220-1102 Practice Test 21 — 15 Questions

Question 1

During a routine security audit, a technician discovers that a user's workstation has a program that records keystrokes and periodically sends the data to an external server. The user denies installing any software recently. Which type of malware is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Keylogger. The program described records keystrokes and exfiltrates them to an external server, which is the defining behavior of a keylogger. This type of malware captures user input, such as usernames and passwords, and sends the data to an attacker. The user's denial of installing software suggests the keylogger may have been delivered stealthily, often via a Trojan horse or drive-by download, but the core functionality is keylogging.

Answer

Trojan horse

Answer

Worm

Answer

Ransomware

Question 2

A company's login script uses a batch file that calls multiple other scripts. Recently, the script stopped working after a Windows update. The technician discovers that the script uses 'call' to run sub-scripts, but one of the sub-scripts contains an 'exit' command that terminates the entire batch process. How should the technician modify the sub-script to prevent this?

Accepted Answer

Change 'exit' to 'exit /b'. The 'exit' command without parameters terminates the entire command interpreter (cmd.exe), which kills the parent batch file as well. Using 'exit /b' instead exits only the current batch script or subroutine, returning control to the calling script. This preserves the intended flow when sub-scripts are invoked via 'call'.

Answer

Replace 'exit' with 'goto :eof'

Answer

Remove the 'exit' command entirely

Answer

Use 'endlocal' before 'exit'

Question 3

A user reports that their computer's hard drive is making clicking noises and they cannot access certain files. You want to check the disk for errors and attempt to repair any bad sectors. Which command should you run from an elevated command prompt?

Accepted Answer

chkdsk /r. The correct command is `chkdsk /r` because it locates bad sectors on the hard drive and recovers readable information from them. The `/r` switch implies `/f` (which fixes file system errors) and additionally performs a surface scan to identify and mark bad sectors, directly addressing the clicking noise and file access issue.

Answer

chkdsk /f

Answer

sfc /scannow

Answer

diskpart

Question 4

A user reports that their Windows 10 laptop shows a 'Your license will expire soon' watermark on the desktop, even though they purchased a retail license key. You need to resolve the activation issue. Which Control Panel applet should you use first?

Accepted Answer

System. The System applet (Control Panel > System) provides direct access to the Windows activation status and the 'Change product key' option. Since the user already has a retail license key, the first troubleshooting step is to verify the current activation state and re-enter the key via this applet, which triggers a re-activation with Microsoft's licensing servers.

Answer

Device Manager

Answer

Programs and Features

Answer

User Accounts

Question 5

During a security audit, you discover that a user’s Windows 10 device has allowed multiple failed login attempts without locking the account. Which policy should you adjust to enforce account lockout after 5 failed attempts?

Accepted Answer

Account Lockout Policy – Account lockout threshold. The Account Lockout Policy – Account lockout threshold setting directly controls the number of failed logon attempts allowed before the account is locked. By setting this value to 5, the system will enforce a lockout after exactly five incorrect password entries, preventing further brute-force attempts until an administrator unlocks the account or the lockout duration expires.

Answer

Password Policy – Minimum password length

Answer

User Rights Assignment – Deny log on locally

Answer

Security Options – Interactive logon: Message text for users attempting to log on

Question 6

A user calls the help desk saying they cannot log into their Windows 10 workstation because a message claims their files are encrypted and they must pay a ransom. What is the most effective remediation approach?

Accepted Answer

Disconnect from the network and restore files from a verified backup. Ransomware encrypts files with a key known only to the attacker, making decryption without the key impossible. Disconnecting from the network prevents the ransomware from spreading to other systems, and restoring from a verified backup is the only reliable way to recover the original files without paying the ransom.

Answer

Pay the ransom to get the decryption key

Answer

Reboot into Safe Mode and run a malware scan

Answer

Run System Restore to a point before the attack

Question 7

A technician is helping a user who accidentally installed a potentially unwanted program (PUP) that changed their browser homepage and search engine. The user is embarrassed and asks the technician not to tell their manager. What is the most ethical response?

Accepted Answer

Explain that you will remove the PUP but must document the incident per company policy, though you will not share unnecessary details.. It balances the user's privacy concern with the technician's professional obligation to follow company policy. Documenting the incident (e.g., in a help desk ticket) is standard procedure for tracking PUP infections, which may indicate broader security issues like drive-by downloads or social engineering. The technician can remove the PUP using tools like Malwarebytes or AdwCleaner while omitting the user's name from unnecessary reports, preserving trust without violating policy.

Answer

Agree not to tell the manager and remove the PUP quietly.

Answer

Tell the user that this is a serious security breach and you have to report it immediately.

Answer

Ignore the request and report the user to HR for violating IT policy.

Question 8

A technician is documenting a configuration change to a firewall rule that allows remote access for a new employee. The technician must ensure the documentation is clear for future audits. Which of the following is the most critical piece of information to include?

Accepted Answer

The business justification for the rule.. Change management documentation must include the business justification to demonstrate that the change was authorized and necessary. Without a clear reason, auditors cannot verify that the firewall rule complies with organizational security policy or regulatory requirements. The business justification provides the context needed to distinguish legitimate changes from unauthorized or malicious modifications.

