220-1102 Practice Test 21 — 15 Questions

Question 1

A user on Windows 11 reports that their computer frequently freezes for 5–10 seconds at a time, especially when opening multiple browser tabs. The system has 8 GB of RAM and a mechanical hard drive. Which performance monitor counter should you check first to confirm the likely bottleneck?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Avg. Disk Queue Length. Frequent freezing when multitasking on a system with a mechanical hard drive and limited RAM often points to excessive disk usage due to paging. The 'Avg. Disk Queue Length' counter in Performance Monitor indicates how many requests are waiting for the disk; a sustained value over 2 suggests the disk is the bottleneck, likely from swapping memory to the page file.

Answer

% Processor Time

Answer

Available Mbytes

Answer

Pages/sec

Question 2

Your company is deploying a new application that requires .NET Framework 3.5 on multiple Windows 10 workstations. You need to enable this feature on a single test machine first. Which tool should you use?

Accepted Answer

Windows Features. Windows Features (accessible via 'Turn Windows features on or off' in the Control Panel or Settings) is the correct tool to enable .NET Framework 3.5 on a Windows 10 workstation. This feature includes .NET 2.0 and 3.0, and it can be installed from local sources or Windows Update. Programs and Features is used for uninstalling or changing installed programs, not for enabling Windows roles or features.

Answer

Programs and Features

Answer

Device Manager

Answer

Services

Question 3

A user is unable to install a new printer on their Windows 10 workstation because the 'Print Spooler' service is not running. You need to start the service and ensure it starts automatically on boot. Which tool should you use?

Accepted Answer

Services. The Print Spooler is a Windows service that manages print jobs sent to the printer. To start it and set its startup type to Automatic, you must use the Services console (services.msc), which provides direct control over service state and startup configuration. Device Manager manages hardware drivers, not service states.

Answer

Device Manager

Answer

Task Scheduler

Answer

System Configuration

Question 4

During a security incident investigation, a technician finds that an attacker called the help desk, pretended to be a new employee who forgot their password, and successfully reset it. The attacker knew the employee's name and department. Which social engineering technique was used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where the attacker fabricates a scenario (pretext) to manipulate a target into performing an action. In this case, the attacker called the help desk, assumed the identity of a new employee, and used the known details (name and department) to create a believable story, convincing the help desk to reset the password. This relies on psychological manipulation rather than technical exploitation.

Answer

Phishing

Answer

Tailgating

Answer

Shoulder surfing

Question 5

A user reports that they clicked a link in a text message that appeared to be from their bank, warning of suspicious activity. The link led to a realistic-looking login page, but the user realized it was fake after entering their credentials. What type of social engineering attack is this?

Accepted Answer

Smishing. Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) containing a link to a fraudulent website. The user received the message on their mobile device, clicked the link, and entered credentials on a fake login page, which is the hallmark of smishing. Unlike vishing (voice phishing), this attack uses text-based messaging to deliver the malicious link.

Answer

Vishing

Answer

Pharming

Answer

Pretexting

Question 6

A technician is tasked with creating a PowerShell script that will parse a CSV file containing user information and create local user accounts on a Windows 10 machine. The CSV has columns: 'Username', 'FullName', 'Password'. The script must skip any row where the 'Username' is empty. Which control structure should the technician use to handle this requirement?

Accepted Answer

An 'if' statement to test whether the Username property is not empty. The requirement is to conditionally skip rows based on a property value. An 'if' statement in PowerShell allows you to test whether the 'Username' property is empty or null using a condition like `if ($_.Username -ne '')` and then skip the row with `continue` or simply not process it. This is the most direct and efficient control structure for a simple boolean check on each row.

Answer

A 'for' loop with a counter to skip empty rows

Answer

A 'switch' statement to match usernames

Answer

A 'try/catch' block to handle errors when creating the account

Question 7

During a major software rollout, a technician discovers that the deployment script modifies a registry key that is also used by a legacy application. The change was not included in the original change request. What should the technician do?

Accepted Answer

Stop the deployment and submit a new change request for the registry modification.. Any unapproved change to a system, even if necessary, must follow the change management process. The technician discovered that the deployment script modifies a registry key shared with a legacy application, which was not included in the original change request. Stopping the deployment and submitting a new change request ensures proper review, risk assessment, and approval before altering a shared resource that could impact the legacy application.

Answer

Proceed with the deployment since the registry change is necessary for the new software.

Answer

Modify the script to skip the registry change and continue.

Answer

Document the registry change after the deployment is complete.

Question 8

A technician is troubleshooting why a smart card reader at a secure entrance fails intermittently. Users can sometimes enter, but other times the reader does not respond. What should the technician check first?

