220-1202 Windows Command-Line Tools Practice Test 2 — 15 Questions

Question 1

A user reports that their Windows 10 computer is infected with ransomware that has encrypted their files. The technician boots into the Windows Recovery Environment and wants to restore the system to a previous restore point. Which command should be used?

Accepted Answer

rstrui.exe. The correct answer is `rstrui.exe`, which launches the System Restore wizard. This can revert system files and settings to a previous state. `vssadmin` manages shadow copies but does not directly restore, `wbadmin` is for backup and restore, and `bootrec` repairs boot issues.

Answer

vssadmin list shadows

Answer

wbadmin start recovery

Answer

bootrec /fixboot

Question 2

During a security audit, you discover that a user's workstation has an unauthorized application running. You need to terminate the process immediately from the command line. The process name is 'malware.exe'. Which command should you use?

Accepted Answer

taskkill /IM malware.exe /F. The correct answer is `taskkill /IM malware.exe /F`. This forcefully terminates the process by image name. `tasklist` only lists processes, `net stop` stops services (not processes), and `shutdown` restarts the computer.

Answer

tasklist /FI "IMAGENAME eq malware.exe"

Answer

net stop malware

Answer

shutdown /r /t 0

Question 3

A technician needs to configure a Windows 10 computer to use a static IP address of 192.168.1.100 with subnet mask 255.255.255.0 and default gateway 192.168.1.1. Which command-line tool and syntax should be used?

Accepted Answer

netsh interface ip set address "Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1. The correct answer is `netsh interface ip set address "Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1`. This sets a static IP with the specified parameters. `ipconfig` is used for display, `netstat` for connections, and `ping` for testing.

Answer

ipconfig /setaddress 192.168.1.100

Answer

netstat -r

Answer

ping 192.168.1.1

Question 4

A technician needs to deploy a software update to 100 computers in a domain. The update requires administrative privileges. The technician wants to run the installer silently without user interaction. Which command-line syntax should be used?

Accepted Answer

msiexec /i update.msi /quiet /norestart. The correct answer is `msiexec /i update.msi /quiet /norestart`. This installs the MSI silently without prompting the user. `/passive` shows a progress bar, `/qb` shows a basic UI, and `/l*` creates a log file but does not suppress UI.

Answer

msiexec /i update.msi /passive

Answer

msiexec /i update.msi /qb

Answer

msiexec /i update.msi /l* log.txt

Question 5

A user reports that their Windows 10 PC is running very slowly, and they suspect a background process is consuming too much memory. Which command-line tool would you use from an elevated command prompt to identify the process with the highest memory usage?

Accepted Answer

tasklist /FI "MEMUSAGE gt 100000". The correct answer is tasklist, which displays a list of running processes along with memory usage. You can sort the output by memory to quickly find the culprit. This is a fundamental command for identifying resource-hungry processes.

Answer

ipconfig /all

Answer

chkdsk /f

Answer

sfc /scannow

Question 6

A user reports that their Windows 10 PC is running slowly and they suspect a background process is consuming too much memory. You need to identify the process and its memory usage without installing any additional tools. Which command-line tool should you use?

Accepted Answer

tasklist. The tasklist command displays a list of running processes along with memory usage (in kilobytes) directly from the command prompt. It is a built-in Windows tool, so no extra software is needed. Other options either do not show process details or require additional tools.

Answer

ipconfig

Answer

chkdsk

Answer

sfc /scannow

Question 7

During a security audit, you need to identify all user accounts that have been created or modified in the last 24 hours on a Windows Server. Which command-line tool can parse security event logs to extract this information?

Accepted Answer

wevtutil qe Security /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]". The wevtutil command can query event logs using structured XML queries, allowing you to filter events by time and ID (e.g., 4720 for user creation). It is a powerful tool for log analysis. Other commands either display logs without filtering or manage disk partitions.

Answer

eventvwr

Answer

net user

Answer

diskpart

Question 8

A customer complains that their Windows 11 laptop cannot connect to the internet, but other devices on the same network work fine. You suspect the IP configuration is incorrect. Which command will release and renew the IP address from the DHCP server?

