220-1102 Practice Test 29 — 15 Questions

Question 1

A school IT administrator needs to remotely lock a lost MacBook and display a custom message with contact information. The MacBook is enrolled in the school’s MDM and has an internet connection. Which macOS feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Find My Mac. Find My Mac is the correct feature because it is specifically designed to locate, lock, and display a custom message on a lost Apple device that is enrolled in MDM and connected to the internet. It leverages Apple's Activation Lock and MDM integration to remotely lock the Mac and present a contact message on the Lock screen, fulfilling the administrator's requirement without needing physical access.

Answer

Remote Desktop

Answer

FileVault

Answer

Terminal command 'sudo pmset'

Question 2

A user reports that Windows automatically installs a generic driver for a new graphics card that causes display issues. You need to change Windows settings to prevent automatic driver downloads from Windows Update. Which Control Panel tool allows you to change this behavior?

Accepted Answer

System > Advanced system settings > Hardware > Device Installation Settings. The Device Installation Settings (System > Advanced system settings > Hardware > Device Installation Settings) allow you to choose whether Windows automatically downloads drivers and realistic icons for your devices from Windows Update. Setting this to 'No' prevents automatic driver installations. This does not affect driver signing enforcement, which is configured via bcdedit or advanced startup options.

Answer

Device Manager

Answer

Programs and Features > Turn Windows features on or off

Answer

Administrative Tools > Services

Question 3

A user reports that their Windows 10 PC is infected with a virus that keeps reappearing after removal. The technician boots into Safe Mode, runs a full antivirus scan, and removes the threat. However, after rebooting normally, the virus returns. What is the most likely reason?

Accepted Answer

The virus has a persistence mechanism, such as a scheduled task or registry run key.. The virus likely uses a persistence mechanism such as a scheduled task (via schtasks.exe) or a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to re-infect the system after boot. Safe Mode may bypass some of these mechanisms, but a normal boot re-triggers them, allowing the virus to reinstall itself even after the initial removal.

Answer

The antivirus definitions are outdated.

Answer

The user is re-downloading the virus from the same source.

Answer

The virus is a polymorphic variant that changes its signature.

Question 4

During a security audit, you find that a configuration file /etc/app/config.cfg has permissions -rwxrwxrwx. What command should you run to restrict it so only the owner can read and write, and the group can read, while others have no access?

Accepted Answer

chmod 640 /etc/app/config.cfg. The requirement is to set permissions so the owner can read and write (6), the group can read (4), and others have no access (0). The octal representation 640 achieves exactly this: 6 (rw-) for owner, 4 (r--) for group, and 0 (---) for others. This matches the security policy of restricting access to only the owner and group read access.

Answer

chmod 750 /etc/app/config.cfg

Answer

chmod 644 /etc/app/config.cfg

Answer

chmod 600 /etc/app/config.cfg

Question 5

During a security audit, you discover that a supply closet containing spare hard drives has a door that can be opened with a standard paperclip. What is the most appropriate recommendation to address this vulnerability?

Accepted Answer

Upgrade the lock to a tamper-resistant electronic lock.. The vulnerability is a weak physical lock that can be bypassed with a simple tool. Upgrading to a tamper-resistant electronic lock, such as one with a keypad or biometric reader, significantly increases the difficulty of unauthorized entry. This directly addresses the core issue of inadequate access control for sensitive assets like spare hard drives.

Answer

Replace the door with a solid-core door and install a deadbolt.

Answer

Install a privacy filter on the closet door window.

Answer

Place a sign on the door warning of security cameras.

Question 6

A user on Windows 11 is trying to install a new application, but receives the error 'Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.' The user is a local administrator. What is the most likely cause?

Accepted Answer

The file has been blocked by Windows because it was downloaded from the internet.. Even local administrators can be blocked from running executables that were downloaded from the internet because Windows marks them with a zone identifier. The 'Unblock' button in the file's Properties removes this mark, allowing the file to run. This is a common security feature in Windows to prevent accidental execution of potentially unsafe files.

Answer

The file is corrupted and needs to be re-downloaded.

Answer

User Account Control (UAC) is blocking the installation.

Answer

The user does not have 'Read & Execute' permissions on the file.

Question 7

A technician needs to write a batch script that will copy a configuration file from a network share to the local system32 directory only if the file on the share is newer than the local copy. Which command should the technician use to perform this conditional copy?

Accepted Answer

xcopy \server\share\config.txt C:\Windows\System32\ /d /y. The `xcopy` command with the `/d` switch copies files only if the source file is newer than the destination file, and `/y` suppresses confirmation prompts. This meets the requirement of a conditional copy based on file timestamp comparison.

Answer

copy /y \server\share\config.txt C:\Windows\System32\

Answer

robocopy \server\share C:\Windows\System32 config.txt /mir

Answer

move /y \server\share\config.txt C:\Windows\System32\

Question 8

A customer complains that their computer emits a strong chemical smell and is unusually hot. After inspection, you find the power supply is failing and leaking a brown, oily substance. How should you handle the power supply disposal?

Accepted Answer

Put the power supply in an anti-static bag, seal it, and label it as hazardous e-waste.. A failing power supply leaking a brown, oily substance (typically from swollen or ruptured capacitors) is classified as hazardous e-waste due to toxic materials like lead, cadmium, and electrolyte fluids. Placing it in an anti-static bag prevents short circuits during transport, and labeling it as hazardous ensures proper disposal per environmental regulations such as the Resource Conservation and Recovery Act (RCRA) or local e-waste directives.

