220-1102 Practice Test 33 — 15 Questions

Question 1

A user reports that their Windows 10 computer is displaying a 'Your IT department has limited access to some features of this app' message when trying to run a legacy application. The application worked before the latest Windows update. Which security feature is most likely causing this issue?

Accepted Answer

Windows Defender Application Guard. Windows Defender Application Guard (WDAG) is a security feature that isolates untrusted applications in a Hyper-V container, restricting their access to system resources. The 'Your IT department has limited access to some features of this app' message indicates that WDAG is blocking the legacy application, likely because the app is not trusted or is being treated as untrusted after a Windows update that tightened WDAG policies.

Answer

Windows Defender Firewall with Advanced Security

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 2

A small business owner wants to ensure that employees cannot install browser extensions or add-ons without administrator approval. Which method should the technician use to enforce this restriction across all company computers?

Accepted Answer

Use Group Policy to disable extension installation.. Group Policy (specifically the Administrative Templates for Google Chrome, Microsoft Edge, or Firefox) provides a centralized method to enforce browser settings across all domain-joined computers. By configuring the 'Block external extensions' or 'ExtensionInstallBlockList' policy, the technician can prevent users from installing extensions without administrator approval, ensuring consistent enforcement without manual intervention on each machine.

Answer

Configure each browser's settings manually on every computer.

Answer

Install a third-party firewall to block extension downloads.

Answer

Set the browser to private browsing mode.

Question 3

A technician is decommissioning a server that uses a hardware RAID controller. The company policy requires that all data be destroyed, but the drives must be returned to the leasing company. Which method ensures data is unrecoverable while preserving the drives?

Accepted Answer

Use the RAID controller's built-in 'secure erase' or 'low-level format' command.. Option C is correct because the RAID controller's built-in 'secure erase' or 'low-level format' command issues the ATA Secure Erase command (or SCSI equivalent) directly to each drive, which overwrites all user-accessible data areas and often the hidden RAID metadata, making data unrecoverable. This method preserves the physical drives for return to the leasing company, as required by policy, and is the only option that both destroys data and leaves the drives functional.

Answer

Remove the drives and use a degausser on each one.

Answer

Perform a secure erase using a bootable utility like DBAN.

Answer

Physically drill through the drive enclosures.

Question 4

During a routine hardware refresh, a technician finds a box of old USB flash drives that were used to store temporary project files. The drives are to be given to employees for personal use. What is the most practical way to ensure no project data remains?

Accepted Answer

Use a diskpart clean all command to overwrite every sector.. Option B is correct because the 'diskpart clean all' command writes zeros or other patterns to every sector of the drive, ensuring that all previously stored data, including temporary project files, is overwritten and cannot be recovered using standard file recovery tools. This is the most practical method for sanitizing USB flash drives before repurposing them for personal use, as it meets the data destruction requirements without physically destroying the media.

Answer

Delete all files and empty the Recycle Bin.

Answer

Microwave the flash drives to destroy the chips.

Answer

Reformat the drives with a quick format.

Question 5

A healthcare clinic is disposing of 50 hard drives that contained protected health information (PHI). The compliance officer insists on a method that meets HIPAA requirements and provides a certificate of destruction. Which approach should be taken?

Accepted Answer

Hire a certified e-waste recycler to physically shred the drives and provide a certificate of destruction.. Option C is correct because HIPAA requires that PHI on electronic media be rendered permanently unreadable and unrecoverable, and physical destruction (e.g., shredding) is the only method that guarantees this for hard drives. A certified e-waste recycler provides a certificate of destruction, which serves as the required documentation of compliance. Overwriting, degaussing, or cryptographic erase may not be sufficient or verifiable for all drives, especially if they are being disposed of rather than reused.

Answer

Overwrite the drives with zeros and reuse them in non-patient areas.

Answer

Use a degausser and then recycle the drives as scrap metal.

Answer

Perform a cryptographic erase if the drives support it.

Question 6

A user reports that their MacBook Air running macOS Monterey will not connect to a Wi-Fi network that other devices can connect to. The Wi-Fi menu shows the network but clicking it does nothing. Which macOS tool should you use to reset the Wi-Fi configuration?

Accepted Answer

Wireless Diagnostics. Wireless Diagnostics is the correct tool because it includes a dedicated 'Wi-Fi Reset' option under the Window menu (or accessible via the 'Utilities' menu in some versions). This option resets Wi-Fi configuration without requiring manual removal of plist files or terminal commands. Network Utility is deprecated and not used for Wi-Fi resets. System Information provides hardware/software info but cannot reset Wi-Fi. The ifconfig command can bring the interface down but does not reset persistent Wi-Fi settings.

Answer

Network Utility

Answer

System Information > Wi-Fi

Answer

Terminal command 'sudo ifconfig en0 down'

Question 7

A user in the accounting department cannot print to a network printer that other users can access. They are running Windows 10. When they try to print, they get a message: 'Windows cannot connect to the printer. Access is denied.' What is the most likely cause of this issue?

Accepted Answer

The user does not have permission to use the printer.. The error message 'Access is denied' specifically indicates a permissions issue at the printer or print server level, not a connectivity or hardware problem. Since other users can print successfully, the printer and network are functional, isolating the cause to the user's lack of permission to use the printer. In Windows, printer permissions are managed via the Security tab in printer properties, where the 'Print' permission must be granted to the user or their group.

Answer

The printer driver is corrupt on the user's computer.

Answer

The network cable is unplugged from the user's computer.

Answer

The printer is out of paper or toner.

