220-1102 Practice Test 24 — 15 Questions

Question 1

A user reports that a PowerShell script they wrote to rename multiple files in a folder works on their desktop but fails with a 'permission denied' error when run from a network folder. The user has full control of the network folder. What is the most likely cause?

Accepted Answer

The execution policy is set to RemoteSigned, which blocks scripts from network locations.. The PowerShell execution policy controls which scripts can run and from where. The RemoteSigned policy requires that scripts from the internet (including network shares) be digitally signed, and it treats network drives as an 'internet' zone. When the script is run from a network folder, the policy blocks execution unless the script is signed, resulting in a 'permission denied' error, even though the user has full NTFS permissions.

Answer

The script uses a cmdlet that is not available on the network drive.

Answer

The network folder has a space in its name.

Answer

The user is not running PowerShell as an administrator.

Question 2

A technician needs to write a script that runs a specific command only if a Windows service is running. If the service is stopped, the script should start it first. Which scripting method is most appropriate?

Accepted Answer

Use an if-else statement to check the service status.. The correct answer is B because an if-else statement is the most appropriate scripting method to check the status of a specific Windows service and conditionally execute a command or start the service. In PowerShell, you can use `Get-Service` to retrieve the service status and then an if-else block to evaluate whether the `Status` property equals 'Running'. This provides clear, linear logic that directly matches the requirement without unnecessary complexity.

Answer

Use a for loop to iterate over all services.

Answer

Use a switch statement with multiple conditions.

Answer

Use a try-catch block to handle errors if the command fails.

Question 3

A user reports that a scheduled task runs a VBScript every morning, but the script fails with an 'ActiveX component can't create object' error. The script uses a COM object to interact with an application. What is the most likely cause of this error?

Accepted Answer

The COM object's DLL is not registered or the application is not installed. The 'ActiveX component can't create object' error occurs when the VBScript's CreateObject call fails because the COM class it references is not available. This typically means the DLL that implements the COM object is not registered (e.g., via regsvr32) or the application that provides the object is not installed on the system. Without the registered COM component, the script cannot instantiate the object, leading to this specific runtime error.

Answer

The script is running with insufficient permissions to create files

Answer

The script contains a syntax error in the CreateObject line

Answer

The scheduled task is set to run when the user is not logged in

Question 4

During a software deployment, a technician needs to ensure that a new web application can run in a sandboxed environment to prevent it from accessing other system resources. Which browser feature should be configured?

Accepted Answer

Enable browser sandboxing.. Option C is correct because browser sandboxing is a security mechanism that isolates the web application's processes from the rest of the system, preventing it from accessing other system resources such as the file system, registry, or other processes. This is commonly implemented in modern browsers (e.g., Chrome's multi-process architecture with a sandbox layer) to contain potential exploits from a compromised web application.

Answer

Enable pop-up blocker.

Answer

Enable private browsing mode.

Answer

Disable JavaScript.

Question 5

A user reports that after installing a free PDF converter from an advertisement, their browser homepage changed and they see constant pop-ups for antivirus software. A malware scan found PUPs (Potentially Unwanted Programs). What is the best next step to fully remove the unwanted software and restore browser settings?

Accepted Answer

Use a dedicated adware removal tool and then reset the browser.. Option B is correct because PUPs often embed deeply into browser settings and registry entries that a standard uninstall or System Restore may not fully remove. A dedicated adware removal tool targets these specific traces, and resetting the browser ensures all malicious extensions, search providers, and homepage hijacks are cleared, restoring default security configurations.

Answer

Run System Restore to a point before installation.

Answer

Manually delete the program from Program Files.

Answer

Disable the browser's JavaScript and ActiveX.

Question 6

A technician is writing a Python script to automate the installation of software on multiple Windows machines. The script needs to check if the software is already installed by looking for a specific registry key. If the key exists, the script should skip the installation. Which Python library and method should the technician use to read the registry?

Accepted Answer

Use the 'winreg' module with 'OpenKey' and 'QueryValueEx'. The `winreg` module is the standard Python library for accessing the Windows registry. `OpenKey` opens a specified registry key, and `QueryValueEx` retrieves the value data and type for a given value name. This allows the script to check for the software's registry key and conditionally skip installation if it exists.

Answer

Use the 'os' module with 'os.regread'

Answer

Use the 'subprocess' module to run 'reg query'

Answer

Use the 'sys' module to access registry via system calls

Question 7

A user's browser is displaying a warning that the website's certificate is not trusted, even though the URL is correct. The technician checks the date and time on the computer and finds it is set to 2019. What is the most likely cause of the certificate warning?

Accepted Answer

The system date is incorrect, causing certificate validation to fail.. The system date is set to 2019, which is outside the certificate's validity period. SSL/TLS certificates have a specific notBefore and notAfter date range; when the client's clock is outside this range, the browser rejects the certificate as untrusted. This is the most direct and common cause of the warning given the symptom and the technician's finding.

Answer

The website's SSL certificate has been revoked.

Answer

The browser's certificate store is corrupted.

Answer

The user is connected to a malicious proxy.

Question 8

A technician is deploying 20 new laptops to a department. The manager asks the technician to install the software quickly, but the technician knows that a full deployment includes user training and data migration. Which action BEST demonstrates professional communication?

Accepted Answer

Explain the standard deployment process and offer a revised timeline that includes training.. Option B is correct because it demonstrates professional communication by clearly explaining the standard deployment process—which includes user training and data migration—and offering a revised timeline. This aligns with the CompTIA A+ objective of managing expectations and ensuring a complete, effective rollout rather than a rushed, incomplete installation.