Accepted Answer

Check the cabling and connections to the reader. Intermittent failures in a smart card reader are most often caused by physical connection issues, such as loose or damaged cabling, rather than software or firmware problems. Checking cabling and connections is the first step in a structured troubleshooting approach because it addresses the most common and easily verifiable cause of intermittent behavior.

Answer

Update the smart card reader firmware

Answer

Replace the smart cards for all users

Answer

Reconfigure the access control software

Question 9

During a software deployment, you need to ensure that all users on a Windows 10 workstation have the company logo as their desktop background. Which Control Panel applet would you use to set a mandatory desktop background?

Accepted Answer

Personalization. The Personalization applet in Control Panel allows you to set a desktop background image. To enforce a mandatory background for all users, you would configure a Group Policy setting (via gpedit.msc) that references the Personalization category, specifically the 'Desktop Wallpaper' policy under User Configuration > Administrative Templates > Desktop > Desktop. This overrides individual user settings and locks the background.

Answer

Ease of Access Center

Answer

Display

Answer

Folder Options

Question 10

An organization uses Windows 10 and wants to prevent users from installing unauthorized software. They have configured Software Restriction Policies via Group Policy. However, a user bypassed the policy by renaming the executable. What additional measure should be taken to enforce the restriction?

Accepted Answer

Use AppLocker with publisher rules. AppLocker with publisher rules is the correct additional measure because Software Restriction Policies (SRP) can be bypassed by renaming executables, as SRP relies on file path or hash rules. AppLocker's publisher rules use digital signatures to identify software, making it immune to filename changes. This provides a more robust enforcement mechanism for preventing unauthorized software installation.

Answer

Enable Windows Defender Real-time Protection

Answer

Set User Account Control to Always Notify

Answer

Enable BitLocker

Question 11

A user's computer is infected with adware that changes the browser homepage and displays constant pop-ups. After removing the adware with an antivirus, the homepage remains changed. What additional remediation step should you take?

Accepted Answer

Reset the browser settings to default. After adware removal, the browser's homepage and settings are often stored in the browser's configuration files or registry keys that the antivirus does not reset. Resetting the browser settings to default restores the homepage, search engine, and new tab page to their original state, clearing any persistent malicious configurations left behind by the adware.

Answer

Reinstall the operating system

Answer

Run a disk cleanup utility

Answer

Update the antivirus definitions and scan again

Question 12

A customer calls saying that after installing a new printer, their Windows 10 computer now takes much longer to shut down. They have uninstalled the printer software, but the slow shutdown persists. Which tool should you use to identify the cause of the shutdown delay?

Accepted Answer

Event Viewer. Slow shutdowns are often caused by services or drivers that fail to terminate properly. The Event Viewer logs system events, including errors and warnings during shutdown, which can pinpoint the offending component. This is more effective than generic performance monitoring or disk cleanup for this specific issue.

Answer

Task Manager

Answer

Performance Monitor

Answer

Disk Cleanup

Question 13

A company's IT policy requires that all wireless connections use certificate-based authentication to prevent unauthorized access. The network is currently using WPA2-PSK. Which configuration change is necessary to meet this policy?

Accepted Answer

Switch to WPA2-Enterprise and configure a RADIUS server.. The policy requires certificate-based authentication, which is a feature of WPA2-Enterprise (802.1X). WPA2-Enterprise uses a RADIUS server to validate certificates and authenticate users individually, replacing the pre-shared key (PSK) model. This meets the requirement for certificate-based authentication to prevent unauthorized access.

Answer

Enable MAC address filtering on the access point.

Answer

Upgrade to WPA3-Personal.

Answer

Change the encryption from AES to TKIP.

Question 14

A user reports that their web browser's homepage has changed to an unfamiliar search engine, and new toolbars have appeared without their consent. They have not installed any new software recently. Which type of malware is most likely responsible?

Accepted Answer

Browser hijacker. The symptoms—unwanted homepage changes, unfamiliar search engine, and new toolbars—are classic signs of a browser hijacker. This malware modifies browser settings (e.g., via registry keys or extension policies) without user consent, often bundled with freeware or installed through drive-by downloads. Unlike other malware types, it specifically targets the browser's configuration to redirect traffic and generate ad revenue.

Answer

Trojan horse

Answer

Worm

Answer

Ransomware

Question 15

A technician is troubleshooting a Windows 10 computer that randomly restarts without any error message. The system does not create a minidump file. Which advanced startup option should be disabled in the System Properties to help capture the error for analysis?

Accepted Answer

Automatic restart. When 'Automatic restart' is enabled, the system restarts immediately after a critical error (BSOD) without displaying the error screen or creating a dump file. Disabling this option allows the system to halt on the blue screen, showing the error code and enabling dump file generation for troubleshooting.

Answer

Fast Startup

Answer

Write an event to the system log

Answer

Small memory dump (256 KB)