220-1102 Practice Test 40 — 15 Questions

Question 1

A system administrator configures a new VPN server for remote employees. The requirement is that all traffic from the remote user's device must be routed through the corporate network to enforce security policies. Which VPN protocol setting should the administrator enable?

Accepted Answer

Disable split tunneling. Disabling split tunneling ensures that all traffic from the remote user's device is routed through the corporate VPN tunnel, enforcing security policies such as content filtering and intrusion detection. When split tunneling is enabled, only traffic destined for the corporate network goes through the VPN, while internet-bound traffic bypasses it, violating the requirement. This setting is typically configured in the VPN client or server profile (e.g., using the 'DisableSplitTunneling' registry key on Windows or the 'tunnel-all' directive in OpenVPN).

Answer

Enable split tunneling

Answer

Use PPTP instead of L2TP

Answer

Increase the MTU size

Question 2

A technician is writing a PowerShell script to check the last boot time of a remote computer. The script uses Get-CimInstance Win32_OperatingSystem. The script works locally but fails with an access denied error when targeting a remote machine. Both computers are domain-joined and the technician has admin rights. What is the most likely issue?

Accepted Answer

The remote computer has Windows Firewall blocking WMI traffic.. Get-CimInstance uses the WS-Management (WSMan) protocol, which relies on WinRM. By default, Windows Firewall blocks inbound WinRM traffic on port 5985 (HTTP) and 5986 (HTTPS). Even though the technician has admin rights and both machines are domain-joined, the remote firewall must allow WinRM traffic for the CIM session to succeed. The local success is because no firewall traversal is needed.

Answer

The remote computer does not have PowerShell installed.

Answer

The script uses an incorrect namespace.

Answer

The technician is not a member of the Remote Management Users group.

Question 3

A technician needs to deploy a configuration change to 50 Windows 10 computers using a script. The script must check if a specific registry key exists before modifying it. Which scripting construct should be used?

Accepted Answer

An if-else statement. The script needs to conditionally execute code based on whether a registry key exists. An if-else statement is the correct construct for this because it evaluates a condition (e.g., Test-Path 'HKLM:\Software\MyKey') and executes one block if true (modify the key) and another if false (skip or create). Loops are for repetition, not conditional branching, and try-catch handles runtime errors, not existence checks.

Answer

A for loop

Answer

A while loop

Answer

A try-catch block

Question 4

A technician is tasked with securely connecting a remote office to the main office over the internet. The remote office has 10 users who need access to the same resources as local users. Which of the following remote access methods provides the most secure and scalable solution?

Accepted Answer

Set up a site-to-site VPN between the two offices. A site-to-site VPN (often using IPsec or a secure tunnel protocol) creates an encrypted, always-on connection between the two office routers, allowing all 10 users transparent access to the main office resources as if they were on the same LAN. This method is both secure (encrypting all traffic) and scalable (handling multiple users without per-client configuration), making it the best fit for connecting entire networks over the internet.

Answer

Configure port forwarding on the main office router for each required service

Answer

Use Remote Desktop for each user to connect to a workstation at the main office

Answer

Implement a client-to-site VPN for each user

Question 5

A user reports that a VBScript logon script that maps network drives stopped working after a Windows update. The script uses the MapNetworkDrive method. Other scripts on the same computer work fine. What is the most likely cause?

Accepted Answer

The update disabled VBScript execution for security reasons.. Option C is correct because recent Windows updates have tightened security around legacy scripting hosts, including cscript.exe and wscript.exe. Specifically, Microsoft has introduced a default behavior that blocks VBScript execution via the Windows Script Host unless explicitly allowed by Group Policy or registry settings. Since the user reports that only the VBScript logon script fails while other scripts work, the most likely cause is that the update disabled VBScript execution, not that the script was deleted or that the script host was changed to PowerShell.

Answer

The script file was deleted by Windows Defender.

Answer

The update changed the default script host to PowerShell.

Answer

The network share requires SMB 2.0, which is no longer supported.

Question 6

A technician is writing a PowerShell script to retrieve the IP configuration of all computers in a domain and output the results to a CSV file. The script must run on a management workstation and target remote machines. Which cmdlet should the technician use to execute commands on remote computers?

Accepted Answer

Invoke-Command. Invoke-Command is the correct cmdlet because it is designed to execute PowerShell commands or script blocks on one or more remote computers and return the results to the local session. This allows the technician to run the IP configuration retrieval script against all domain computers from the management workstation and then pipe the output to Export-Csv.

Answer

Enter-PSSession

Answer

Get-WmiObject

Answer

Out-File

Question 7

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

Accepted Answer

Use Group Policy Preferences to set the local administrator password.. Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Answer

Store the password in a plain text file and have the script read it.

Answer

Embed the password in the script using a variable and run it from a hidden share.

Answer

Use a scheduled task that runs the script as SYSTEM.

Question 8

A graphic designer reports that their MacBook Pro running macOS Monterey suddenly shows a gray screen with a folder icon containing a question mark at startup. They have important client files on the internal SSD. What is the most likely cause of this issue?

Accepted Answer

macOS cannot locate a valid boot volume or system folder. The gray screen with a folder icon containing a question mark indicates that the Mac's startup process cannot locate a valid boot volume or system folder. This is a classic symptom of a missing or corrupted boot loader, damaged system files, or a disconnected internal SSD, which prevents macOS from finding the required bootable system.