Answer

Place the power supply in a standard trash bag and throw it in the dumpster.

Answer

Clean the power supply with isopropyl alcohol and then recycle it normally.

Answer

Disassemble the power supply to remove the leaking capacitor and then dispose of the rest.

Question 9

A user installs a new application and immediately receives a 'The application was unable to start correctly (0xc000007b)' error. The application worked on another computer with the same Windows version. Which component is most likely causing this error?

Accepted Answer

The Visual C++ Redistributable package is missing or corrupted.. Error code 0xc000007b is a STATUS_INVALID_IMAGE_FORMAT error, typically indicating a mismatch between 32-bit and 64-bit binaries. The most common cause is a missing or corrupted Visual C++ Redistributable package, which provides essential runtime libraries (e.g., MSVCR120.dll) that the application depends on. Without these libraries, the application cannot load correctly, even if the Windows version matches.

Answer

The application requires a newer version of DirectX.

Answer

The user does not have administrative privileges.

Answer

The hard drive has bad sectors affecting the application files.

Question 10

A technician is configuring a new Windows 11 workstation for a user who frequently downloads free software. To reduce the risk of malware infections from bundled applications, which security setting should be enabled?

Accepted Answer

Set User Account Control to always notify.. User Account Control (UAC) set to 'Always notify' is the correct choice because it prompts the user for consent or credentials whenever an application (including bundled installers) attempts to make system-level changes. This gives the user a chance to review and block unauthorized installations, directly reducing the risk of malware from bundled freeware. The other options address different security concerns: Application Guard isolates browser sessions, Firewall controls network traffic, and BitLocker encrypts data at rest.

Answer

Enable Windows Defender Application Guard.

Answer

Turn on Windows Firewall with advanced logging.

Answer

Enable BitLocker drive encryption.

Question 11

A technician is decommissioning a RAID array of 10 hard drives that contained sensitive HR data. The company policy requires that data be destroyed without removing individual drives from the array. Which method is most appropriate?

Accepted Answer

Use a degausser that can accommodate the entire array chassis.. To use a degausser designed for large media, which can destroy data on all drives simultaneously without disassembly. However, this may damage the RAID controller. Alternatively, a bulk eraser could be used. This question tests understanding of bulk destruction methods for RAID arrays.

Answer

Remove each drive and use a hammer to break the platters.

Answer

Perform a secure erase on each drive via the RAID controller.

Answer

Reformat the array and reuse it for non-sensitive data.

Question 12

A technician is setting up a wireless network for a small office that handles sensitive client data. The office has a mix of modern laptops and a few legacy printers that only support WEP. What should the technician do to maintain security while keeping the printers functional?

Accepted Answer

Create a separate VLAN for the printers using WEP and a strong passphrase, and keep the main network on WPA2.. It isolates the insecure WEP-based printers on a separate VLAN, preventing their weak encryption from compromising the main network which uses WPA2. This allows the legacy printers to remain functional while sensitive client data on the main network is protected by the stronger WPA2 protocol.

Answer

Enable WEP on the main router and set a complex 128-bit key.

Answer

Replace the printers with modern ones that support WPA2.

Answer

Set the router to mixed mode (WEP + WPA2) and use a single SSID.

Question 13

A user reports that their computer is infected with a virus and they have been trying to remove it using a free online scanner, but the problem persists. The technician suspects the malware may have disabled the antivirus software. Which safe mode should the technician use to run a full system scan?

Accepted Answer

Safe Mode with Networking. Safe Mode with Networking (C) is correct because it loads only essential drivers and services, including network components, which allows the technician to run a full system scan while the malware is likely inactive. Since the malware may have disabled the antivirus software in normal mode, booting into Safe Mode with Networking ensures the antivirus can run and still access the internet for signature updates or cloud-based scanning.

Answer

Safe Mode

Answer

Safe Mode with Command Prompt

Answer

Last Known Good Configuration

Question 14

A user reports that their Windows 10 PC is unable to connect to network shares on a server, but internet access works fine. You suspect the 'Workstation' service is not running. Which administrative tool should you use to verify and start this service?

Accepted Answer

Services console to locate the 'Workstation' service and start it.. The 'Workstation' service (LanmanWorkstation) is a core Windows service that enables the computer to initiate outbound SMB connections to network shares. The Services console (services.msc) is the correct administrative tool to check the status of this service and start it if it is stopped. Option C directly addresses the need to verify and manage this service.

Answer

Task Manager > Startup tab to check if the service is enabled.

Answer

Network and Sharing Center to run the network troubleshooter.

Answer

Device Manager to reinstall the network adapter driver.

Question 15

A user reports that after a recent Windows update, they can no longer install a legacy application that requires write access to the Program Files folder. The user is a local administrator. What Windows security setting is most likely blocking the installation?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) is the Windows security feature that prompts for consent or credentials before allowing actions that require administrative privileges, even for local administrators. By default, UAC virtualizes write attempts to protected system locations like Program Files, redirecting them to a per-user virtual store, which can cause legacy applications that expect direct write access to fail. Disabling UAC or running the installer with explicit administrative rights (e.g., right-click 'Run as administrator') typically resolves the issue.

Answer

BitLocker Drive Encryption

Answer

Windows Defender Firewall

Answer

Group Policy Software Restrictions