220-1102 Practice Test 19 — 15 Questions

Question 1

A user reports that their computer is infected with a virus and they have been trying to remove it using a free online scanner, but the problem persists. The technician suspects the malware may have disabled the antivirus software. Which safe mode should the technician use to run a full system scan?

Accepted Answer

Safe Mode with Networking. Safe Mode with Networking (C) is correct because it loads only essential drivers and services, including network components, which allows the technician to run a full system scan while the malware is likely inactive. Since the malware may have disabled the antivirus software in normal mode, booting into Safe Mode with Networking ensures the antivirus can run and still access the internet for signature updates or cloud-based scanning.

Answer

Safe Mode

Answer

Safe Mode with Command Prompt

Answer

Last Known Good Configuration

Question 2

During a routine security audit, a technician discovers that a user's computer has a program that opens a backdoor on port 4444 and allows remote control. The program was installed alongside a free PDF converter the user downloaded last week. Which malware type is this, and what is the most effective removal method?

Accepted Answer

Trojan horse; boot into Safe Mode and run a full anti-malware scan.. The program is a Trojan horse because it disguises itself as a legitimate PDF converter while secretly installing a backdoor. The most effective removal method is to boot into Safe Mode, which loads only essential drivers and services, preventing the Trojan from running, and then perform a full anti-malware scan to detect and remove the malicious files.

Answer

Worm; use a network-based firewall to block port 4444.

Answer

Ransomware; pay the ransom to regain control.

Answer

Rootkit; perform a clean installation of Windows.

Question 3

A user reports that their web browser's homepage has changed to an unfamiliar search engine, and new toolbars have appeared without their consent. They have not installed any new software recently. Which type of malware is most likely responsible?

Accepted Answer

Browser hijacker. The symptoms—unwanted homepage changes, unfamiliar search engine, and new toolbars—are classic signs of a browser hijacker. This malware modifies browser settings (e.g., via registry keys or extension policies) without user consent, often bundled with freeware or installed through drive-by downloads. Unlike other malware types, it specifically targets the browser's configuration to redirect traffic and generate ad revenue.

Answer

Trojan horse

Answer

Worm

Answer

Ransomware

Question 4

A small business owner reports that all their employees are receiving emails from each other containing a link that, when clicked, downloads a file that installs a program that spreads to other contacts. The emails appear to come from known senders. What type of malware is this?

Accepted Answer

Worm. The correct answer is B (Worm) because the malware self-replicates by sending copies of itself via email to all contacts without requiring user action beyond clicking the link. Unlike a virus, it does not need to attach to a host file; it spreads autonomously over the network using the email system as a transport mechanism.

Answer

Virus

Answer

Trojan horse

Answer

Rootkit

Question 5

A user reports that their computer is infected with a virus that has encrypted all their personal files and left a text file with instructions to pay a ransom. The technician has verified the infection is ransomware. The company has a backup policy. What is the best course of action to recover the data?

Accepted Answer

Restore the files from a recent backup after removing the malware.. Option C is correct because the company has a backup policy, meaning a recent, clean backup should exist. Restoring from backup after removing the ransomware ensures data recovery without paying criminals or relying on unreliable decryption tools. This aligns with best practices for ransomware incidents: isolate, remove, then restore from verified backups.

Answer

Pay the ransom and hope the decryption key is provided.

Answer

Use a ransomware decryption tool from a reputable source.

Answer

Reinstall the operating system and hope the files become accessible.

Question 6

A technician is troubleshooting a user's slow computer. The user mentions they received a call from 'Windows Support' saying their computer had a virus. The user gave the caller remote access to 'fix' it. Now, the computer is running slower and has strange pop-ups. What is the most likely consequence of this social engineering attack?

Accepted Answer

The attacker installed a keylogger to steal credentials and sensitive data.. The attacker gained remote access to the user's computer under the guise of tech support. Once in, they installed a keylogger to capture keystrokes, which is a common payload in such social engineering attacks. This allows the attacker to steal credentials, banking information, and other sensitive data, explaining the continued slow performance and pop-ups.

Answer

The computer is now part of a botnet used for DDoS attacks.

Answer

The computer's BIOS has been corrupted.

Answer

The hard drive has been physically damaged.

Question 7

A technician receives an email from what appears to be the company's CEO, asking for a list of all employee passwords for a 'security audit'. The email address is correct, but the tone and request are unusual. The technician suspects a social engineering attack. What is the best course of action?

Accepted Answer

Forward the email to the security team and do not respond.. Option B is correct because forwarding the email to the security team ensures that the incident is handled by the appropriate personnel who can investigate the potential phishing or social engineering attack without engaging the attacker. Responding to the email, even for confirmation, could validate the technician's email address as active and potentially expose the organization to further attacks. The security team can analyze headers, links, and attachments using tools like email security gateways or SIEM systems to determine the legitimacy of the request.

Answer

Reply to the email asking for more details to confirm the request.

Answer

Provide the list as requested, since the CEO has authority.

Answer

Call the CEO immediately to verify the request.

Question 8

A user calls the help desk claiming they received an urgent email from the CEO asking them to purchase gift cards for a client and reply with the codes. The user is suspicious because the email address looks slightly off. What type of social engineering attack is this?

Accepted Answer

Phishing. This is a phishing attack because the attacker impersonates a trusted entity (the CEO) via email to trick the user into performing a fraudulent action (purchasing gift cards and sharing codes). The suspicious email address indicates a spoofed sender, a common phishing technique that exploits trust and urgency to bypass user skepticism.