Answer

Agree to the manager's request and rush the installation to avoid conflict.

Answer

Install the software and let the users figure out the rest on their own.

Answer

Tell the manager that training is not part of the technician's job.

Question 9

A user reports that their Windows 10 laptop is running slowly and frequently shows a 'Low Memory' warning. They have 8 GB of RAM and are not running any unusual applications. Which built-in Windows tool should you use to determine if a specific process is leaking memory?

Accepted Answer

Task Manager. Task Manager (Option B) is the correct tool because it provides a real-time view of per-process memory usage, including the 'Memory (Active Private Working Set)' column, which can identify a process that is consuming an abnormally increasing amount of RAM over time—indicative of a memory leak. Unlike other tools, Task Manager allows you to quickly sort processes by memory usage and observe growth without needing to configure counters or parse logs.

Answer

Performance Monitor

Answer

Event Viewer

Answer

System Configuration (msconfig)

Question 10

A security incident occurred on a Windows 10 workstation where an attacker gained administrative access and created several hidden user accounts. You need to ensure no unauthorized accounts exist and that the built-in Administrator account is disabled. Which two tools can you use from the command line to list all user accounts and check the status of the Administrator account?

Accepted Answer

Use 'net user' to list accounts and 'net user Administrator | findstr /i active' to check status.. The 'net user' command lists all local user accounts on a Windows system, which is necessary to identify hidden or unauthorized accounts. Piping 'net user Administrator' through 'findstr /i active' filters the output to show whether the built-in Administrator account is enabled or disabled, as the status line contains 'Active' or 'Account active' depending on the locale. This combination directly fulfills the requirement to list all accounts and check the Administrator account's status from the command line.

Answer

Use 'whoami' to list current user and 'net localgroup Administrators' to see group members.

Answer

Use 'dir C:\Users' to list user profile folders and 'net accounts' to see password policies.

Answer

Use 'gpresult /R' to list applied policies and 'net start' to see running services.

Question 11

A Windows 10 workstation is experiencing random blue screen errors with the stop code 'IRQL_NOT_LESS_OR_EQUAL'. You suspect a faulty driver. You need to analyze the memory dump files to identify the offending driver. Which built-in tool should you use to view the dump file?

Accepted Answer

Windows Debugging Tools (WinDbg) – open the .dmp file.. WinDbg (Windows Debugging Tools) is the correct built-in tool for analyzing memory dump (.dmp) files. It can parse crash dump data and identify the specific driver or module that caused the IRQL_NOT_LESS_OR_EQUAL stop code by examining the stack trace and loaded module list. This is the standard approach for post-mortem debugging of blue screen errors.

Answer

Event Viewer (eventvwr.msc) – filter by System logs with level 'Error'.

Answer

Performance Monitor (perfmon.msc) – add a Data Collector Set for crash dumps.

Answer

Windows Memory Diagnostic (mdsched.exe) – run a memory test.

Question 12

During a software deployment, you need to create a script that runs automatically every time a user logs into their Windows 10 domain-joined computer. Which tool should you use to configure this task?

Accepted Answer

Task Scheduler. Task Scheduler is the correct tool because it allows you to create a task that triggers on a specific event, such as user logon. You can set the trigger to 'At log on' for any user or a specific user, and the task will run automatically each time the user logs into the Windows 10 domain-joined computer. This is the native Windows mechanism for scheduling scripts or programs to run at logon without requiring additional configuration.

Answer

Group Policy Management Console

Answer

Local Group Policy Editor

Answer

Windows PowerShell ISE

Question 13

A user reports that their browser crashes every time they visit a particular website. Other websites work fine. The technician tries the same website on another computer and it works normally. What is the most likely cause on the user's computer?

Accepted Answer

A browser extension is incompatible with that website.. Option B is correct because the issue is isolated to a single website on one computer, and the same website works on another computer. This rules out network-wide or server-side problems. Browser extensions can inject scripts, modify headers, or block resources that a specific website requires, causing crashes. Disabling extensions or testing in incognito mode (which typically disables extensions) can confirm this.

Answer

The website has been blacklisted by the company's firewall.

Answer

The user's network adapter driver is outdated.

Answer

The website is using a newer version of TLS that the browser doesn't support.

Question 14

A company's security policy requires that all Windows 10 workstations automatically install critical updates as soon as they are released. However, users must not be forced to restart during work hours. Which Windows Update setting should you configure to meet these requirements?

Accepted Answer

Set Active Hours to cover the workday. Configuring Active Hours in Windows Update allows you to specify the time range during which the system should not automatically restart after installing updates. By setting Active Hours to cover the entire workday, critical updates can be downloaded and installed automatically, but the required restart is deferred until outside those hours, meeting both the security policy and the user experience requirement.

Answer

Defer feature updates

Answer

Set the connection as metered

Answer

Configure Windows Update to 'Notify to schedule restart'

Question 15

A security incident occurred on a Windows 10 workstation where an unauthorized user gained access. The technician needs to review detailed security events, such as logon attempts and file access, to determine the scope of the breach. Which tool should the technician use to examine these logs?

Accepted Answer

Event Viewer. Event Viewer is the correct tool because it provides a centralized, detailed log of security-related events, including logon attempts (Event ID 4624 for successful logons, 4625 for failed logons) and file access audits (Event ID 4663). These logs are essential for forensic analysis to determine the scope of a breach on a Windows 10 workstation.

Answer

Resource Monitor

Answer

Performance Monitor

Answer

Local Security Policy