220-1102 Exam Questions and Answers

Check RAM usage in Task Manager

Task Manager shows real-time physical memory utilization under the Performance tab, as well as per-process memory columns under the Processes tab, which directly tells the technician whether the system is running out of RAM or a single application is monopolizing memory. By sorting processes by the Memory column, the technician can immediately identify the culprit and decide whether to close the application, update it, or recommend a hardware RAM upgrade. This objective data is the essential first step in the troubleshooting process, as it distinguishes between a true low-memory condition and other problems that might present similar symptoms like sluggishness.

GPT

GPT is the standard partition table for UEFI systems. It uses 64-bit logical block addressing, supports disks larger than 2 TiB, and includes a dedicated EFI System Partition (ESP) formatted as FAT32 where UEFI firmware locates bootloaders. Both Windows 10 and Linux distributions support installing to GPT disks, and Secure Boot relies on GPT-based UEFI firmware, making GPT the required choice here.

dism /online /cleanup-image /restorehealth

DISM with /restorehealth checks the component store for corruption and repairs it using Windows Update or a local source. This addresses the root cause of many Windows Update failures and is the appropriate next step after the troubleshooter.

chmod 750 script.sh

chmod 750 is correct because the numeric mode 7 (owner) grants read, write, and execute; 5 (group) grants read and execute; and 0 (others) removes all permissions. This precisely matches the requirement that only the owner has full control, the group can read/execute the script, and no other users have any access. The execute bit on the group is appropriate for a script that needs to be run, while the zero for others ensures they cannot even read the file's contents.

Join the computer to the domain and allow domain user logins.

Domain joining integrates the Windows 10 client with Active Directory, allowing users to authenticate with their existing domain credentials. On first sign-in, Windows automatically provisions a local profile for that domain user, and optional Folder Redirection or Roaming Profiles make settings and files follow the user across machines. Centralized Group Policy also enforces security and configuration baselines, making this the only option that satisfies both individualization and centralized administration.

The User Accounts tool (netplwiz)

The User Accounts tool (netplwiz) is the supported Microsoft GUI for configuring automatic logon. In its 'Users' tab, clearing the checkbox labeled 'Users must enter a user name and password to use this computer' and then entering the intended account's password twice causes Windows to securely populate the underlying Winlogon registry values (AutoAdminLogon, DefaultUserName, DefaultPassword, DefaultDomainName). This method offloads the correct handling of credentials and avoids the brittleness of manually setting registry entries; it is accessible from both the Control Panel and the command-line shortcut 'control userpasswords2'.

Ransomware

Ransomware is specifically constructed to disable or evade security software, encrypt the victim's files or even whole volumes, and then display an extortion note demanding payment for the decryption key. Modern ransomware often terminates antivirus processes and clears shadow copies to make file recovery impossible without paying, which matches the user's report exactly. The dual symptom set of disabled security tools and encrypted files is the classic, high-confidence signature of a ransomware attack, distinguishing it clearly from Trojans, worms, and rootkits.

Disconnect the affected system from the network immediately.

Disconnecting the affected system from the network is the essential first step in incident response because it immediately halts propagation across SMB, mapped drives, and administrative shares. This action also cuts off the ransomware's command-and-control communication, preventing the attacker from issuing new instructions or exfiltrating data. Physically unplugging the network cable or disabling the wireless adapter is preferred over software-based disconnection, as a compromised system may ignore or spoof such commands. This containment step preserves evidence and minimizes the blast radius before any detection or recovery attempts.

Forward the email to the bank's official customer service or security team

Forwarding the email to the bank's official customer service or security team is the correct response because it provides the bank's incident responders with the raw phishing content, including headers that help identify the sending infrastructure. It is critical to use contact information from the bank's official website—not from the email—to ensure the report reaches the legitimate team. This action supports coordinated remediation such as blocking the malicious domain, issuing customer alerts, and initiating a takedown, which protects other customers from the same attack.

Run a network packet capture to analyze the traffic content.

Running a network packet capture with a tool such as Wireshark or tcpdump provides a detailed view of the actual data being transmitted, including packet payloads, protocol headers, and destination IP address responses. This allows you to identify whether the outbound traffic is command-and-control beaconing, data exfiltration, or an application acting abnormally, and it preserves volatile evidence in real time. As the best investigative step, packet capture gives you the ground truth needed to determine the nature of the communication and to guide subsequent containment or remediation.

Malware is disabling the DHCP client service to block internet access as part of a scareware campaign.

Scareware commonly disrupts network access to manufacture a crisis that the malware then offers to 'fix' for a fee. By stopping or disabling the DHCP Client service (DHCPSVC), the network interface can no longer request a lease; Windows then auto-configures an APIPA address in the 169.254.0.0/16 range, producing the 'Limited connectivity' state. At the same time, the malware displays a fake Windows Security alert demanding immediate action, which perfectly matches the reported symptom of no network access plus a popup.

Implement an IPsec policy on the workstation to encrypt all network traffic.

IPsec operates at the network layer (Layer 3), so it encrypts all IP-based traffic from the workstation, regardless of the application protocol used by the legacy software. Because it is enforced at the OS or policy level, it can be applied without modifying the application, and it protects against data interception on the LAN. A persistent IPsec policy via Group Policy or local security policy ensures encryption is always active.