Answer

Shoulder surfing

Answer

Tailgating

Answer

Dumpster diving

Question 9

During a security audit, a technician discovers that an unauthorized person accessed a restricted server room by pretending to be a fire inspector. The person had a fake ID and clipboard. Which social engineering technique was used, and what is the best mitigation?

Accepted Answer

Pretexting; enforce visitor check-in and verification procedures.. The attacker used a fabricated identity (fake ID and clipboard) to create a false scenario—pretending to be a fire inspector—which is the hallmark of pretexting. The best mitigation is to enforce visitor check-in and verification procedures, such as requiring government-issued ID validation and escort policies, to prevent unauthorized access based on fabricated roles.

Answer

Tailgating; install mantraps at entrances.

Answer

Phishing; implement email filtering.

Answer

Baiting; disable USB ports on workstations.

Question 10

During a printer toner replacement, a technician accidentally spills toner powder on the carpet. What is the proper cleanup procedure?

Accepted Answer

Blot the toner with a cold, damp cloth and then use a HEPA-filter vacuum.. Option C is correct because toner powder is extremely fine and can become airborne if mishandled. Blotting with a cold, damp cloth prevents the toner from spreading, and using a HEPA-filter vacuum ensures that microscopic toner particles are trapped without being exhausted back into the environment. Standard vacuum cleaners lack HEPA filtration and can release toner dust into the air, causing respiratory hazards.

Answer

Use a vacuum cleaner with a standard bag to suck up the toner.

Answer

Wipe the toner with a damp cloth using hot water.

Answer

Sweep the toner into a dustpan and dispose of it in the trash.

Question 11

A user reports that their Windows 10 laptop takes an unusually long time to boot and frequently shows a 'Preparing Automatic Repair' screen before finally loading the desktop. Which Windows tool should be used first to diagnose and potentially fix the boot process?

Accepted Answer

Run the System File Checker (SFC) from an elevated Command Prompt.. The 'Preparing Automatic Repair' loop and slow boot often indicate corruption in critical boot files, such as the Boot Configuration Data (BCD) or system files. Running System File Checker (SFC) from an elevated Command Prompt scans and repairs protected system files, addressing the root cause without data loss. This is the first-line diagnostic tool for boot integrity issues before escalating to more destructive methods.

Answer

Perform a full system restore from a backup made last month.

Answer

Use the Disk Cleanup tool to remove temporary files.

Answer

Reinstall Windows using the 'Reset this PC' option.

Question 12

A technician is troubleshooting an Android phone that cannot send or receive SMS messages, but can make and receive calls and use mobile data. The phone is on a corporate plan with a new SIM card. What is the most likely cause?

Accepted Answer

The SMS message center number is incorrect or missing.. The SMS message center number (SMSC) is a required parameter stored on the SIM card or phone that tells the device where to route outgoing SMS messages for delivery. If this number is incorrect or missing, the phone cannot send or receive SMS, but voice calls and mobile data remain unaffected because they use separate signaling paths (CSFB for calls and packet-switched data for mobile data). A new SIM card may have a misconfigured or missing SMSC, which is the most likely cause given the symptom pattern.

Answer

The phone's IMEI is blacklisted.

Answer

The mobile data APN settings are incorrect.

Answer

The phone is in airplane mode.

Question 13

A user calls the help desk, frantic because they received an email from what appears to be the CEO asking them to urgently purchase $500 in gift cards for a client and reply with the codes. The email address looks slightly off, and the signature is missing the usual legal disclaimer. What type of social engineering attack is this most likely an example of?

Accepted Answer

Phishing. This is a classic example of phishing, specifically a subtype known as spear phishing or whaling, because the attacker impersonates a high-level executive (the CEO) to trick the user into performing a financial action. The telltale signs are the slightly off email address (spoofed domain or lookalike character) and the missing legal disclaimer, which are common indicators of a fraudulent email designed to harvest credentials or money. Phishing relies on social engineering to bypass technical controls by exploiting human trust and urgency.

Answer

Shoulder surfing

Answer

Tailgating

Answer

Pretexting

Question 14

A technician is installing a new power supply in a desktop computer. After connecting all cables, the computer will not power on. What is the most likely safety-related oversight?

Accepted Answer

The voltage selector switch on the power supply is set to the wrong voltage.. The voltage selector switch on the power supply must match the local mains voltage (typically 115V in North America or 230V in Europe). If set to 230V while plugged into a 115V outlet, the power supply will receive insufficient voltage to start, causing the computer to appear completely dead. This is a common safety-related oversight because the switch is often overlooked during installation.

Answer

The power supply is not compatible with the motherboard.

Answer

The power cord is not securely plugged into the power supply.

Answer

The power supply fan is blocked by debris.

Question 15

During a routine security audit, you find that several workstations have the same local administrator password. The company policy requires unique passwords for each machine. Which tool or method should you use to enforce unique local administrator passwords across the domain?

Accepted Answer

Deploy Microsoft LAPS (Local Administrator Password Solution).. Microsoft LAPS (Local Administrator Password Solution) is the correct tool because it automatically manages local administrator passwords on domain-joined computers, storing them in Active Directory and rotating them to unique values per machine. This directly enforces the policy of unique local admin passwords without manual intervention, using the `AdmPwd` extension and Group Policy to configure password complexity and rotation intervals.

Answer

Use Group Policy to set a standard local admin password.

Answer

Enable BitLocker on each workstation.

Answer

Disable the local administrator account on all workstations.