220-1102 Practice Test 48 — 15 Questions

Question 1

A technician is preparing to replace a faulty power supply in a desktop computer. Which of the following safety precautions should the technician take? (Choose two.)

Accepted Answer

Disconnect the power cord from the wall outlet before opening the case.. Disconnecting the power cord and wearing an antistatic wrist strap are essential safety precautions when working inside a computer. These steps prevent electric shock and electrostatic discharge, protecting both the technician and the components. The other options introduce risks such as magnetic interference, electrical hazards, or static buildup.

Answer

Leave the power cord connected but turn off the power supply switch.

Answer

Use a magnetic screwdriver to retrieve screws from inside the power supply.

Answer

Work on a carpeted floor to cushion the components.

Question 2

A technician is troubleshooting a Windows 10 workstation that repeatedly displays a message stating "The User Profile Service failed the logon. User profile cannot be loaded." The user can log in with a different account. Which of the following should the technician do to allow the user to log in with their original profile while preserving their data?

Accepted Answer

Use the Registry Editor to modify the ProfileList key and remove the .bak extension from the user's SID.. The "User Profile Service failed the logon" error typically stems from a corrupted user profile, often indicated by a .bak extension on the user's SID in the ProfileList registry key. Removing the .bak extension and correcting the profile path restores the original profile without data loss. Other methods either delete data or are less direct.

Answer

Delete the user's profile folder from C:\Users and have the user log in again.

Answer

Recreate the user's account and copy the contents of the old profile folder to the new one.

Answer

Run the System File Checker (SFC) utility to repair corrupted system files.

Question 3

A technician needs to install a 64-bit application on a Windows 11 system. The application requires .NET Framework 3.5. When the technician tries to enable .NET Framework 3.5 through Windows Features, the installation fails with error 0x800F0906. What is the most likely cause?

Accepted Answer

The system does not have an internet connection to download the required files.. Error 0x800F0906 occurs when Windows cannot download the necessary files to enable .NET Framework 3.5. This is typically due to no internet connection or Windows Update being unavailable. The correct resolution is to use DISM with a source path pointing to the Windows installation media, or to enable the feature while connected to the internet. The other options do not match the error code.

Answer

The user does not have administrative privileges.

Answer

The .NET Framework 3.5 feature is corrupted in the Windows component store.

Answer

The application is not compatible with Windows 11.

Question 4

A technician is troubleshooting a Windows 10 workstation that repeatedly shows a message stating the operating system could not be found. The drive is detected in UEFI/BIOS, and the technician suspects the boot configuration is damaged. Which command should the technician run from the Windows Recovery Environment to rebuild the Boot Configuration Data store?

Accepted Answer

bootrec /rebuildbcd. When the Boot Configuration Data store is damaged, Windows cannot locate the operating system even though the disk is healthy. The bootrec /rebuildbcd command scans for installations and reconstructs the BCD, directly addressing the symptom. The other commands either repair the wrong boot component, destroy data, or check disk surface errors rather than the boot database.

Answer

chkdsk /r

Answer

diskpart /clean

Answer

bootrec /fixmbr

Question 5

A technician is upgrading a Windows 11 Pro workstation from a SATA SSD to a larger NVMe drive. The user needs to retain installed applications, user profiles, and the existing domain join. Which tool should the technician use to move the installation to the new drive without reinstalling Windows?

Accepted Answer

Third-party drive cloning software, such as Macrium Reflect or Clonezilla. Cloning is the correct migration path because it duplicates the source disk's partitions and boot configuration onto the new NVMe drive, so the installed applications, profiles, and domain membership continue to work. Image-based restore and reset operations either rebuild the layout or strip applications, and Extend Volume cannot populate a blank disk.

Answer

Disk Management's Extend Volume on the new disk after cloning

Answer

Windows System Image Backup (wbadmin) restore to the new disk

Answer

Windows Recovery Environment's Reset this PC with Keep my files

Question 6

A technician is configuring a Windows 11 workstation for a small business that handles credit card payments. The owner wants to ensure that stored cardholder data cannot be read if the drive is removed and attached to another computer. Which Windows feature should the technician enable?

Accepted Answer

BitLocker. BitLocker encrypts the entire volume, so if the drive is removed and connected to another computer, the data remains unreadable without the recovery key or the original TPM. EFS, firewall rules, and UAC do not provide full-volume encryption, so they fail the physical-theft requirement. BitLocker is the correct built-in Windows feature for protecting data at rest.

Answer

Encrypting File System (EFS)

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Question 7

A user calls the help desk because their Windows 11 laptop will not boot. The screen displays the message "Bootmgr is missing" immediately after the manufacturer logo. The technician needs to repair the boot configuration data so the system can start normally. Which command should the technician run from the Windows Recovery Environment?

Accepted Answer

bootrec /rebuildbcd. The "Bootmgr is missing" error means the boot manager cannot find a valid Boot Configuration Data entry for the Windows installation. The bootrec /rebuildbcd command scans for Windows installations and rebuilds the BCD store, directly resolving this issue. Other recovery commands address different problems such as MBR corruption, system file damage, or disk errors, and would not restore the missing boot entry.

Answer

bootrec /fixmbr

Answer

chkdsk /f

Answer

sfc /scannow

Question 8

A technician is troubleshooting a Windows 10 workstation that is exhibiting symptoms of a malware infection. The technician has already disconnected the computer from the network. Which of the following should the technician do next to remediate the infection? (Choose two.)