Question 8

A security auditor discovers that a company's data destruction logs show only a quick format was performed on drives before disposal. The drives contained personally identifiable information (PII). What is the primary risk?

Accepted Answer

The PII data is still recoverable from the drives.. A quick format only clears the file system metadata (e.g., the Master File Table on NTFS) and marks the drive's sectors as available for new data, but it does not overwrite the actual data stored in those sectors. Because the PII data remains physically on the platters or NAND cells, it can be easily recovered using file recovery tools or forensic software. This makes the data destruction process incomplete and poses a severe compliance and privacy risk.

Answer

The drives may not boot properly after disposal.

Answer

The drives could be reused without any issues.

Answer

The drives will no longer hold a magnetic charge.

Question 9

A small business is upgrading its workstations and needs to dispose of 20 old hard drives that contain confidential payroll records. The company wants the lowest-cost method that ensures data cannot be recovered. Which disposal method should be recommended?

Accepted Answer

Drill holes through the platters of each drive.. Drilling holes through the platters physically destroys the magnetic surfaces, making data recovery impossible without specialized cleanroom equipment. This is the lowest-cost method that guarantees destruction because it directly damages the storage medium beyond repair, unlike degaussing which may not work on modern SSDs or high-coercivity drives.

Answer

Use a degausser on each drive.

Answer

Perform a standard format on each drive.

Answer

Reformat the drives and install a fresh OS.

Question 10

A company is decommissioning a data center and must destroy 1000 HDDs and 200 SSDs. The policy mandates that all data be destroyed on-site and that the drives be rendered physically unusable. Which combination of methods is most efficient?

Accepted Answer

Use a hard drive shredder to shred all drives.. Option B is correct because shredding physically destroys both HDDs and SSDs in a single pass, meeting the policy requirement for on-site destruction and rendering drives physically unusable. Degaussing is ineffective for SSDs due to their flash memory, and overwriting is too slow for 1000 drives and also ineffective for SSDs with TRIM or wear-leveling. Shredding is the most efficient method for mixed media at scale.

Answer

Degauss all drives and then recycle them.

Answer

Overwrite all drives with a three-pass wipe.

Answer

Use a degausser for HDDs and a secure erase for SSDs.

Question 11

A user reports that their MacBook Air running macOS Monterey is running slowly and they suspect a startup item is consuming resources. They want to see which applications launch automatically at login and disable unnecessary ones. Which macOS tool should they use?

Accepted Answer

System Settings > General > Login Items.. Option B is correct because macOS Monterey's System Settings (formerly System Preferences) includes a dedicated 'Login Items' pane under General that allows users to view and disable applications that launch automatically at login. This is the intended graphical interface for managing startup items, directly addressing the user's need to identify and disable unnecessary login applications without requiring command-line tools or performance monitors.

Answer

Activity Monitor and sort by CPU usage.

Answer

Terminal with the 'launchctl list' command.

Answer

Force Quit Applications window.

Question 12

A user reports that their Windows 10 PC is running slowly and they suspect a background process is consuming excessive memory. Which command-line tool should you use to identify the process by name and memory usage?

Accepted Answer

tasklist. The `tasklist` command displays a list of all currently running processes on a Windows system, including their process ID (PID), session name, session number, and memory usage. By default, it shows memory consumption in kilobytes, allowing you to identify which process is consuming excessive memory by name. This makes it the correct tool for diagnosing a memory-hungry background process.

Answer

ipconfig

Answer

chkdsk

Answer

sfc

Question 13

A security audit reveals that a Windows 10 workstation has an unauthorized local user account. You need to remove this account from the command line without using the GUI. Which command should you use?

Accepted Answer

net user UnauthorizedUser /delete. The `net user UnauthorizedUser /delete` command correctly removes a local user account from the command line. The `net user` command is designed to manage local user accounts, and the `/delete` switch removes the specified account from the local Security Accounts Manager (SAM) database. This is the standard Windows CLI tool for deleting a local user without using the GUI.

Answer

net localgroup Administrators UnauthorizedUser /delete

Answer

wmic useraccount where name='UnauthorizedUser' delete

Answer

gpresult /r

Question 14

A technician needs to map a network drive to a shared folder on a file server for a user who frequently works remotely. The share path is \Server\Data. Which command would you use to persistently map this drive as drive letter Z:?

Accepted Answer

net use Z: \Server\Data /persistent:yes. Option B is correct because the `net use` command is used to map a network share to a drive letter, and the `/persistent:yes` switch ensures the mapping is reconnected automatically after a reboot or network interruption, which is essential for a user who works remotely. The syntax `net use Z: \Server\Data /persistent:yes` correctly specifies the drive letter, UNC path, and persistence flag.

Answer

net user Z: \Server\Data /add

Answer

chkdsk Z: /f

Answer

ipconfig /renew

Question 15

A user installs a new application and immediately receives a 'The application was unable to start correctly (0xc000007b)' error. The application worked on another computer with the same Windows version. Which component is most likely causing this error?

Accepted Answer

The Visual C++ Redistributable package is missing or corrupted.. Error code 0xc000007b is a STATUS_INVALID_IMAGE_FORMAT error, typically indicating a mismatch between 32-bit and 64-bit binaries. The most common cause is a missing or corrupted Visual C++ Redistributable package, which provides essential runtime libraries (e.g., MSVCR120.dll) that the application depends on. Without these libraries, the application cannot load correctly, even if the Windows version matches.

Answer

The application requires a newer version of DirectX.

Answer

The user does not have administrative privileges.

Answer

The hard drive has bad sectors affecting the application files.