220-1102 Practice Test 30 — 15 Questions

Question 1

A user reports that their computer is running slowly after they installed a 'free system cleaner' from a pop-up ad. The technician suspects malware. What is the most appropriate first step in handling this situation professionally?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ask the user to describe exactly what they installed and from where, without sounding accusatory.. The first step in handling a potential malware infection professionally is to gather information from the user without judgment. Asking the user to describe what they installed and from where helps the technician understand the attack vector (e.g., a fake pop-up ad), which is critical for selecting the appropriate remediation steps and for any future security awareness training. This approach maintains trust and encourages the user to report issues promptly, which is essential for effective incident response.

Answer

Immediately run a full antivirus scan and quarantine any threats found.

Answer

Tell the user that installing software from pop-ups is dangerous and they should know better.

Answer

Remotely uninstall the program without informing the user.

Question 2

A user reports that their web browser frequently redirects to an unfamiliar search engine and displays pop-up ads even when no tabs are open. What is the most likely cause of this behavior?

Accepted Answer

The user has accidentally enabled a malicious browser extension.. The described behavior—unwanted redirects to an unfamiliar search engine and pop-up ads appearing even with no tabs open—is a classic symptom of adware or a malicious browser extension. Such extensions hijack browser settings, inject ads, and redirect search queries without the user's consent. Unlike a simple update or cache issue, this requires a malicious add-on that has been granted permissions to modify web content and navigation.

Answer

The browser needs to be updated to the latest version.

Answer

The internet connection is unstable and causing DNS errors.

Answer

The browser cache is full and needs to be cleared.

Question 3

A user reports that their browser crashes every time they visit a particular website. Other websites work fine. The technician tries the same website on another computer and it works normally. What is the most likely cause on the user's computer?

Accepted Answer

A browser extension is incompatible with that website.. The issue is isolated to a single website on one computer, and the same website works on another computer. This rules out network-wide or server-side problems. Browser extensions can inject scripts, modify headers, or block resources that a specific website requires, causing crashes. Disabling extensions or testing in incognito mode (which typically disables extensions) can confirm this.

Answer

The website has been blacklisted by the company's firewall.

Answer

The user's network adapter driver is outdated.

Answer

The website is using a newer version of TLS that the browser doesn't support.

Question 4

A user needs to access a shared folder on a Windows 10 workstation from their Windows 11 laptop. Both devices are on the same local network. Which Windows feature must be enabled on the workstation to allow file sharing?

Accepted Answer

File and Printer Sharing. File and Printer Sharing (option B) is the correct feature because it enables the Server Message Block (SMB) protocol on the workstation, which is the underlying protocol Windows uses for shared folder access. Without this service running and allowed through the firewall, other devices cannot connect to the workstation's shared resources, regardless of network discovery or firewall settings.

Answer

Network Discovery

Answer

HomeGroup

Answer

Windows Firewall

Question 5

A company is migrating to new laptops and needs to dispose of 50 old hard drives securely. The drives contain proprietary software and client data. The IT manager wants a method that is both environmentally friendly and compliant with data protection laws. Which disposal method should be chosen?

Accepted Answer

Use a certified e-waste recycler that offers secure destruction and recycling.. Certified e-waste recyclers follow strict data destruction standards (e.g., NIST SP 800-88) and environmental regulations (e.g., R2 or e-Stewards certification). This ensures the drives are physically destroyed or degaussed to prevent data recovery, while responsibly recycling materials, meeting both security and compliance requirements.

Answer

Donate the drives to a local charity after wiping them with a free tool.

Answer

Physically break the drives with a drill and dispose of them in the regular trash.

Answer

Perform a quick format and sell the drives online.

Question 6

A technician is troubleshooting a computer that has been infected with ransomware. The ransomware encrypted files and left a note demanding payment. After removing the malware, what is the most important step to prevent future infections?

Accepted Answer

Implement a strict backup policy and educate users on phishing. Ransomware often enters through phishing emails or unpatched vulnerabilities. While removing the malware is necessary, preventing future infections requires a combination of user education to avoid phishing attempts and a strict backup policy to ensure data can be restored without paying the ransom. Without addressing the root cause (user behavior and data resilience), the system remains vulnerable to reinfection.

Answer

Reinstall the operating system

Answer

Update all software to the latest versions

Answer

Disable all browser plugins

Question 7

A small office is decommissioning several SSDs from old laptops. The technician needs to ensure data is destroyed securely and the drives can be resold. Which method is most appropriate?

Accepted Answer

Use the ATA Secure Erase command.. The ATA Secure Erase command is the most appropriate method because it is specifically designed for SSDs, issuing a secure erase command at the firmware level that resets all cells to their unprogrammed state, effectively destroying all data in seconds. This method is reliable, fast, and does not wear out the NAND flash cells like multi-pass overwrites would, making it ideal for decommissioning and reselling SSDs.

Answer

Run a multi-pass overwrite with random data.

Answer

Degauss the SSDs to remove magnetic data.

Answer

Perform a standard delete and empty the recycle bin.

Question 8

A technician is configuring a company-issued iPhone for a new employee. After setting up the email account, the employee says they cannot receive emails, but they can send them. Which setting should the technician check first?

Accepted Answer

The incoming mail server (IMAP/POP3) settings.. The symptom—able to send but not receive emails—indicates a problem with the incoming mail server configuration. Sending uses SMTP (outgoing), while receiving uses IMAP or POP3 (incoming). The technician should first verify the incoming mail server settings (server hostname, port, SSL/TLS, and authentication) because a misconfiguration there would prevent the device from downloading new messages.