Answer

The exact date and time the rule was added.

Answer

The IP address of the new employee's remote location.

Answer

The name of the technician who made the change.

Question 9

A user needs to connect to a work VPN but cannot find the VPN settings in the network tray. You need to guide them to the correct location to add a VPN connection. Where in Windows Settings would you direct them?

Accepted Answer

Network & Internet > VPN. The VPN settings in Windows are located under Network & Internet > VPN. This is the dedicated section where users can add, configure, and manage VPN connections, including setting up a new VPN profile with the server address, authentication method, and protocol (e.g., IKEv2, SSTP, or L2TP/IPsec). The network tray only shows existing connections; to add a new VPN, you must navigate to this specific settings page.

Answer

Network & Internet > Status

Answer

Network & Internet > Ethernet

Answer

Network & Internet > Proxy

Question 10

A technician needs to write a script that runs a specific command only if a Windows service is running. If the service is stopped, the script should start it first. Which scripting method is most appropriate?

Accepted Answer

Use an if-else statement to check the service status.. An if-else statement is the most appropriate scripting method to check the status of a specific Windows service and conditionally execute a command or start the service. In PowerShell, you can use `Get-Service` to retrieve the service status and then an if-else block to evaluate whether the `Status` property equals 'Running'. This provides clear, linear logic that directly matches the requirement without unnecessary complexity.

Answer

Use a for loop to iterate over all services.

Answer

Use a switch statement with multiple conditions.

Answer

Use a try-catch block to handle errors if the command fails.

Question 11

A technician is writing a PowerShell script to check the last boot time of a remote computer. The script uses Get-CimInstance Win32_OperatingSystem. The script works locally but fails with an access denied error when targeting a remote machine. Both computers are domain-joined and the technician has admin rights. What is the most likely issue?

Accepted Answer

The remote computer has Windows Firewall blocking WMI traffic.. Get-CimInstance uses the WS-Management (WSMan) protocol, which relies on WinRM. By default, Windows Firewall blocks inbound WinRM traffic on port 5985 (HTTP) and 5986 (HTTPS). Even though the technician has admin rights and both machines are domain-joined, the remote firewall must allow WinRM traffic for the CIM session to succeed. The local success is because no firewall traversal is needed.

Answer

The remote computer does not have PowerShell installed.

Answer

The script uses an incorrect namespace.

Answer

The technician is not a member of the Remote Management Users group.

Question 12

During a wireless site survey, a technician discovers that an employee has set up a personal wireless router in their cubicle, connected to the corporate network. This rogue access point is broadcasting an open SSID. Which security risk is most immediately concerning?

Accepted Answer

The rogue AP provides an unencrypted entry point for attackers to access the corporate network.. The most immediate security risk of a rogue access point broadcasting an open SSID is that it provides an unencrypted entry point into the corporate network. Any attacker within range can associate with the open SSID and, because the AP is connected to the corporate LAN, gain direct access to internal resources without authentication or encryption, bypassing perimeter security controls.

Answer

The rogue AP may cause radio frequency interference with the corporate WLAN.

Answer

The rogue AP will consume additional power from the corporate UPS.

Answer

The rogue AP's DHCP server may conflict with the corporate DHCP server.

Question 13

A small business owner reports that all their employees are receiving emails from each other containing a link that, when clicked, downloads a file that installs a program that spreads to other contacts. The emails appear to come from known senders. What type of malware is this?

Accepted Answer

Worm. (Worm) because the malware self-replicates by sending copies of itself via email to all contacts without requiring user action beyond clicking the link. Unlike a virus, it does not need to attach to a host file; it spreads autonomously over the network using the email system as a transport mechanism.

Answer

Virus

Answer

Trojan horse

Answer

Rootkit

Question 14

A technician is asked to install a new accounting application on a user's computer. The user mentions that a coworker told them the software is known to cause conflicts with antivirus programs. What should the technician do?

Accepted Answer

Research the software's compatibility with the antivirus and test in a sandbox if possible.. The technician must validate the user's concern through proper research rather than dismissing it. Checking the software's documented compatibility with the specific antivirus program and testing in an isolated sandbox environment prevents potential system instability or security bypasses without risking the production system.

Answer

Ignore the user's comment because it is hearsay and proceed with the installation.

Answer

Disable the antivirus temporarily and install the software.

Answer

Tell the user that the coworker is mistaken and install the software anyway.

Question 15

A technician is configuring a kiosk mode on a company-owned Android tablet for customer use. After enabling the dedicated device management app, the tablet still allows users to exit the kiosk app by pressing the home button. Which setting did the technician MOST likely overlook?

Accepted Answer

The 'Lock task mode' or 'Pin app' feature.. The technician enabled the dedicated device management app but did not activate Android's 'Lock task mode' (or 'Pin app' feature). This mode is required to pin the kiosk app to the foreground and block system navigation keys (Home, Recent Apps), preventing users from exiting the app. Without it, the Home button remains functional, allowing escape from the kiosk environment.

Answer

The tablet's screen timeout setting.

Answer

The tablet's Wi-Fi configuration.

Answer

The device's date and time settings.