220-1102 Practice Test 35 — 15 Questions

Question 1

A technician discovers that a Windows 10 workstation has been infected with a fileless malware that resides in memory. Traditional antivirus scans have not detected it. Which approach should the technician use to remove this type of malware?

Accepted Answer

Boot from a rescue disk and perform an offline scan.. Fileless malware resides entirely in memory (RAM) and does not write persistent files to disk, so traditional antivirus scans that rely on file signatures cannot detect it. Booting from a rescue disk (e.g., a bootable USB or CD with an offline scanner) loads a clean operating system that bypasses the infected Windows environment, allowing the scanner to inspect memory and terminate the malware without the malware being able to hide or protect itself. This offline approach ensures the malware's process cannot interfere with the scan, making it the correct remediation method.

Answer

Run a full antivirus scan in normal mode.

Answer

Use the Windows Malicious Software Removal Tool (MSRT) in Safe Mode.

Answer

Restore the system from a backup taken before the infection.

Question 2

A small business owner wants to ensure that all company laptops are protected in case of theft. They need a solution that encrypts the entire hard drive and requires a pre-boot PIN. Which security feature should you implement?

Accepted Answer

Enable BitLocker with a TPM + startup PIN.. BitLocker with a TPM + startup PIN provides full-disk encryption and requires a pre-boot authentication PIN, meeting the requirement to protect the entire hard drive in case of theft. The TPM validates system integrity, and the PIN must be entered before the OS loads, preventing unauthorized access even if the drive is removed.

Answer

Enable EFS (Encrypting File System) on the Documents folder.

Answer

Set a BIOS password.

Answer

Install a third-party antivirus with encryption.

Question 3

A small business owner wants to ensure that all company laptops have their hard drives encrypted in case of theft. The laptops run Windows 10 Pro. Which technology should the technician enable to meet this requirement?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption (option C) is the correct technology because it provides full-disk encryption for Windows 10 Pro, ensuring that all data on the laptop's hard drive is encrypted at rest. This protects against data exposure if the device is stolen, as the drive cannot be accessed without the decryption key (e.g., a PIN, USB key, or TPM-based authentication). BitLocker is built into Windows 10 Pro and is specifically designed for whole-drive encryption, meeting the requirement for all company laptops.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Antivirus

Answer

TPM (Trusted Platform Module)

Question 4

A company's security policy requires that all workstations use a host-based firewall to block incoming connections except for specific allowed applications. A technician needs to configure this on a Windows 10 PC. Which tool should they use?

Accepted Answer

Windows Defender Firewall with Advanced Security. The Windows Defender Firewall with Advanced Security (wf.msc) is the correct tool because it provides granular control over inbound rules, allowing the technician to block all incoming connections by default and then create explicit allow rules for specific applications. This meets the security policy requirement for a host-based firewall that blocks incoming traffic except for permitted applications.

Answer

Windows Defender Antivirus settings

Answer

Group Policy Editor

Answer

Network and Sharing Center

Question 5

A technician is configuring a company-issued iPhone for a new employee. After setting up the email account, the employee says they cannot receive emails, but they can send them. Which setting should the technician check first?

Accepted Answer

The incoming mail server (IMAP/POP3) settings.. The symptom—able to send but not receive emails—indicates a problem with the incoming mail server configuration. Sending uses SMTP (outgoing), while receiving uses IMAP or POP3 (incoming). The technician should first verify the incoming mail server settings (server hostname, port, SSL/TLS, and authentication) because a misconfiguration there would prevent the device from downloading new messages.

Answer

The outgoing mail server (SMTP) settings.

Answer

The device's date and time settings.

Answer

The phone's VPN configuration.

Question 6

A user reports that their Windows 10 PC is infected with a virus that changes the desktop background to a ransom note. After removing the virus with antivirus software, the desktop background remains unchanged. What should you do to restore the original background?

Accepted Answer

Check Group Policy settings for desktop wallpaper enforcement and reset them.. Option C is correct because the virus likely modified the Group Policy setting that enforces a specific desktop wallpaper. Even after the virus is removed, the Group Policy setting persists and overrides any user attempts to change the background. Resetting the Group Policy wallpaper enforcement restores the user's ability to change the background normally.

Answer

Reinstall the graphics driver.

Answer

Run System File Checker (sfc /scannow).

Answer

Perform a system restore to a point before the infection.

Question 7

A company's security policy mandates that all USB flash drives must be encrypted before use. A user inserts a new USB drive and wants to encrypt it on a Windows 10 Pro workstation. Which built-in tool should be used?

Accepted Answer

Enable BitLocker To Go on the USB drive.. BitLocker To Go is the built-in Windows 10 Pro feature specifically designed to encrypt removable drives such as USB flash drives. It uses AES encryption to protect the entire volume, and the drive can be accessed only with a password, smart card, or recovery key. This directly satisfies the company's mandate for encrypting USB drives before use.

Answer

Use EFS (Encrypting File System) on the USB drive.

Answer

Format the drive as exFAT and set a password.

Answer

Use the cipher command to encrypt the drive.

Question 8

A user reports that their iPhone's flashlight is not working, and the camera app shows a black screen. Other apps function normally. The device is up-to-date and has been restarted. What is the most likely hardware-related issue?

Accepted Answer

The camera module or its flex cable is damaged.. The simultaneous failure of the flashlight and camera strongly points to a shared hardware component failure. Both the camera module and the LED flash are typically integrated on the same flex cable assembly or share a common power management IC. Since other apps function normally and the device has been restarted, a hardware fault in the camera module or its flex cable is the most likely cause.

