220-1102 Practice Test 28 — 15 Questions

Question 1

A technician is setting up a remote desktop solution for a small business with five employees who need to access their office PCs from home. The office uses a dynamic public IP address. Which of the following should the technician configure to ensure reliable remote access without requiring users to remember a changing IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a dynamic DNS (DDNS) service. A dynamic DNS (DDNS) service maps a fixed hostname (e.g., remote.office.com) to the office’s changing public IP address. The technician configures the router or a client to update the DDNS provider automatically whenever the ISP-assigned IP changes, so employees can always connect using the same hostname without tracking the current IP.

Answer

Set up port forwarding on the router

Answer

Assign each employee a static IP address on the office network

Answer

Use a VPN with a static IP assigned by the ISP

Question 2

During a security audit, a technician notices that an unauthorized person is standing just behind an employee at the secure door, waiting for the employee to badge in so they can enter without badging themselves. What type of social engineering attack is being attempted?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a secured area without using their own credentials. In this scenario, the attacker waits for the employee to badge in and then slips through the door before it closes, bypassing the access control system. This exploits the trust or politeness of the employee and the physical security gap between the door closing and the authentication check.

Answer

Pretexting

Answer

Baiting

Answer

Phishing

Question 3

A technician is configuring a company-issued iPhone for a new employee. After setting up the email account, the employee says they cannot receive emails, but they can send them. Which setting should the technician check first?

Accepted Answer

The incoming mail server (IMAP/POP3) settings.. The symptom—able to send but not receive emails—indicates a problem with the incoming mail server configuration. Sending uses SMTP (outgoing), while receiving uses IMAP or POP3 (incoming). The technician should first verify the incoming mail server settings (server hostname, port, SSL/TLS, and authentication) because a misconfiguration there would prevent the device from downloading new messages.

Answer

The outgoing mail server (SMTP) settings.

Answer

The device's date and time settings.

Answer

The phone's VPN configuration.

Question 4

A user is setting up a new Android tablet for a child and wants to restrict access to adult content, limit app purchases, and set screen time limits. Which built-in Android feature should the technician configure?

Accepted Answer

Google Family Link. Google Family Link is the built-in Android parental control feature that allows a technician to restrict adult content via SafeSearch filtering, limit app purchases by requiring parental approval, and set screen time limits through daily usage schedules. It operates by linking the child's device to a parent's Google account, enabling remote management of digital ground rules without third-party software.

Answer

Guest Mode

Answer

Do Not Disturb

Answer

Developer Options

Question 5

A company uses a private cloud for its internal applications. The IT team wants to ensure that if one physical host fails, the virtual machines running on it can be automatically restarted on another host with minimal downtime. Which feature should they implement?

Accepted Answer

High availability. High availability (HA) is the correct feature because it is designed to automatically restart virtual machines on a surviving host within a cluster when a physical host fails. HA uses heartbeat monitoring between hosts and a resource manager to detect failures and trigger VM restarts, minimizing downtime without requiring manual intervention.

Answer

Fault tolerance

Answer

Live migration

Answer

Snapshots

Question 6

A technician receives a call from someone claiming to be from the company's IT security team, asking for the administrator password to 'run a critical update.' The caller's voice sounds stressed and they mention a data breach. What should the technician do?

Accepted Answer

Ask for a callback number and verify it against the company directory.. It follows the principle of verifying identity through a trusted channel before disclosing sensitive information. The technician should ask for a callback number and cross-reference it against the company directory to ensure the caller is legitimate, as social engineering attacks often use urgency and impersonation to bypass security protocols.

Answer

Provide the password immediately to prevent a data breach.

Answer

Ignore the call because IT never calls about updates.

Answer

Change the password and give them the new one.

Question 7

During a security incident, you need to identify which processes are listening on specific network ports on a Windows server. Which command-line tool should you use?

Accepted Answer

netstat -an. The `netstat -an` command displays all active TCP connections and the TCP/UDP ports on which the computer is listening, with numerical addresses and port numbers. This makes it the correct tool to identify which processes are listening on specific network ports during a security incident on a Windows server.

Answer

nslookup

Answer

tracert

Answer

ipconfig /all

Question 8

A user reports that their laptop was stolen from their desk overnight. The security team reviews badge logs and finds no after-hours access to the floor. What physical security control should be implemented to prevent this from recurring?

Accepted Answer

Use a cable lock to secure the laptop to the desk.. A cable lock physically secures the laptop to a fixed object like a desk, directly preventing theft by requiring physical force or tool removal. Since the breach occurred overnight with no after-hours access, the threat was unauthorized physical removal, not logical access. A cable lock is the only control that addresses the physical theft vector by tethering the device to an immovable anchor.

Answer

Install a biometric fingerprint reader on the laptop.

Answer

Require a smart card to log in to the laptop.

Answer

Enable full-disk encryption on the laptop.

Question 9

A company deploys a custom app via MDM to Android devices. Users report that the app crashes immediately upon launch. The app works fine on the developer's test device. What is the most likely cause?