Accepted Answer

ipconfig /release then ipconfig /renew. The ipconfig /release command releases the current DHCP lease, and ipconfig /renew requests a new IP address from the DHCP server. This is the standard troubleshooting sequence for IP configuration issues. Other commands either display information or flush DNS, which does not address the IP lease issue.

Answer

ipconfig /flushdns

Answer

ipconfig /all

Answer

ping 127.0.0.1

Question 9

A technician is troubleshooting a Windows 11 system that intermittently loses network connectivity. They need to continuously monitor the connection to a remote server and log the results to a text file for analysis. Which command should they use?

Accepted Answer

ping -t > log.txt. The ping -t command sends continuous ICMP echo requests until stopped, and appending > log.txt redirects output to a file. This allows for long-term monitoring of connectivity. Other commands either perform a single test or trace the route.

Answer

ping -n 100 > log.txt

Answer

tracert -d > log.txt

Answer

pathping > log.txt

Question 10

A security incident is suspected on a Windows 10 workstation. You need to list all active network connections and the associated processes to identify potential malicious activity. Which command provides this information?

Accepted Answer

netstat -b. The netstat -b command displays active connections along with the executable involved in creating each connection, making it ideal for identifying suspicious processes. Other options either show process information without network details or vice versa.

Answer

netstat -a

Answer

tasklist /svc

Answer

ipconfig /displaydns

Question 11

A user reports that they cannot access a shared folder on a file server. You suspect the network path is incorrect or the share is unavailable. Which command can you use to test connectivity to the server and the share simultaneously?

Accepted Answer

net view \ServerName. The net view command lists available shared resources on a specified server, allowing you to verify both network connectivity and share availability. It is a quick diagnostic tool for shared folder issues. Other commands either test basic connectivity or map drives but do not list shares.

Answer

ping \ServerName

Answer

net use Z: \ServerName\Share

Answer

tracert \ServerName

Question 12

During a software deployment, you need to copy a configuration file from a network share to multiple workstations. The command must run silently and overwrite existing files. Which command should you use?

Accepted Answer

xcopy /y. The xcopy command with the /y switch suppresses the prompt to confirm overwriting, and /s copies directories and subdirectories (if needed). It is designed for file copying with advanced options like silent overwrite. Other commands either do not copy files or lack the silent overwrite feature.

Answer

copy /y

Answer

move /y

Answer

robocopy /mir

Question 13

After deploying a group policy update, several users report that their mapped network drives are missing. You need to force an immediate refresh of group policy settings on a remote workstation without rebooting. Which command should you run?

Accepted Answer

gpupdate /force. The gpupdate /force command forces an immediate refresh of all group policy settings, including drive maps, without requiring a reboot. It is the standard tool for applying policy changes on Windows. Other commands either manage user accounts or network configurations.

Answer

net use

Answer

gpresult

Answer

nslookup

Question 14

A technician is troubleshooting a Windows 10 system that fails to boot with a 'Bootmgr is missing' error. They need to repair the boot configuration data (BCD) from the Windows Recovery Environment. Which command should they use?

Accepted Answer

bootrec /rebuildbcd. The bootrec /rebuildbcd command scans all drives for Windows installations and rebuilds the Boot Configuration Data store. This is the standard recovery command for missing or corrupt BCD. Other commands either fix the master boot record or system files, not the BCD specifically.

Answer

bootrec /fixmbr

Answer

bootrec /fixboot

Answer

sfc /scannow

Question 15

You are deploying a new application to multiple Windows 10 workstations using a script. The application requires administrator privileges, and you need to run the command with elevated rights from within the script. Which command should precede your installation command?

Accepted Answer

runas /user:Administrator. The runas command allows you to run a program with different credentials, such as an administrator account, from the command line. It is the standard way to elevate privileges in a script. Other commands either manage user accounts or change directories.

Answer

net user

Answer

cd

Answer

whoami