220-1102 Practice Test 45 — 15 Questions

Question 1

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

Accepted Answer

Use a Group Policy to allow only the specific USB device by hardware ID, then remove the allowance after use. Option B is correct because it uses Group Policy to enforce a device installation restriction by hardware ID, allowing only the specific USB device while blocking all others. This maintains the security policy's intent by preventing unauthorized devices while granting temporary, auditable access. After use, removing the allowance restores the full block without domain-wide disruption.

Answer

Disable the USB blocking Group Policy for the entire domain

Answer

Give the manager a company-approved USB drive and tell them to use it only once

Answer

Create a local admin account on the manager's workstation and disable the USB block locally

Question 2

A security analyst discovers that an attacker has been using a compromised VPN account to access the corporate network. The account belongs to a former employee who was terminated two weeks ago. Which of the following should the analyst do immediately to prevent further unauthorized access?

Accepted Answer

Disable the former employee's VPN account. Disabling the former employee's VPN account immediately stops the attacker from using the compromised credentials to access the corporate network. This is the most direct and effective action to prevent further unauthorized access, as the account is the vector being exploited. Other steps like log review or server reconfiguration are important but secondary to cutting off the active attack path.

Answer

Review the VPN logs to determine the extent of the breach

Answer

Change the VPN server's shared secret

Answer

Notify the former employee about the security incident

Question 3

While upgrading a workstation, you find that the old lithium-ion battery is swollen. What is the safest and most environmentally sound way to handle this battery?

Accepted Answer

Place it in a fireproof container and contact a hazardous waste disposal service.. A swollen lithium-ion battery indicates internal damage and potential thermal runaway risk. Placing it in a fireproof container and contacting hazardous waste disposal ensures safe containment and proper recycling, preventing fire hazards and environmental contamination from toxic electrolytes and heavy metals.

Answer

Puncture the battery to release the pressure, then throw it in the trash.

Answer

Put it in a sealed plastic bag and put it in the regular recycling bin.

Answer

Freeze the battery to stop the swelling, then dispose of it in the trash.

Question 4

A technician is tasked with decommissioning a server that contains a RAID array of hard drives. The drives are still functional, but the data must be securely erased. What is the most secure method to ensure data cannot be recovered?

Accepted Answer

Use a degausser to erase the magnetic data on the drives.. Option C is correct because degaussing uses a powerful magnetic field to randomize the magnetic domains on the hard drive platters, effectively destroying all stored data at the magnetic level. This method renders the data unrecoverable even with advanced forensic tools, as it disrupts the magnetic orientation that represents the data. For a RAID array of functional drives, degaussing ensures complete data sanitization without requiring physical destruction.

Answer

Perform a quick format of each drive.

Answer

Overwrite the drives with zeros using a low-level format.

Answer

Physically destroy the drives with a hammer.

Question 5

A technician is setting up a remote desktop solution for a small business with five employees who need to access their office PCs from home. The office uses a dynamic public IP address. Which of the following should the technician configure to ensure reliable remote access without requiring users to remember a changing IP?

Accepted Answer

Configure a dynamic DNS (DDNS) service. Option B is correct because a dynamic DNS (DDNS) service maps a fixed hostname (e.g., remote.office.com) to the office’s changing public IP address. The technician configures the router or a client to update the DDNS provider automatically whenever the ISP-assigned IP changes, so employees can always connect using the same hostname without tracking the current IP.

Answer

Set up port forwarding on the router

Answer

Assign each employee a static IP address on the office network

Answer

Use a VPN with a static IP assigned by the ISP

Question 6

A technician is troubleshooting a batch script that is supposed to delete temporary files older than 30 days. The script runs without errors but does not delete any files. The technician suspects the script's logic is flawed. Which part of the script is most likely incorrect?

Accepted Answer

The script uses 'forfiles' with the wrong date syntax. The 'forfiles' command in Windows uses a specific date syntax with the `/d` parameter. The correct syntax for files older than 30 days is `forfiles /d -30` (negative number means older than). If the script uses a positive number or an incorrect date format like `+30` or `30 days ago`, it will not match any files, resulting in no deletions. This is the most likely flaw given the symptom of no errors but no action.

Answer

The script uses the 'del' command without a path

Answer

The script runs as a standard user without admin rights

Answer

The script uses 'echo' instead of 'del'

Question 7

After deploying a new Windows 11 workstation, a user complains that their screens turn off after 3 minutes of inactivity, even though they are reading documents. They want the display to stay on for at least 15 minutes. Which Settings page should you navigate to in order to change this power setting?

Accepted Answer

Settings > System > Power & battery > Screen and sleep. Option C is correct because the modern Windows 11 Settings app consolidates power management under System > Power & battery, where the 'Screen and sleep' section allows you to adjust the 'On battery power, turn off my screen after' and 'When plugged in, turn off my screen after' drop-downs. This directly addresses the user's complaint about the display turning off after 3 minutes of inactivity, enabling a change to 15 minutes.