Answer

The outgoing mail server (SMTP) settings.

Answer

The device's date and time settings.

Answer

The phone's VPN configuration.

Question 9

A network administrator is investigating a security incident where an attacker captured the 4-way handshake of a WPA2-PSK network and successfully cracked the passphrase. Which protocol change would most effectively prevent this type of attack in the future?

Accepted Answer

Upgrade to WPA3-SAE.. WPA3-SAE (Simultaneous Authentication of Equals) replaces the WPA2-PSK 4-way handshake with a protocol that uses a Diffie-Hellman key exchange, making it resistant to offline dictionary attacks. Even if an attacker captures the SAE handshake, they cannot crack the passphrase offline because the key exchange provides forward secrecy and prevents brute-force attempts without interacting with the network.

Answer

Switch to WPA2-Enterprise with 802.1X and a RADIUS server.

Answer

Increase the WPA2-PSK passphrase length to 63 characters.

Answer

Enable MAC address filtering on the access point.

Question 10

A user calls the help desk saying that after upgrading to macOS Ventura, the 'Documents' folder in the sidebar keeps disappearing after every reboot. They need it to stay visible. Which macOS feature or tool should you use to fix this?

Accepted Answer

Finder > Preferences > Sidebar. The visibility of folders like 'Documents' in the Finder sidebar is controlled directly through Finder's own preferences, not through global system settings. By opening Finder > Preferences > Sidebar, you can check the 'Documents' checkbox, which persists the folder's visibility across reboots. This setting is stored per-user in the Finder plist and is not affected by macOS upgrades.

Answer

System Settings > Desktop & Dock

Answer

Terminal command 'defaults write com.apple.finder ShowSidebar -bool true'

Answer

Spotlight Preferences

Question 11

A technician is tasked with disposing of a server that contains multiple SAS hard drives. The company's data destruction policy mandates that drives must be rendered unreadable by any means. Which combination of methods ensures compliance?

Accepted Answer

Use a degausser on each drive and then shred them.. Degaussing destroys the magnetic field on SAS hard drives, making data unrecoverable, and shredding physically destroys the platters, ensuring compliance with a policy that mandates drives be rendered unreadable by any means. This combination addresses both magnetic and physical recovery methods, which is necessary for high-security data destruction.

Answer

Perform a full format on each drive.

Answer

Overwrite each drive with zeros using a software tool.

Answer

Remove the drives and store them in a locked cabinet.

Question 12

A technician is writing a Python script to automate the installation of software on multiple Windows machines. The script needs to check if the software is already installed by looking for a specific registry key. If the key exists, the script should skip the installation. Which Python library and method should the technician use to read the registry?

Accepted Answer

Use the 'winreg' module with 'OpenKey' and 'QueryValueEx'. The `winreg` module is the standard Python library for accessing the Windows registry. `OpenKey` opens a specified registry key, and `QueryValueEx` retrieves the value data and type for a given value name. This allows the script to check for the software's registry key and conditionally skip installation if it exists.

Answer

Use the 'os' module with 'os.regread'

Answer

Use the 'subprocess' module to run 'reg query'

Answer

Use the 'sys' module to access registry via system calls

Question 13

A security incident occurred where an unauthorized user gained access to a workstation. The security team needs to review detailed logs of all user logon attempts, including successful and failed logins, for the past 48 hours. Which administrative tool and specific log should you access to provide this information?

Accepted Answer

Event Viewer > Windows Logs > Security. Event Viewer's Windows Logs > Security log records all security-related events, including logon attempts (success and failure). This is the standard location for auditing user activity. Other logs like System or Application do not focus on authentication events.

Answer

Event Viewer > Windows Logs > System

Answer

Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager

Answer

Computer Management > System Tools > Shared Folders > Sessions

Question 14

A customer complains that their new smartphone connects to their home Wi-Fi but has no internet access. The router is configured with WPA2-PSK and a 64-character pre-shared key. Other devices work fine. What is the most likely cause?

Accepted Answer

The smartphone is using a wrong or mistyped Wi-Fi password.. The most likely cause is a mistyped or incorrect Wi-Fi password. Since the smartphone connects to the Wi-Fi network (association and authentication succeed at Layer 2) but has no internet access, the device is likely using a wrong pre-shared key that still allows partial connectivity due to WPA2-PSK's four-way handshake behavior—if the key is incorrect, the handshake fails, but some implementations may show a 'connected' status without proper encryption. Other devices work fine, ruling out router-side issues like DHCP exhaustion or DNS misconfiguration.

Answer

The smartphone's Wi-Fi antenna is faulty.

Answer

The router's DHCP server has run out of IP addresses.

Answer

The smartphone's DNS settings are misconfigured.

Question 15

A user reports that their Windows 10 PC is unable to connect to shared network folders on the office server. You need to verify that the necessary network discovery and file sharing services are running. Which administrative tool should you open to check the status of services like 'Function Discovery Resource Publication' and 'SSDP Discovery'?

Accepted Answer

Services.msc. The 'Services.msc' (Services console) is the dedicated Microsoft Management Console (MMC) snap-in used to start, stop, and configure Windows services. To verify that 'Function Discovery Resource Publication' (which publishes the machine's resources for network discovery) and 'SSDP Discovery' (which implements the Simple Service Discovery Protocol for UPnP devices) are running, you must open the Services console. Network and Sharing Center only shows connection status and sharing settings, not the underlying service state.

Answer

Network and Sharing Center

Answer

Device Manager

Answer

Task Manager