220-1102 Practice Test 43 — 15 Questions

Question 1

A company's security policy mandates that all USB flash drives must be encrypted before use. A user inserts a new USB drive and wants to encrypt it on a Windows 10 Pro workstation. Which built-in tool should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable BitLocker To Go on the USB drive.. BitLocker To Go is the built-in Windows 10 Pro feature specifically designed to encrypt removable drives such as USB flash drives. It uses AES encryption to protect the entire volume, and the drive can be accessed only with a password, smart card, or recovery key. This directly satisfies the company's mandate for encrypting USB drives before use.

Answer

Use EFS (Encrypting File System) on the USB drive.

Answer

Format the drive as exFAT and set a password.

Answer

Use the cipher command to encrypt the drive.

Question 2

A technician is troubleshooting a recurring network outage that occurs every Tuesday at 3 PM. After reviewing the change log, the technician finds that a scheduled backup job runs at that time. What is the best course of action?

Accepted Answer

Document the correlation and propose a change to the backup schedule.. The technician has identified a clear correlation between the 3 PM Tuesday backup job and the recurring outage, so the correct action is to document that correlation and route a change request to reschedule or throttle the backup (B). This respects change management while addressing the root cause, rather than making an unauthorized unilateral change to a critical process.

Answer

Disable the backup job immediately to restore network stability.

Answer

Increase the network bandwidth to accommodate the backup traffic.

Answer

Ignore the issue since the backup is a critical process.

Question 3

A retail store wants to protect its point-of-sale (POS) terminals from unauthorized physical access during off-hours. The terminals are in an open area with no lockable cabinets. Which control should be prioritized?

Accepted Answer

Use tamper-evident seals on the terminal casings.. Tamper-evident seals on POS terminal casings are the most appropriate control because they provide a physical indication if someone has opened or accessed the terminal's internal components during off-hours. Since the terminals are in an open area with no lockable cabinets, seals offer a low-cost, immediately deployable deterrent and detection mechanism. They alert staff the next morning if tampering occurred, enabling investigation and preventing skimming attacks.

Answer

Install a privacy screen on each POS terminal.

Answer

Require a smart card to power on the terminal.

Answer

Enable a screensaver with a password.

Question 4

A user reports that their browser frequently redirects to a different search engine, and a new toolbar has appeared. After checking the browser settings, you find the homepage has been changed and there are unknown extensions enabled. What is the most likely cause of this issue?

Accepted Answer

A browser hijacker installed via a malicious extension. The symptoms—browser redirects, new toolbar, changed homepage, and unknown extensions—are classic signs of a browser hijacker, which is often installed via malicious extensions. These extensions modify browser settings to redirect traffic and inject ads.

Answer

A corrupted browser cache

Answer

An outdated browser version

Answer

A misconfigured proxy server

Question 5

A technician is troubleshooting a Windows 10 PC that fails to boot with a 'Bootmgr is missing' error. They need to repair the boot configuration. Which administrative tool should be used from the Windows Recovery Environment (WinRE)?

Accepted Answer

Command Prompt to run bootrec /rebuildbcd.. The correct tool is Command Prompt to run 'bootrec /rebuildbcd' (B). The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is missing or corrupted. The 'bootrec /rebuildbcd' command scans for Windows installations and rebuilds the BCD, which is the appropriate repair step from WinRE.

Answer

System Restore to revert to a previous restore point.

Answer

Device Manager to update the disk driver.

Answer

Local Security Policy to adjust boot options.

Question 6

A customer reports that their Windows 10 computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware is the most likely malware type because the symptoms—frequent pop-up ads even when no browser is open, and a new browser toolbar—are classic indicators of adware. Adware is designed to display unwanted advertisements and often bundles additional toolbars or browser extensions without user consent. It can run in the background and inject ads into various applications.

Answer

Ransomware

Answer

Virus

Answer

Worm

Question 7

A technician is configuring a new workstation for a customer who is concerned about energy consumption. Which setting should the technician enable to reduce power usage when the computer is idle?

Accepted Answer

Enable sleep mode after 15 minutes of inactivity.. Enabling sleep mode after 15 minutes of inactivity places the computer into a low-power state (S3 sleep, Suspend-to-RAM) where the CPU is powered down but RAM retains data, allowing a quick wake-up. This directly reduces energy consumption during idle periods more effectively than simply turning off the display, as it cuts power to the processor, drives, and most peripherals.

Answer

Disable the screensaver and set the display to turn off after 30 minutes.

Answer

Enable hibernation mode after 1 hour of inactivity.

Answer

Set the power plan to 'High performance' to reduce power draw.

Question 8

A user reports that their computer has been acting strangely: files are missing, and the mouse cursor moves on its own, opening programs and typing messages. The technician suspects a remote access Trojan (RAT). What is the most effective immediate action to stop the unauthorized access?

Accepted Answer

Disconnect the Ethernet cable and disable Wi-Fi.. Disconnecting the Ethernet cable and disabling Wi-Fi immediately severs the remote attacker's connection to the machine, stopping the unauthorized access. This is the most effective immediate action because it cuts off the command-and-control channel that a RAT relies on. Other actions like antivirus scans or password changes may take time and do not immediately stop an active intruder.

