220-1102 Practice Test 28 — 15 Questions

Question 1

After installing a new application, a user's Windows 10 system fails to boot and displays a 'Bootmgr is missing' error. Which command-line tool should you use from the Windows Recovery Environment to repair the boot configuration?

Accepted Answer

bootrec. The 'Bootmgr is missing' error indicates that the Boot Manager (bootmgr) is corrupted or the Boot Configuration Data (BCD) is damaged. The bootrec command, specifically with the /FixBoot, /FixMbr, and /RebuildBcd switches, is designed to repair the boot configuration and restore the boot manager from the Windows Recovery Environment.

Answer

diskpart

Answer

sfc /scannow

Answer

chkdsk /f

Question 2

During a security incident, you need to identify which processes are listening on specific network ports on a Windows server. Which command-line tool should you use?

Accepted Answer

netstat -an. The `netstat -an` command displays all active TCP connections and the TCP/UDP ports on which the computer is listening, with numerical addresses and port numbers. This makes it the correct tool to identify which processes are listening on specific network ports during a security incident on a Windows server.

Answer

nslookup

Answer

tracert

Answer

ipconfig /all

Question 3

A customer complains that their Windows 10 laptop frequently loses network connectivity. You suspect the IP address configuration is incorrect. Which command should you use to release the current IP address and request a new one from the DHCP server?

Accepted Answer

ipconfig /release. Option B is correct because the `ipconfig /release` command sends a DHCPRELEASE message to the DHCP server, discarding the current IP address lease. This is followed by `ipconfig /renew` to request a new IP address from the DHCP server, which resolves connectivity issues caused by an incorrect or stale IP configuration.

Answer

ping 8.8.8.8

Answer

nslookup google.com

Answer

netstat -a

Question 4

After a failed Windows Update, a Windows 10 system repeatedly attempts to install the update and fails. You need to stop the Windows Update service and delete the temporary update files from the command line. Which two commands, in order, should you use? (Select the first command from the options.)

Accepted Answer

net stop wuauserv. The correct first command is 'net stop wuauserv' because it stops the Windows Update service (wuauserv), which prevents the system from continuing to attempt the failed update installation. After stopping the service, you can then delete the temporary update files from the SoftwareDistribution folder using commands like 'del /f /s /q %systemroot%\SoftwareDistribution\*' or 'rmdir /s /q %systemroot%\SoftwareDistribution'. This two-step process is the standard method to clear a stuck update state.

Answer

sfc /scannow

Answer

dism /online /cleanup-image /restorehealth

Answer

taskkill /IM svchost.exe /F

Question 5

A technician needs to configure a Windows 10 computer to use a static IP address of 192.168.1.100 with subnet mask 255.255.255.0 and default gateway 192.168.1.1. Which command-line tool and syntax should be used?

Accepted Answer

netsh interface ip set address "Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1. Option A is correct because the `netsh interface ip set address` command is the proper Windows command-line tool to configure a static IP address, subnet mask, and default gateway. The syntax `"Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1` specifies the interface name, the static keyword, the IP address, the subnet mask, the default gateway, and the metric (1), which matches the required configuration.

Answer

ipconfig /setaddress 192.168.1.100

Answer

netstat -r

Answer

ping 192.168.1.1

Question 6

During a security audit, you discover that a user's workstation has an unauthorized application running. You need to terminate the process immediately from the command line. The process name is 'malware.exe'. Which command should you use?

Accepted Answer

taskkill /IM malware.exe /F. Option B is correct because the `taskkill` command with the `/IM` (image name) and `/F` (force) flags is the standard Windows CLI method to forcibly terminate a process by its executable name. This directly stops 'malware.exe' without requiring the process ID, making it the appropriate tool for immediate termination during a security incident.

Answer

tasklist /FI "IMAGENAME eq malware.exe"

Answer

net stop malware

Answer

shutdown /r /t 0

Question 7

A customer complains that their Windows 11 laptop cannot connect to the internet, but other devices on the same network work fine. You suspect the IP configuration is incorrect. Which command will release and renew the IP address from the DHCP server?

Accepted Answer

ipconfig /release then ipconfig /renew. The `ipconfig /release` command releases the current DHCP lease, setting the IP address to 0.0.0.0, and `ipconfig /renew` sends a DHCPDISCOVER broadcast to obtain a new IP configuration from the DHCP server. This is the correct sequence to resolve an incorrect IP configuration that prevents a Windows 11 client from connecting to the internet while other devices work fine.

Answer

ipconfig /flushdns

Answer

ipconfig /all

Answer

ping 127.0.0.1

Question 8

You are deploying a new application to multiple Windows 10 workstations using a script. The application requires administrator privileges, and you need to run the command with elevated rights from within the script. Which command should precede your installation command?

Accepted Answer

runas /user:Administrator. The `runas /user:Administrator` command allows you to execute a subsequent command with the security context of the specified user (in this case, the built-in Administrator account), which provides the elevated privileges required to install the application. This is necessary because the script itself runs under the current user's context, which may lack the administrative rights needed for the installation.

