220-1102 Practice Test 34 — 15 Questions

Question 1

After a power outage, a Windows 10 computer boots to a black screen with the message 'Bootmgr is missing'. The technician has a Windows installation USB. Which repair command should be used to rebuild the Boot Configuration Data (BCD)?

Accepted Answer

Run 'bootrec /rebuildbcd'.. The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is corrupted or missing. The 'bootrec /rebuildbcd' command scans all disks for Windows installations and prompts you to add them to a new BCD store, directly rebuilding the BCD. This is the correct repair for a missing or corrupt BCD, which is the specific cause of this error.

Answer

From the recovery command prompt, run 'bootrec /fixmbr'.

Answer

Run 'bootrec /fixboot'.

Answer

Run 'sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows'.

Question 2

A user's Windows 11 PC displays a 'Critical Process Died' blue screen error after a recent Windows Update. The system boots into a recovery loop. Which advanced startup option should be used to remove the problematic update?

Accepted Answer

Boot into Safe Mode from the recovery environment and uninstall the latest update.. Option A is correct because booting into Safe Mode from the Windows Recovery Environment (WinRE) allows you to access the desktop with minimal drivers and services, then use Settings > Windows Update > Update History > Uninstall updates to remove the problematic cumulative update. This directly addresses the 'Critical Process Died' bugcheck (0x000000EF), which often results from a corrupted system file or driver conflict introduced by a recent update, and Safe Mode bypasses the crash loop to enable the uninstall.

Answer

Use System Restore to revert to a point before the update.

Answer

Run the Windows Memory Diagnostic tool to check for RAM issues.

Answer

Perform a clean installation of Windows 11 using the recovery USB.

Question 3

A user reports that their Windows 10 PC suddenly shows a 'Your IT administrator has limited access' message when trying to change the desktop background. The user has local administrator rights. Which Group Policy or registry setting is most likely misconfigured?

Accepted Answer

The 'Prevent changing desktop background' policy is enabled in Local Group Policy.. The 'Prevent changing desktop background' policy, when enabled in Local Group Policy Editor (gpedit.msc) under User Configuration > Administrative Templates > Control Panel > Personalization, explicitly blocks background changes regardless of local administrator rights. Since the user has local admin rights but still sees the restriction, this policy is the most likely cause, as it overrides user permissions.

Answer

The user's account is not part of the Administrators group.

Answer

The desktop background file is corrupted.

Answer

The Windows license has expired.

Question 4

A user's Windows 10 laptop fails to boot and shows 'INACCESSIBLE_BOOT_DEVICE' blue screen error. The technician suspects a recent driver update for the storage controller. Which recovery environment command can be used to disable the problematic driver from loading?

Accepted Answer

Run 'bcdedit /set {default} safeboot minimal' from the recovery command prompt.. The 'INACCESSIBLE_BOOT_DEVICE' error often occurs after a faulty storage controller driver update. Booting into Safe Mode with minimal drivers can bypass the problematic driver. The command 'bcdedit /set {default} safeboot minimal' configures the boot loader to start Windows in Safe Mode on the next restart, loading only essential drivers and services, which allows the technician to roll back or uninstall the offending driver.

Answer

Run 'diskpart' and then 'clean' to wipe the disk.

Answer

Run 'chkdsk /f' to fix file system errors.

Answer

Run 'bootrec /fixboot' to repair the boot sector.

Question 5

A user complains that their Windows 11 laptop's battery drains quickly even when idle. They have checked the Task Manager and no unusual processes are running. Which built-in tool should you use to generate a detailed report of battery usage and health?

Accepted Answer

Powercfg /batteryreport. Powercfg /batteryreport is the correct built-in tool because it generates a comprehensive HTML report detailing battery capacity history, usage patterns, and estimated life. This command analyzes the system's power efficiency and battery health, which directly addresses the user's complaint of rapid drain even when idle, without relying on running processes visible in Task Manager.

Answer

Resource Monitor

Answer

Performance Monitor

Answer

Windows Memory Diagnostic

Question 6

A customer reports that their Windows 10 desktop shows a black screen with a movable cursor after logging in. They can press Ctrl+Alt+Del and open Task Manager. Which process should be restarted from Task Manager to restore the desktop and taskbar?

Accepted Answer

Restart the 'Windows Explorer' process in Task Manager.. The black screen with a movable cursor after login, combined with the ability to open Task Manager via Ctrl+Alt+Del, indicates that the Windows shell (explorer.exe) has crashed or is not running. Restarting the 'Windows Explorer' process from Task Manager (File > Run new task > 'explorer.exe') reloads the desktop, taskbar, and File Explorer, restoring the graphical user interface. This is the standard recovery step for a missing shell in Windows 10.

Answer

End the 'svchost.exe' process group.

Answer

Start the 'winlogon.exe' process.

Answer

Run 'msconfig' from the Run dialog to enable normal startup.

Question 7

A user calls the help desk because their Windows 10 laptop will not connect to any Wi-Fi network. The Wi-Fi adapter is enabled in Device Manager and shows no errors, but the network list is empty. Other devices connect fine. Which command should be run first to reset the network stack?

Accepted Answer

Run 'netsh winsock reset' from an elevated Command Prompt.. The 'netsh winsock reset' command is the correct first step because it resets the Winsock catalog, which manages network I/O and API calls. When the Wi-Fi adapter shows no errors but the network list is empty, the issue is often a corrupted Winsock configuration rather than a driver or service failure. This command restores the Winsock stack to a clean state without requiring a reboot, making it the most direct fix for this specific symptom.