Answer

Run a full antivirus scan while the user is logged off.

Answer

Change the user's password and log off.

Answer

Restore the system to a previous restore point.

Question 9

A technician is removing malware from a Windows 10 PC and wants to ensure that no remnants remain in the registry or startup folders. After running an antivirus scan and deleting infected files, which additional step should the technician perform?

Accepted Answer

Check and clean startup entries using MSConfig or Autoruns.. Malware frequently persists via registry Run keys, startup folders, and scheduled tasks that survive file deletion. After an antivirus scan removes the payload, remnants in these autostart locations can re-download or re-execute the malware. Using MSConfig or Sysinternals Autoruns to inspect and clean startup entries ensures no persistence mechanism remains, which is the correct remediation step.

Answer

Run the Windows Memory Diagnostic tool.

Answer

Disable System Restore to free up disk space.

Answer

Update all device drivers to the latest versions.

Question 10

A user wants to encrypt a USB flash drive so that if it is lost, the data cannot be read on another computer. The USB drive will be used on both Windows 10 and Windows 11 devices. Which Windows feature should be used?

Accepted Answer

BitLocker To Go. BitLocker To Go is the correct choice because it provides full-disk encryption specifically designed for removable drives like USB flash drives. It encrypts the entire drive using AES encryption, and when the drive is inserted into another Windows 10 or Windows 11 computer, the user must enter the password or use a smart card/recovery key to access the data. This ensures that if the drive is lost, the data remains unreadable on any other system.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Encryption

Answer

Secure Boot

Question 11

A customer complains that their Windows 10 PC fails to boot and displays a 'Bootmgr is missing' error. You suspect the Boot Configuration Data (BCD) is corrupted. Which tool should you use to repair the BCD from the Windows Recovery Environment?

Accepted Answer

bootrec /rebuildbcd. The 'Bootmgr is missing' error indicates that the Windows Boot Manager cannot locate or read the Boot Configuration Data (BCD) store. The bootrec /rebuildbcd command, run from the Windows Recovery Environment, scans the disk for Windows installations and rebuilds the BCD store, restoring the boot configuration. This is the correct tool for repairing a corrupted BCD.

Answer

chkdsk /f

Answer

sfc /scannow

Answer

diskpart

Question 12

During a routine security audit, a technician discovers that a server was patched out of the approved maintenance window. The patch was applied by a junior admin who was not authorized. What is the most important step to include in the incident documentation?

Accepted Answer

The reason the patch was applied outside the maintenance window.. The most important step in incident documentation is to capture the reason the patch was applied outside the approved maintenance window. This directly addresses the root cause of the unauthorized change, which is critical for post-incident review, process improvement, and preventing recurrence. Without the reason, the documentation fails to support a meaningful root cause analysis (RCA) and corrective action planning.

Answer

The name of the junior admin who applied the patch.

Answer

The exact time the patch was applied.

Answer

The patch's version number and source.

Question 13

A company is considering moving its email system from an on-premises Exchange server to a cloud-based solution. Which cloud service model would best fit this migration?

Accepted Answer

SaaS (Software as a Service). SaaS (Software as a Service) is the correct model because it delivers fully functional email applications (e.g., Microsoft 365 Exchange Online) over the internet, eliminating the need for the company to manage the underlying infrastructure, platform, or software. The cloud provider handles all maintenance, updates, and availability, making it ideal for migrating an existing email system without re-architecting the application itself.

Answer

IaaS (Infrastructure as a Service)

Answer

PaaS (Platform as a Service)

Answer

DaaS (Desktop as a Service)

Question 14

A company's security policy requires that all Windows 10 workstations automatically lock the screen after 5 minutes of inactivity. However, users in the sales department often leave their desks for extended periods. A technician configures the 'Interactive logon: Machine inactivity limit' policy to 300 seconds. Despite this, the screensaver does not activate. What is the most likely reason?

Accepted Answer

The screensaver is not enabled or configured on the workstations. The 'Interactive logon: Machine inactivity limit' policy locks the machine after the specified inactivity period, but it does not activate the screensaver. If the screensaver is not enabled or configured via Group Policy or local settings, the screen will not show a screensaver even though the machine locks. The policy and screensaver settings are separate mechanisms.

Answer

The 'Screen saver timeout' policy is set to a longer duration

Answer

The 'Password protect the screensaver' setting is disabled

Answer

The 'Turn off the display' power setting is set to 'Never'

Question 15

A user reports that their Windows 10 computer runs a script every time they log in that maps a network drive, but the drive mapping fails intermittently. The script uses the 'net use' command. Which scripting element should be added to handle the failure gracefully and retry the mapping?

Accepted Answer

An exit code check and a loop to retry the mapping. Adding an exit code check after 'net use' and a loop to retry the mapping allows the script to detect failure (non-zero exit code) and attempt the mapping again, handling intermittent network issues gracefully. This is a standard scripting pattern for resilience.

Answer

A comment line explaining the net use syntax

Answer

A variable to store the drive letter

Answer

A 'pause' command after the net use line