is preparing to replace a failed hard drive in a user's desktop PC. The drive contains sensitive company data. The technician wants to ensure proper disposal of the old drive and maintain data security. Which of the following TWO actions should the technician take? (Choose two.)

Accepted Answer

Use a software tool to perform a secure erase or wipe.. The correct actions are to physically destroy the drive or use a software tool to perform a secure erase/wipe. Both methods ensure that sensitive data cannot be recovered. Standard format, partition deletion, or storage alone do not provide adequate data sanitization. These steps align with data security best practices for storage media disposal.

Answer

Run a standard format on the drive before disposal.

Answer

Delete all partitions and recreate a single empty partition.

Answer

Store the drive in a secure cabinet until it can be reused.

Question 6

A technician is preparing to replace a faulty power supply in a desktop computer. Which of the following safety precautions should the technician take? (Choose two.)

Accepted Answer

Disconnect the power cord from the wall outlet before opening the case.. Disconnecting the power cord and wearing an antistatic wrist strap are essential safety precautions when working inside a computer. These steps prevent electric shock and electrostatic discharge, protecting both the technician and the components. The other options introduce risks such as magnetic interference, electrical hazards, or static buildup.

Answer

Leave the power cord connected but turn off the power supply switch.

Answer

Use a magnetic screwdriver to retrieve screws from inside the power supply.

Answer

Work on a carpeted floor to cushion the components.

Question 7

A technician is troubleshooting a Windows 10 workstation that is exhibiting symptoms of a malware infection. The technician has already disconnected the computer from the network. Which of the following should the technician do next to remediate the infection? (Choose two.)

Accepted Answer

Run a full antivirus scan using updated definitions.. After isolating the infected system, the technician should run a full antivirus scan with updated definitions to detect and remove malware. Additionally, booting into Safe Mode and using specialized removal tools helps eliminate persistent infections that might resist normal removal. These two actions directly address the malware, while other options are either preventive, premature, or not directly remedial.

Answer

Enable System Restore and create a restore point.

Answer

Reimage the computer immediately without attempting removal.

Answer

Educate the user on safe browsing habits.

Question 8

A security administrator is reviewing authentication methods for a company that wants to reduce the risk of credential theft while allowing employees to log in from personal mobile devices. Which two of the following should the administrator implement? (Choose two.)

Accepted Answer

Biometric authentication. MFA and biometric authentication both add factors that a stolen password alone cannot satisfy, directly reducing the risk of credential theft. SSO, password managers, and RBAC are useful but do not prevent an attacker with stolen credentials from logging in. The administrator should implement MFA and biometric authentication to strengthen login security for personal mobile devices.

Answer

Role-based access control (RBAC)

Answer

Single sign-on (SSO)

Answer

Password manager

Question 9

A user's Windows 10 laptop has become increasingly slow over the past month. The hard drive activity light is constantly on, and the system often freezes for several seconds. A technician suspects the issue is related to a failing hard disk drive (HDD). Which two of the following should the technician perform to confirm the diagnosis? (Choose two.)

Accepted Answer

Check the S.M.A.R.T. status using a diagnostic tool.. To confirm a failing HDD, the technician should check S.M.A.R.T. data for warning signs and run chkdsk /r to scan for and recover bad sectors. These tools directly assess the drive's health and can reveal physical errors, unlike defragmentation, memory testing, or disk cleanup, which address other issues.

Answer

Use Disk Cleanup to remove temporary files.

Answer

Run the Windows Memory Diagnostic tool.

Answer

Defragment the hard drive using the built-in Windows tool.

Question 10

A technician is troubleshooting a Windows 11 desktop that randomly freezes and displays a blue screen with the stop code DRIVER_IRQL_NOT_LESS_OR_EQUAL. The technician suspects a recently updated device driver. Which two tools or artifacts should the technician examine to identify the offending driver? (Choose two.)

Accepted Answer

The memory dump file analyzed with WinDbg. The memory dump analyzed with WinDbg names the faulting module directly, and Driver Verifier forces the misbehaving driver to crash deterministically so it can be identified. Together they move the investigation from a general bug check to a specific driver file that can be updated, rolled back, or removed.

Answer

Reliability Monitor

Answer

Event Viewer's System log

Answer

Performance Monitor's counter logs