Answer

Settings > Personalization > Lock screen

Answer

Control Panel > Power Options > Edit Plan Settings

Answer

Settings > Accessibility > Display

Question 8

A user wants to share a folder on their Windows 11 PC so that other users on the local network can access files without a password. They have already enabled network discovery and file sharing. Which additional setting must they configure in the Advanced Sharing settings to allow password-less access?

Accepted Answer

Turn off password protected sharing. To allow password-less access to shared folders on a local network, you must disable password protected sharing. When this setting is turned off, Windows 11 does not require users to have a local account and password on the host machine; instead, it grants access based on the 'Everyone' group permissions. This is configured in the 'Advanced sharing settings' under 'All Networks'.

Answer

Turn on Public folder sharing

Answer

Enable 128-bit encryption

Answer

Set up a homegroup

Question 9

A technician is troubleshooting a user's inability to access a specific website. The user can access other websites without issue. The technician wants to check the route packets take to the problematic server and identify where the connection fails. Which command should be used?

Accepted Answer

tracert example.com. The `tracert` command (short for 'trace route') is the correct tool because it sends ICMP Echo Request packets with incrementally increasing TTL (Time to Live) values, causing each router along the path to reply with an ICMP Time Exceeded message. This reveals the exact hop-by-hop path to the destination and pinpoints where the connection fails, which is precisely what the technician needs to diagnose a site-specific outage.

Answer

ping -t example.com

Answer

nslookup example.com

Answer

netstat -an

Question 10

A user reports that they cannot access a shared folder on a file server. You suspect the network path is incorrect or the share is unavailable. Which command can you use to test connectivity to the server and the share simultaneously?

Accepted Answer

net view \ServerName. The `net view \ServerName` command lists all shared resources on the specified server, confirming both network connectivity to the server and the availability of shares. If the server is unreachable or has no shares, the command will fail, directly testing the user's reported issue.

Answer

ping \ServerName

Answer

net use Z: \ServerName\Share

Answer

tracert \ServerName

Question 11

A user reports that their Windows 10 computer is infected with ransomware that has encrypted their files. The technician boots into the Windows Recovery Environment and wants to restore the system to a previous restore point. Which command should be used?

Accepted Answer

rstrui.exe. The correct command is `rstrui.exe`, which launches the System Restore utility. In the Windows Recovery Environment (WinRE), this command allows you to revert the system to a previous restore point, effectively undoing the ransomware encryption if a restore point was created before the infection. This is the standard tool for restoring system files and settings without affecting personal files, assuming the restore point predates the attack.

Answer

vssadmin list shadows

Answer

wbadmin start recovery

Answer

bootrec /fixboot

Question 12

A security incident is suspected on a Windows 10 workstation. You need to list all active network connections and the associated processes to identify potential malicious activity. Which command provides this information?

Accepted Answer

netstat -b. The `netstat -b` command displays all active TCP/UDP network connections along with the executable (process) name that created each connection. This is essential for identifying which process is communicating over the network, enabling you to spot suspicious activity like malware beaconing outbound.

Answer

netstat -a

Answer

tasklist /svc

Answer

ipconfig /displaydns

Question 13

A user reports that their Windows 10 PC is running slowly and they see many background processes in Task Manager. You need to identify which processes are consuming the most CPU and memory resources without installing any additional software. Which built-in Windows tool should you use?

Accepted Answer

Task Manager. Task Manager (Option C) is the correct built-in tool because it provides a real-time, sortable list of all running processes, displaying their CPU and memory usage directly on the Processes tab. This allows you to quickly identify which processes are consuming the most resources without needing to install additional software, as the user specifically requested.

Answer

Performance Monitor

Answer

Resource Monitor

Answer

System Configuration (msconfig)

Question 14

A customer complains that their Windows 11 laptop frequently freezes after waking from sleep. You suspect a driver issue and need to view detailed hardware and driver information to diagnose the problem. Which administrative tool should you open first?

Accepted Answer

Device Manager. Device Manager is the correct tool because it provides a centralized view of all hardware components and their associated drivers. You can expand categories like 'System devices' or 'Batteries' to check for driver conflicts, outdated drivers, or power management settings that could cause freezing after sleep. It also allows you to update, roll back, or disable drivers directly, which is essential for diagnosing wake-from-sleep issues.

Answer

Disk Management

Answer

System Configuration (msconfig)

Answer

Event Viewer

Question 15

A customer complains that their Windows 10 PC is running very slowly after a recent software installation. You suspect a new background service is consuming excessive CPU. Which built-in administrative tool should you use to identify the offending service?

Accepted Answer

Services console (services.msc) to locate and stop the problematic service.. The Services console (services.msc) allows you to view all running services, their status, and resource usage. By sorting services by CPU consumption or stopping suspected services one by one, you can identify which newly installed service is causing high CPU usage. This is the direct tool for managing and troubleshooting Windows services.

Answer

Device Manager to check for driver issues.

Answer

Event Viewer to review system logs.

Answer

Performance Monitor to create a data collector set.