Answer

Run 'ipconfig /release' followed by 'ipconfig /renew'.

Answer

Run 'sfc /scannow' to check system files.

Answer

Run 'net start wlansvc' to start the WLAN AutoConfig service.

Question 8

A technician is troubleshooting a Windows 10 PC that was infected with a rootkit. After booting from a rescue disk and running a scan, the rootkit is removed, but the system is still unstable. What should the technician do next to ensure the system is fully remediated?

Accepted Answer

Run the System File Checker (SFC) tool to repair corrupted files.. After removing a rootkit, the system may have corrupted system files that cause instability. Running the System File Checker (SFC) tool with the 'sfc /scannow' command scans protected system files and replaces corrupted versions with cached copies from the Windows side-by-side store, directly addressing file integrity issues left by the rootkit.

Answer

Reinstall the operating system from scratch.

Answer

Disable System Restore and delete all restore points.

Answer

Perform a disk cleanup to remove temporary files.

Question 9

A company has a policy that all workstations must automatically lock after 10 minutes of inactivity. A user complains that their computer does not lock automatically. Which setting should you check and remediate?

Accepted Answer

Verify that the screen saver is enabled and set to 'On resume, display logon screen' with a 10-minute wait. Option B is correct because the automatic lock behavior in Windows is controlled by the screen saver settings. When 'On resume, display logon screen' is enabled with a 10-minute wait, the screen saver triggers after inactivity and locks the workstation by requiring authentication upon resume. This is the standard mechanism for enforcing a lock timeout, not the power plan sleep timeout.

Answer

Check the power plan settings for sleep timeout

Answer

Ensure Windows Update is fully installed

Answer

Disable the Fast Startup feature

Question 10

A user reports that their Windows 10 PC is infected with a virus that keeps reappearing after removal. The technician boots into Safe Mode, runs a full antivirus scan, and removes the threat. However, after rebooting normally, the virus returns. What is the most likely reason?

Accepted Answer

The virus has a persistence mechanism, such as a scheduled task or registry run key.. Option B is correct because the virus likely uses a persistence mechanism such as a scheduled task (via schtasks.exe) or a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to re-infect the system after boot. Safe Mode may bypass some of these mechanisms, but a normal boot re-triggers them, allowing the virus to reinstall itself even after the initial removal.

Answer

The antivirus definitions are outdated.

Answer

The user is re-downloading the virus from the same source.

Answer

The virus is a polymorphic variant that changes its signature.

Question 11

A customer reports that their computer is running slowly and they see pop-up ads even when no browser is open. They suspect malware. Which of the following should you perform first to remediate this issue?

Accepted Answer

Disconnect the computer from the network. Disconnecting the computer from the network is the first step because it immediately stops the malware from communicating with its command-and-control (C2) server, preventing further data exfiltration, additional payload downloads, or remote control. This containment step is critical before any remediation (like scanning or rebooting) to avoid the malware spreading or causing more damage.

Answer

Run a full antivirus scan

Answer

Reboot the computer in Safe Mode

Answer

Restore from a recent backup

Question 12

During a security audit, you need to identify all user accounts that have been created or modified in the last 24 hours on a Windows Server. Which command-line tool can parse security event logs to extract this information?

Accepted Answer

wevtutil qe Security /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]". The wevtutil command with the 'qe' (query-events) parameter and an XPath filter can directly query the Security event log for events created within a specific time window. The filter '*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]' retrieves events whose creation time is within the last 86,400,000 milliseconds (24 hours), allowing you to identify user accounts created or modified via event IDs such as 4720 (user created) or 4738 (user changed).

Answer

eventvwr

Answer

net user

Answer

diskpart

Question 13

A small business owner wants to ensure that if a laptop is stolen, the data on the drive cannot be read. The laptop runs Windows 11 Pro. What is the most appropriate remediation?

Accepted Answer

Enable BitLocker on the system drive. BitLocker is the native full-disk encryption feature in Windows 11 Pro that encrypts the entire system drive, including the operating system, applications, and all user data. If the laptop is stolen, the data on the drive remains unreadable without the recovery key or TPM authentication, even if the drive is removed and attached to another computer. This directly addresses the requirement to prevent data access after theft.

Answer

Set a strong BIOS password

Answer

Install an antivirus with anti-theft features

Answer

Use a cloud backup service

Question 14

A user's computer is infected with adware that changes the browser homepage and displays constant pop-ups. After removing the adware with an antivirus, the homepage remains changed. What additional remediation step should you take?

Accepted Answer

Reset the browser settings to default. After adware removal, the browser's homepage and settings are often stored in the browser's configuration files or registry keys that the antivirus does not reset. Resetting the browser settings to default restores the homepage, search engine, and new tab page to their original state, clearing any persistent malicious configurations left behind by the adware.

Answer

Reinstall the operating system

Answer

Run a disk cleanup utility

Answer

Update the antivirus definitions and scan again

Question 15

A company policy requires that all USB flash drives be encrypted before use. A technician needs to configure a new drive for a manager who will store confidential client data. Which built-in Windows tool should the technician use?

Accepted Answer

BitLocker To Go. BitLocker To Go is the correct built-in Windows tool for encrypting removable drives like USB flash drives. It provides full-disk encryption specifically designed for portable storage, ensuring that the confidential client data on the drive is protected if the drive is lost or stolen.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Firewall

Answer

Device Manager