220-1102 Practice Test 4 — 10 Questions

Question 1

A client brings in a laptop that was used by an employee who left the company. The manager wants to ensure all data is unrecoverable before recycling the laptop. The laptop has a traditional HDD. Which method should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run a full overwrite using disk-wiping software.. Disk-wiping software performs a full overwrite of every sector on the HDD with patterns (e.g., zeros, random data), making the original data unrecoverable even with advanced forensic tools. This method is specifically designed for secure data destruction on functional drives, ensuring compliance with data sanitization standards like NIST SP 800-88.

Answer

Perform a quick format of the drive.

Answer

Use a degausser to demagnetize the drive.

Answer

Physically shred the drive with a hard drive shredder.

Question 2

A user reports that they can no longer connect to the company network from home using VPN. They confirm their internet connection is working and that they can browse websites. Which of the following should a technician check first to resolve the VPN connectivity issue?

Accepted Answer

Verify the user's VPN username and password. The user's internet connection is working (they can browse websites), which rules out general network connectivity issues. The most common cause of VPN authentication failure is incorrect or expired credentials, so verifying the username and password is the quickest and most logical first step before escalating to more complex troubleshooting.

Answer

Check if the VPN client software is up to date

Answer

Restart the VPN server at the data center

Answer

Reinstall the network adapter drivers

Question 3

After a security incident, a forensic analyst needs to ensure that Windows 10 audit logs capture all successful and failed attempts to access the 'Confidential' folder on a file server. Which audit policy configuration is required?

Accepted Answer

Enable 'Audit object access' and configure the SACL on the folder. To audit access attempts to a specific folder, you must enable the 'Audit object access' policy in the Advanced Audit Policy Configuration (or the legacy 'Audit object access' under Local Policies). This policy alone does not audit anything; you must also configure a System Access Control List (SACL) on the 'Confidential' folder itself, specifying which access types (e.g., Read, Write) for which users or groups to audit for success and failure. Without the SACL, no object access events are generated.

Answer

Enable 'Audit account logon events' for success and failure

Answer

Enable 'Audit privilege use' for success and failure

Answer

Enable 'Audit process tracking' for success and failure

Question 4

A user complains that their Remote Desktop session to a Windows 10 Pro workstation frequently disconnects after a few minutes of inactivity. The workstation is on a local network. Which setting should the technician modify on the host computer to prevent this?

Accepted Answer

Increase the idle session limit in Remote Desktop settings. The Remote Desktop Session Host (RDSH) has a configurable idle session limit that disconnects sessions after a period of inactivity. By default, Windows 10 Pro may enforce a short idle timeout (often 1-5 minutes) to conserve resources. Increasing this limit in the Remote Desktop Session Host settings (under Local Group Policy or the Remote Desktop Services configuration) prevents the automatic disconnection the user is experiencing.

Answer

Disable the screensaver

Answer

Change the power plan to High Performance

Answer

Enable Network Level Authentication

Question 5

During a security incident, a user's files have been renamed with a '.encrypted' extension, and a ransom note demands Bitcoin to restore them. The user has no backups. What is the most appropriate immediate action?

Accepted Answer

Disconnect the computer from the network immediately.. Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

Answer

Pay the ransom to regain access quickly.

Answer

Run a full antivirus scan to remove the malware.

Answer

Restart the computer in Safe Mode and attempt file recovery.

Question 6

A user reports that their MacBook Pro running macOS Ventura is unable to open any applications after a recent system update. They see a spinning beach ball when clicking app icons. Which macOS tool should you use first to diagnose and resolve this issue?

Accepted Answer

Activity Monitor. Activity Monitor is the correct first tool because it allows you to inspect running processes, CPU usage, memory pressure, and disk activity. The spinning beach ball indicates a hung or unresponsive process, likely caused by a kernel extension or system daemon failing after the update. Activity Monitor can identify the offending process (e.g., a high CPU or stuck I/O process) so you can force quit it or gather logs for further troubleshooting.

Answer

Terminal

Answer

Disk Utility

Answer

System Information

Question 7

A user reports that a specific application crashes immediately on launch. You want to verify the integrity of the application's core files without reinstalling. Which command-line tool can you use to scan and repair system files that the application depends on?

Accepted Answer

sfc /scannow. The `sfc /scannow` (System File Checker) command scans all protected system files and replaces corrupted versions with a cached copy located in the `%WinDir%\System32\dllcache` directory. Since the application crashes on launch, it likely depends on core Windows system files (e.g., DLLs, executables) that may be corrupted or missing. Running `sfc /scannow` verifies and repairs these system files without reinstalling the application itself, directly addressing the integrity of the dependencies.

Answer

chkdsk /f

Answer

tasklist

Answer

dism /online /cleanup-image /restorehealth

Question 8

A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?

Accepted Answer

Set the execution policy to AllSigned. Setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

Answer

Set the execution policy to Restricted

Answer

Set the execution policy to RemoteSigned

Answer

Disable PowerShell using Group Policy

Question 9

A technician is configuring a new Windows 10 kiosk computer that will run a single application for public use. They need to prevent users from accessing the desktop, taskbar, or other system functions. Which Windows security feature should be used?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (Kiosk Mode) is the correct feature because it locks down the Windows 10 device to run only a single Universal Windows Platform (UWP) app or a classic Win32 app in full-screen mode, completely hiding the desktop, taskbar, Start menu, and other system interfaces. This is specifically designed for public-facing kiosk scenarios where users must not be able to exit the application or access any other system functions.

Answer

User Account Control (UAC) set to highest level

Answer

Local Group Policy – Software Restriction Policies

Answer

Windows Defender Application Guard

Question 10

A user calls the help desk saying they cannot access a shared folder on the network. They can access other shares on the same server. The technician verifies the user's account is active and the folder exists. What should the technician check next to resolve the access issue?

Accepted Answer

Review the NTFS permissions on the shared folder.. Since the user can access other shares on the same server, the issue is isolated to a specific shared folder. NTFS permissions control access at the folder level independently of share permissions, and a missing or incorrect NTFS entry for the user would block access even if the share permissions are open. The technician should review the NTFS permissions on that folder to ensure the user or their group has at least Read access.

Answer

Check if the user's password has expired.

Answer

Verify the user has been added to the local Administrators group.

Answer

Reboot the file server to clear any cached permissions.