Accepted Answer

Run a full antivirus scan using updated definitions.. After isolating the infected system, the technician should run a full antivirus scan with updated definitions to detect and remove malware. Additionally, booting into Safe Mode and using specialized removal tools helps eliminate persistent infections that might resist normal removal. These two actions directly address the malware, while other options are either preventive, premature, or not directly remedial.

Answer

Enable System Restore and create a restore point.

Answer

Reimage the computer immediately without attempting removal.

Answer

Educate the user on safe browsing habits.

Question 9

A user reports that when visiting a banking website, the browser displays a warning that the site's certificate is not trusted, even though the site worked yesterday. The technician verifies the system clock is correct and the network is functioning. Which of the following is the MOST likely cause?

Accepted Answer

The root certificate for the issuing CA was removed from the Trusted Root Certification Authorities store.. A browser trusts a TLS certificate only if it can chain it to a root CA in the Trusted Root Certification Authorities store. If that root was removed, the chain breaks and the browser warns that the certificate is not trusted. An expired certificate or DNS problem could also cause warnings, but the sudden failure with a correct clock points to a missing root certificate.

Answer

The user's account password has expired.

Answer

The website's TLS certificate has expired.

Answer

The DNS server is resolving the banking site to an incorrect IP address.

Question 10

An administrator needs to deploy a standardized Windows 11 image to 40 new workstations and must remove the built-in consumer applications while preserving the Start layout and driver set. Which deployment approach best meets these requirements with the least manual effort per machine?

Accepted Answer

Create a Windows system image with DISM and deploy it with an unattend.xml answer file. A DISM-captured image applied with an unattend.xml answer file delivers a consistent, automated deployment. The administrator can remove built-in applications during image preparation, inject drivers, and define the Start layout once, then apply the same image to all 40 workstations with minimal per-machine interaction.

Answer

Install Windows manually on each PC, then run a PowerShell script to remove applications

Answer

Perform an in-place upgrade on each workstation using a mounted ISO

Answer

Use Windows Backup to restore a reference workstation's files to each new PC

Question 11

A security analyst notices that several workstations on the same subnet are resolving popular banking domains to an IP address that belongs to an unknown server. The analyst confirms the DHCP server is legitimate and the DNS server settings have not been changed by Group Policy. Which of the following attacks is MOST likely occurring?

Accepted Answer

DNS poisoning. DNS poisoning inserts false records into a DNS resolver's cache, so clients receive attacker-controlled IP addresses for legitimate names. Because DHCP and Group Policy are intact, the misdirection must come from the DNS layer. Evil twin, ARP poisoning, and domain hijacking do not match the specific symptom of multiple clients resolving banking domains to an unknown server.

Answer

Evil twin

Answer

Domain hijacking

Answer

ARP poisoning

Question 12

A user at a small office reports that whenever they connect to the corporate Wi-Fi in the break room, their laptop warns that the network is unsecured and other devices on the same network can see their traffic. The access point in the break room broadcasts an open SSID with no password. Which of the following should a technician configure on the access point to protect wireless traffic while keeping the SSID available to employees?

Accepted Answer

Enable WPA3-Personal with SAE. The reported problem is an open wireless network where traffic is visible to other devices. The fix must add authentication and encryption to the wireless link. WPA3-Personal with SAE provides strong per-session encryption using a shared passphrase, which fits a small office that wants employees to connect with one password while keeping the SSID broadcast for easy discovery.

Answer

Change the access point to operate on the 5 GHz band only

Answer

Disable SSID broadcast on the access point

Answer

Enable MAC address filtering for known employee devices

Question 13

A user reports that a Ubuntu Linux workstation boots to a command-line prompt instead of the graphical desktop after a recent package update. The technician wants to check which systemd target is currently active and switch to the graphical environment without rebooting. Which sequence of commands should the technician use?

Accepted Answer

systemctl list-units --type=target, then systemctl isolate graphical.target. Listing active targets identifies the current systemd state, and isolating graphical.target transitions the running system into the graphical environment right away. This satisfies the requirement to switch without rebooting, and the default target can be corrected separately if the change needs to survive a restart.

Answer

systemctl get-default, then systemctl set-default graphical.target

Answer

systemctl isolate multi-user.target, then reboot

Answer

systemctl status graphical.target, then systemctl restart gdm

Question 14

An administrator receives an alert that a workstation is repeatedly making DNS queries for random-looking domain names and sending small amounts of data to external IP addresses every few minutes. The endpoint protection agent is installed and up to date, and no user is logged in. Which of the following is the MOST likely explanation for this behavior?

Accepted Answer

The workstation is infected with malware that uses DNS tunneling for command and control.. Malware that has established a foothold often uses DNS tunneling to evade egress filtering, encoding command-and-control traffic in DNS queries and responses. The combination of randomized domain names, a repeating short interval, small outbound data, and no interactive user strongly indicates a compromised endpoint rather than any normal update, reputation, or time-sync process.

Answer

The workstation is receiving a legitimate software update from the vendor.

Answer

The workstation is synchronizing its clock with an external NTP server.

Answer

The endpoint protection agent is performing a cloud reputation lookup for each file.

Question 15

A security administrator is reviewing authentication methods for a company that wants to reduce the risk of credential theft while allowing employees to log in from personal mobile devices. Which two of the following should the administrator implement? (Choose two.)

Accepted Answer

Biometric authentication. MFA and biometric authentication both add factors that a stolen password alone cannot satisfy, directly reducing the risk of credential theft. SSO, password managers, and RBAC are useful but do not prevent an attacker with stolen credentials from logging in. The administrator should implement MFA and biometric authentication to strengthen login security for personal mobile devices.

Answer

Role-based access control (RBAC)

Answer

Single sign-on (SSO)

Answer

Password manager