Answer

The user’s Time Machine backup has failed

Answer

The firmware password is enabled

Answer

The user’s login keychain is corrupted

Question 9

A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?

Accepted Answer

Set the execution policy to AllSigned. Option B is correct because setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

Answer

Set the execution policy to Restricted

Answer

Set the execution policy to RemoteSigned

Answer

Disable PowerShell using Group Policy

Question 10

A technician is creating a PowerShell script that must be deployed via Group Policy to all workstations. The script should run in the user context and display a message if the user's password is about to expire within 7 days. The script must not show any PowerShell console window. Which scripting technique should be used?

Accepted Answer

Use a VBScript with a pop-up message box. Option B is correct because VBScript's `MsgBox` function creates a pop-up message box that runs in the user context without a console window, making it ideal for displaying password-expiry warnings via Group Policy. PowerShell scripts, even with `-WindowStyle Hidden`, briefly flash a console window unless compiled into an executable, which violates the requirement to show no console window. VBScript natively integrates with Windows Script Host (WSH) to produce a GUI pop-up without any console overhead.

Answer

Use the 'Write-Host' cmdlet to display the message

Answer

Use the '-NoProfile' parameter when starting PowerShell

Answer

Use a scheduled task with 'Run whether user is logged on or not'

Question 11

A technician is reviewing a PowerShell script that was used in a ransomware attack. The script contains a line that downloads and executes a payload from a remote server. The script uses a technique to bypass execution policy. Which scripting technique is most likely used to bypass the execution policy?

Accepted Answer

Using the '-ExecutionPolicy Bypass' parameter when launching PowerShell. The '-ExecutionPolicy Bypass' parameter when launching PowerShell tells the PowerShell engine to bypass the execution policy for that session only, allowing any script to run without restriction. This is a common technique used by attackers because it does not require administrative privileges or permanent policy changes, making it stealthy and effective for executing malicious payloads.

Answer

Using the 'Set-ExecutionPolicy' cmdlet to change the policy to Unrestricted

Answer

Using the 'powershell.exe -Command' syntax with an encoded command

Answer

Signing the script with a self-signed certificate

Question 12

A technician needs to deploy a PowerShell script to 50 Windows 10 workstations that will install a security update silently. The script must run with administrative privileges. Which method should the technician use to ensure the script executes properly without user interaction?

Accepted Answer

Run the script via 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt. Option B is correct because running 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt bypasses PowerShell's execution policy for that session and ensures the script runs with administrative privileges. This combination allows silent, unattended execution of the security update installation across multiple workstations without user interaction.

Answer

Double-click the script file on each workstation

Answer

Use the 'Start-Process' cmdlet without elevation

Answer

Copy the script to the Startup folder

Question 13

A company uses a login script that sets environment variables and maps drives based on the user's department. The script works for most users, but some report that the drive mappings are missing. The script is written in batch and uses 'if' statements to check department codes. What is the most likely cause of the intermittent failures?

Accepted Answer

The department codes in the script do not match the actual codes due to case sensitivity. Batch file 'if' statements are case-sensitive by default when comparing strings. If the script checks for department codes like 'SALES' but the actual environment variable or user input contains 'sales' or 'Sales', the comparison fails and the drive mapping block is skipped. This explains why the issue is intermittent — it depends on how the department code is stored or passed.

Answer

The script runs too early before the network is fully initialized

Answer

The script is using 'setx' instead of 'set' for environment variables

Answer

The user accounts lack permission to run login scripts

Question 14

A technician is writing a PowerShell script to check the status of a Windows service on multiple remote computers. The script must output the service name and status for each computer where the service is running. Which cmdlet combination should the technician use to achieve this?

Accepted Answer

Get-Service -ComputerName $computers | Where-Object {$_.Status -eq 'Running'}. Option A is correct because Get-Service with the -ComputerName parameter can query multiple remote computers directly, and piping its output to Where-Object with the condition {$_.Status -eq 'Running'} filters only services whose Status property equals 'Running'. This meets the requirement to output the service name and status for each computer where the service is running, as Get-Service returns objects containing both Name and Status properties by default.

Answer

Invoke-Command -ComputerName $computers -ScriptBlock {Get-Service} | Select-Object Status

Answer

Get-WmiObject Win32_Service -ComputerName $computers | Where-Object {$_.State -eq 'Running'}

Answer

Get-Service -Name * -ComputerName $computers | Format-Table -AutoSize

Question 15

A company's login script uses a batch file that calls multiple other scripts. Recently, the script stopped working after a Windows update. The technician discovers that the script uses 'call' to run sub-scripts, but one of the sub-scripts contains an 'exit' command that terminates the entire batch process. How should the technician modify the sub-script to prevent this?

Accepted Answer

Change 'exit' to 'exit /b'. The 'exit' command without parameters terminates the entire command interpreter (cmd.exe), which kills the parent batch file as well. Using 'exit /b' instead exits only the current batch script or subroutine, returning control to the calling script. This preserves the intended flow when sub-scripts are invoked via 'call'.

Answer

Replace 'exit' with 'goto :eof'

Answer

Remove the 'exit' command entirely

Answer

Use 'endlocal' before 'exit'