Answer

net user

Answer

cd

Answer

whoami

Question 9

A user complains that their computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What is the most likely security issue?

Accepted Answer

The system is infected with adware that displays unsolicited advertisements.. The symptoms—pop-up ads without a browser open, an unwanted toolbar, and system slowdown—are classic indicators of adware. Adware is a type of potentially unwanted program (PUP) that displays intrusive advertisements, often by injecting ads into system processes or browser sessions, and can degrade performance by consuming CPU and memory resources.

Answer

A rootkit has hidden itself in the system's firmware.

Answer

A worm is spreading through the network, consuming bandwidth.

Answer

A Trojan horse has stolen the user's banking credentials.

Question 10

A user receives an email that appears to be from their bank, asking them to click a link and verify their account information due to 'suspicious activity.' The email address looks legitimate, but the link points to a different domain. What type of attack is this?

Accepted Answer

Phishing. This is a classic phishing attack because the email uses social engineering to trick the user into clicking a link that leads to a fraudulent domain, even though the sender's address appears legitimate. Phishing is a broad category of social engineering where attackers impersonate a trusted entity to steal credentials or sensitive information, and the mismatched link is the key indicator.

Answer

Spear phishing

Answer

Whaling

Answer

Vishing

Question 11

A user reports that their workstation is running slowly and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their system tray that they did not install. What is the most likely security issue?

Accepted Answer

The system has adware installed.. Adware is a type of malware that displays unwanted advertisements, often in the form of pop-ups or browser redirects, and may install toolbars or other unwanted software without the user's consent. The presence of a new toolbar in the system tray and frequent pop-ups even when no browser is open are classic indicators of adware infection, as adware often runs background processes to generate revenue through ad impressions.

Answer

A rootkit has hidden itself in the kernel.

Answer

A ransomware encryption process has started.

Answer

The user's account has been phished and credentials stolen.

Question 12

A user reports that after a recent Windows update, the 'Local Users and Groups' snap-in is missing from the Computer Management console. The user needs to add a new local user account. Which administrative tool should be used to complete this task?

Accepted Answer

Run lusrmgr.msc from the Run dialog.. The 'Local Users and Groups' snap-in is a Microsoft Management Console (MMC) component that can be launched directly by running lusrmgr.msc from the Run dialog. This command opens the Local Users and Groups manager, which allows you to create, modify, and delete local user accounts and groups without needing the Computer Management console. Since the snap-in is missing from the console due to the update, using the standalone MMC command is the correct workaround.

Answer

Open the Services console (services.msc) and restart the 'User Manager' service.

Answer

Use the Disk Management tool to create a new user volume.

Answer

Open the Registry Editor and modify the SAM registry hive.

Question 13

A security incident occurred on a Windows 10 workstation, and you need to review detailed logs of user logon attempts, including successful and failed logins, to identify unauthorized access. Which tool should you use to view these security logs?

Accepted Answer

Event Viewer. Event Viewer is the correct tool because it provides access to Windows Security logs, which record detailed information about user logon attempts, including both successful (Event ID 4624) and failed (Event ID 4625) logins. These logs are essential for forensic analysis of unauthorized access on a Windows 10 workstation.

Answer

Reliability Monitor

Answer

Performance Monitor

Answer

Group Policy Editor

Question 14

A user reports that their MacBook Pro running macOS Ventura suddenly lost all desktop icons and the menu bar is missing. They can still move the cursor and click on open applications. Which macOS feature or tool should you use to restore the desktop and menu bar?

Accepted Answer

Use Force Quit (Cmd+Option+Esc) and select Finder, then click Relaunch.. Option C is correct because the Finder process manages the desktop icons and the menu bar in macOS. When the Finder becomes unresponsive or crashes, relaunching it via Force Quet (Cmd+Option+Esc) restores the desktop environment and menu bar without requiring a full system restart. This is the standard troubleshooting step for a hung Finder that still allows cursor movement and interaction with open applications.

Answer

Restart the MacBook by holding the power button.

Answer

Open Activity Monitor and force quit the WindowServer process.

Answer

Run the command 'sudo killall Dock' in Terminal.

Question 15

A user complains that their Mac running macOS Big Sur suddenly shows a message 'Your system has run out of application memory' and applications crash frequently. Activity Monitor shows high memory pressure. What is the most effective built-in tool to diagnose the cause?

Accepted Answer

Activity Monitor. Activity Monitor is the correct tool because it provides real-time metrics on memory pressure, including the 'Memory Pressure' graph, which indicates whether the system is efficiently using memory or thrashing. High memory pressure, combined with the 'Your system has run out of application memory' alert, points to excessive memory usage or a memory leak, which Activity Monitor can pinpoint by sorting processes by memory consumption.

Answer

Console

Answer

Disk Utility

Answer

System Information