Boot into Safe Mode and roll back the printer driver.

Booting into Safe Mode loads only the minimal set of generic drivers, which prevents the newly installed printer driver from being loaded during startup, so the system becomes stable enough to open Device Manager. From the printer's Properties, the Driver tab provides a Roll Back Driver button that reinstalls the previous driver version that worked before the crash. Rolling back the specific driver is the direct reversal of the change that caused the bugcheck, making it the most targeted and immediate solution.

The BIOS boot order has changed due to the power outage.

During a power outage, the CMOS battery can be depleted or the CMOS contents can be cleared, causing the BIOS/UEFI to reset to factory defaults and change the boot device priority. If the hard drive with Windows is no longer first in the boot order, the firmware may attempt to boot from a non-bootable USB, optical disc, or network adapter, resulting in 'Invalid system disk' on a Windows 10 machine. This is the most plausible explanation because the error disappears once the correct disk is reselected in the BIOS boot menu.

Check the disk space on the network drive.

Saving to a network share requires the remote file system to allocate space for the new file; if the network volume is full or the user has reached a quota limit, the SMB server rejects the write even though the share appears accessible and local saves work. This is a frequent root cause of application-specific save failures, and a technician can quickly verify it by checking the share's properties, using `fsutil volume diskfree` on the server, or reviewing the user's quota from the file server. It is a fast, non-destructive diagnostic that directly addresses the difference between local and remote save behavior.

Use the Open and Repair feature in Word to attempt to recover the file.

The Open and Repair feature in Word invokes a built-in recovery engine that parses the OOXML structure of the document, identifies damaged parts such as document.xml or relationship feeds, and attempts to reconstruct a readable version. When Word crashes only for a specific .docx and safe mode confirms other files open, the file's internal integrity is the prime suspect; Open and Repair is the targeted solution designed for exactly this scenario. It prioritizes salvaging content, with fallback to extracting raw text if full recovery is impossible.

Run SFC /scannow

SFC /scannow is the correct first step because it verifies the integrity of all protected system files and replaces corrupted or missing versions from the Windows component store (WinSxS). A missing DLL error often indicates that a critical system component or dependency has been damaged, not that the application itself is broken. SFC is non-invasive, preserves user data and installed applications, and directly targets the root cause if the DLL belongs to the OS or a shared runtime.

Reliability Monitor

Reliability Monitor records system and application failures with detailed error information, making it ideal for identifying the crashing application.

Use a degausser to demagnetize the platters.

A degausser exposes the hard drive platters to a powerful alternating magnetic field that randomizes or cancels the magnetic domains, effectively destroying the stored data along with the drive's servo tracks and structural alignment. This renders the drive unusable and the data unrecoverable, even by specialized forensic equipment. It is the industry-standard method for confidentially disposing of magnetic media such as HDDs and tapes, though it does not work on SSDs.

Take them to an e-waste recycling center

Taking the equipment to a dedicated e-waste recycling center is the most responsible and compliant disposal method. These facilities are specifically permitted to process toxic electronic components and typically follow certified standards such as R2 or e-Stewards, ensuring safe dismantling, proper segregation of hazardous waste, and responsible downstream management. They also have robust data sanitization or physical destruction protocols, addressing both ecological and security concerns. In contrast to landfill disposal or partial metal recovery, e-waste centers maximize material recovery while minimizing environmental harm.

Physically destroying the hard drive platters.

Physically destroying the hard drive platters is the most reliable and definitive method for ensuring that data cannot be recovered, as it eliminates the storage medium itself. Techniques such as shredding, drilling through the platters, or disintegrating the drive render the magnetic layers unreadable and make any forensic reconstruction infeasible. This approach aligns with the highest level of security in data disposal (e.g., NIST SP 800-88), which recommends device destruction for media containing sensitive data. Once the physical structure of the platters is compromised, no software or hardware recovery method can retrieve the data, guaranteeing complete data destruction.

Recycle them through an approved electronics recycling vendor or battery drop-off program.

Approved e-waste recycling vendors and battery drop-off programs are the correct route because they safely manage hazardous components in accordance with regulations such as the Resource Conservation and Recovery Act (RCRA). These programs sort chemistries, stabilize or neutralize reactive materials, and recover valuable metals (lithium, cobalt, nickel) for reuse, preventing both environmental contamination and the risk of landfill fires. Many states mandate take-back programs, so using an authorized recycler also ensures legal compliance.

Submit a request to deploy a permanent fix through the change control process

Submitting a request to deploy a permanent fix is the correct next step because change management requires that any modification to the production environment go through documented review, approval, and scheduling. The RFC must include the technical details, risk assessment, rollback plan, and testing results so the Change Advisory Board can approve it with confidence. With a workaround already in place, the fix can follow the standard change path rather than an emergency process.

Submit a change request to the change control board and develop a backout plan.

Submitting a change request to the change control board (CCB) ensures the patch is formally assessed for risk, impact, and required testing before touching production. Developing a backout plan is equally critical because it provides a documented, step-by-step method to revert the server to its prior state if the patch fails or causes unforeseen issues. This approach complies with change management best practices and protects the legacy server's stability while still addressing the security vulnerability.