Accepted Answer

The app requires a specific Android API level that is not present on the deployed devices.. The most likely cause is that the app requires a specific Android API level (e.g., a minimum SDK version) that is not present on the deployed devices. Since the app works on the developer's test device (which likely has a newer or matching API level), but crashes on the target devices, this indicates a compatibility mismatch. MDM deployment does not alter the device's API level, so the app's manifest-defined requirements are not met, leading to an immediate crash on launch.

Answer

The MDM profile is corrupt and needs to be re-pushed.

Answer

The devices have insufficient storage space.

Answer

The app is not signed with the correct enterprise certificate.

Question 10

A user calls the help desk because they received a pop-up on their screen claiming their computer is infected with a virus and to call a toll-free number for immediate support. The user did not call the number. What should the technician advise the user to do?

Accepted Answer

Close the pop-up and run a full antivirus scan.. The pop-up is a classic tech support scam, a form of social engineering. The user should close the pop-up (e.g., using Task Manager or Alt+F4) and immediately run a full antivirus scan to detect and remove any potential malware that may have triggered the pop-up or been downloaded in the background. This ensures the system is cleaned and prevents further compromise.

Answer

Call the number to see if it's legitimate.

Answer

Ignore the pop-up and continue working.

Answer

Reboot the computer immediately.

Question 11

A technician is configuring a wireless network for a new office. The network must support legacy devices that only support WPA-TKIP, but the technician also wants to maximize security for modern devices. Which configuration should the technician use?

Accepted Answer

Set up a separate SSID with WPA-TKIP for legacy devices and another SSID with WPA2-AES for modern devices.. It isolates legacy WPA-TKIP devices on a separate SSID, preventing the weaker TKIP encryption from compromising the security of modern devices. Modern devices can then connect to a second SSID using WPA2-AES, which provides strong encryption (CCMP) and is not vulnerable to TKIP-specific attacks like Michael MIC exhaustion. This approach satisfies both requirements without forcing all devices onto a single, less secure configuration.

Answer

Enable WPA3-SAE for all devices.

Answer

Use WPA2-PSK with TKIP encryption.

Answer

Configure the router for WPA2-PSK with AES and enable WPA-TKIP as a fallback.

Question 12

A user's iPhone is experiencing random restarts and app crashes after installing a new configuration profile for email. The technician needs to remove the profile but cannot find it in Settings. What should the technician check?

Accepted Answer

Check Settings > General > VPN & Device Management. Configuration profiles are managed under Settings > General > VPN & Device Management. When a profile is installed (e.g., for email), it appears in this section, not in the main Settings list. If the profile is missing from the expected location, the technician should check here first to remove it and resolve the random restarts and app crashes.

Answer

Reset the iPhone's network settings

Answer

Use iTunes to restore the iPhone from a backup

Answer

Disable iCloud Keychain

Question 13

A network administrator is investigating a security incident where an attacker captured the 4-way handshake of a WPA2-PSK network and successfully cracked the passphrase. Which protocol change would most effectively prevent this type of attack in the future?

Accepted Answer

Upgrade to WPA3-SAE.. WPA3-SAE (Simultaneous Authentication of Equals) replaces the WPA2-PSK 4-way handshake with a protocol that uses a Diffie-Hellman key exchange, making it resistant to offline dictionary attacks. Even if an attacker captures the SAE handshake, they cannot crack the passphrase offline because the key exchange provides forward secrecy and prevents brute-force attempts without interacting with the network.

Answer

Switch to WPA2-Enterprise with 802.1X and a RADIUS server.

Answer

Increase the WPA2-PSK passphrase length to 63 characters.

Answer

Enable MAC address filtering on the access point.

Question 14

A user calls the help desk saying that after upgrading to macOS Ventura, the 'Documents' folder in the sidebar keeps disappearing after every reboot. They need it to stay visible. Which macOS feature or tool should you use to fix this?

Accepted Answer

Finder > Preferences > Sidebar. The visibility of folders like 'Documents' in the Finder sidebar is controlled directly through Finder's own preferences, not through global system settings. By opening Finder > Preferences > Sidebar, you can check the 'Documents' checkbox, which persists the folder's visibility across reboots. This setting is stored per-user in the Finder plist and is not affected by macOS upgrades.

Answer

System Settings > Desktop & Dock

Answer

Terminal command 'defaults write com.apple.finder ShowSidebar -bool true'

Answer

Spotlight Preferences

Question 15

A technician is tasked with disposing of a server that contains multiple SAS hard drives. The company's data destruction policy mandates that drives must be rendered unreadable by any means. Which combination of methods ensures compliance?

Accepted Answer

Use a degausser on each drive and then shred them.. Degaussing destroys the magnetic field on SAS hard drives, making data unrecoverable, and shredding physically destroys the platters, ensuring compliance with a policy that mandates drives be rendered unreadable by any means. This combination addresses both magnetic and physical recovery methods, which is necessary for high-security data destruction.

Answer

Perform a full format on each drive.

Answer

Overwrite each drive with zeros using a software tool.

Answer

Remove the drives and store them in a locked cabinet.