Answer

The battery is failing and cannot provide enough power.

Answer

The camera app is corrupted; reinstall it.

Answer

The iOS has a bug that affects the camera and flashlight.

Question 9

A technician is troubleshooting a Windows 11 system that intermittently loses network connectivity. They need to continuously monitor the connection to a remote server and log the results to a text file for analysis. Which command should they use?

Accepted Answer

ping -t > log.txt. Option B is correct because the `ping -t` command continuously sends ICMP Echo Request packets to the remote server until manually stopped, which allows the technician to monitor intermittent connectivity issues over an extended period. The `> log.txt` redirection operator captures all output (timestamps and replies) into a text file for later analysis, making it ideal for troubleshooting sporadic network drops.

Answer

ping -n 100 > log.txt

Answer

tracert -d > log.txt

Answer

pathping > log.txt

Question 10

A user on an Android tablet reports that the Google Play Store is not downloading any apps, showing an error message about insufficient storage. The device's storage settings show 2GB free. What should you do first?

Accepted Answer

Clear the cache and data of the Google Play Store app.. Clearing the cache and data of the Google Play Store app is the correct first step because the error message about insufficient storage, despite 2GB free, often indicates a corrupted cache or data within the Play Store itself. This corruption can cause the Play Store to misreport storage availability or fail to initialize downloads. Clearing these app-specific files forces the Play Store to rebuild its state, resolving the false positive without affecting user data or requiring additional free space.

Answer

Factory reset the tablet.

Answer

Uninstall large apps to free up more storage.

Answer

Check for a system update.

Question 11

A technician is troubleshooting an iPhone that fails to activate after a software update. The phone displays 'Activation Error' and the SIM card is known to be working. Which of the following steps should the technician perform FIRST?

Accepted Answer

Check Apple's System Status page for activation server outages.. The 'Activation Error' after a software update typically indicates that the iPhone cannot reach Apple's activation servers to verify its eligibility. Since the SIM card is known to be working, the most logical first step is to check Apple's System Status page to rule out a server-side outage, which is a common cause of activation failures and can be resolved without any device-side intervention.

Answer

Replace the SIM card with a new one.

Answer

Restore the iPhone using iTunes or Finder.

Answer

Reset the iPhone's network settings.

Question 12

A user reports that their Android phone's Bluetooth keeps disconnecting from their car's hands-free system. The technician has already cleared the Bluetooth cache and re-paired the devices. What should the technician do NEXT?

Accepted Answer

Update the car's infotainment system firmware.. Option B is correct because after basic troubleshooting (cache clear and re-pair) fails, the next logical step is to check for firmware updates on the car's infotainment system. Bluetooth connectivity issues between a phone and a car are often caused by incompatibilities or bugs in the car's Bluetooth stack, which can be resolved by updating the car's firmware. The technician should prioritize updating the car's system before considering hardware replacement or more drastic phone resets.

Answer

Perform a factory reset on the phone.

Answer

Replace the phone's Bluetooth antenna.

Answer

Disable Bluetooth power saving mode on the phone.

Question 13

A technician is investigating a security incident where a user's corporate email account was accessed from an unknown device. The user's iPhone shows no suspicious apps, and the password was recently changed. Which of the following is the MOST likely cause?

Accepted Answer

An OAuth token or app-specific password was stolen and used to access the account.. Option B is correct because OAuth tokens or app-specific passwords bypass the need for the primary password, allowing persistent access even after a password change. Since the user's iPhone shows no suspicious apps and the password was recently changed, a stolen token is the most plausible vector for unauthorized email access via Exchange ActiveSync or modern authentication.

Answer

The user's iCloud account was compromised, and the email is synced via Exchange.

Answer

The user's iPhone has a jailbreak that hides malicious apps.

Answer

The corporate email server has a backdoor account.

Question 14

A technician is troubleshooting an Android device that has a corporate email account configured. The user can send emails but cannot receive any. The email server uses IMAP. The technician has verified the username and password are correct. What should the technician check next?

Accepted Answer

Check the incoming mail server settings (IMAP).. Since the user can send emails but not receive them, the issue is isolated to the incoming mail path. IMAP uses port 143 (or 993 for SSL/TLS) to retrieve messages, and the incoming server settings (server address, port, security type) must match the corporate email configuration. Incorrect IMAP settings would prevent the device from connecting to the server to download new emails, while SMTP (outgoing) settings remain unaffected, explaining the send-only symptom.

Answer

Check if the device's date and time are correct.

Answer

Check if the email account has exceeded its storage quota.

Answer

Check if the device is in power-saving mode.

Question 15

A user reports that their Android phone's battery drains rapidly after a recent app update. They have already tried restarting the device. Which of the following should a technician recommend FIRST to diagnose the issue?

Accepted Answer

Check battery usage in Settings to identify the app consuming the most power.. Option B is correct because the first step in diagnosing rapid battery drain after an app update is to use the built-in battery usage tool in Android Settings. This tool provides a per-app breakdown of power consumption, allowing the technician to identify which specific app is consuming excessive energy without making invasive changes. Restarting the device already failed to resolve the issue, so checking battery stats is the logical next step before any destructive or restrictive actions.

Answer

Perform a factory reset.

Answer

Replace the battery immediately.

Answer

Disable all background data.