220-1102 Practice Test 49 — 15 Questions

Question 1

A technician is asked to dispose of several old company laptops that contain customer records on their internal drives. The drives are traditional spinning magnetic disks, and the company wants to reuse the laptops internally after the data is removed. Which of the following is the BEST method to ensure the customer data cannot be recovered?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a low-level wipe by overwriting the entire drive with multiple passes of random data. The laptops will be reused internally, so the storage must remain functional while the customer data becomes unrecoverable. Overwriting every sector of a magnetic hard disk with random data removes the original bit patterns and defeats forensic recovery. Partition deletion and quick formatting leave recoverable remnants, and degaussing renders the drive unusable.

Answer

Run a standard format of the drive from the operating system installer

Answer

Degauss the drive and then reinstall the operating system

Answer

Delete all partitions and leave the drive unallocated

Question 2

A security analyst notices that an employee's account is logging in successfully from two different countries within a five-minute window. The account uses a complex password, and the employee confirms they did not travel. The organization already requires multifactor authentication for all users. Which of the following is the MOST likely cause of the suspicious logins?

Accepted Answer

The employee's session cookie was stolen and reused by an attacker. MFA blocks credential replay, so an attacker who obtains a valid session token can continue using the already-authenticated session without triggering another challenge. Two successful logins from distant countries within minutes, with a complex password and no travel, point to stolen session cookies rather than password guessing, time-zone display issues, or a single VPN exit node.

Answer

The employee is using a corporate VPN that assigns an exit node in another country

Answer

The employee's password was guessed by a brute-force attack

Answer

The multifactor authentication provider is synchronizing time zones incorrectly

Question 3

A user reports that their Windows 11 laptop display appears very dim even at the highest brightness setting. The technician suspects that the display adapter driver may be causing the issue. Which tool should the technician use to verify the driver version and check for driver errors?

Accepted Answer

Device Manager. Device Manager is the Windows tool that provides a centralized view of hardware devices and their drivers. It allows the technician to check the display adapter's driver version, update it, and see error codes that might explain the dim display. Task Manager, Disk Management, and System Configuration serve different purposes and do not offer driver-level diagnostics for hardware devices.

Answer

Task Manager

Answer

Disk Management

Answer

System Configuration

Question 4

A user reports that their Windows 10 laptop is running very slowly and the hard drive light is constantly active. The technician suspects a malware infection. Which of the following should the technician perform FIRST according to best practices?

Accepted Answer

Disconnect the laptop from the network.. The first step in malware incident response is containment, which means disconnecting the device from the network to prevent the malware from spreading or communicating externally. Running scans, restarting in Safe Mode, or using System Restore are remediation steps that should follow containment. Isolation also preserves evidence for analysis.

Answer

Restart the laptop in Safe Mode with Networking.

Answer

Run a full antivirus scan on the laptop.

Answer

Use System Restore to revert to a previous restore point.

Question 5

A user reports that their Windows 11 laptop frequently displays a message that the battery is not charging and the system clock keeps resetting to an earlier date. The laptop is plugged into a known-good power outlet. Which of the following should a technician check first?

Accepted Answer

The CMOS battery. The CMOS battery maintains the system clock and BIOS settings when the computer is unplugged. When it fails, the clock resets and sometimes power management settings are lost, which can affect battery charging. The power adapter, hard drive, and RAM do not cause the clock to reset. Therefore, the CMOS battery is the first component to check.

Answer

The power adapter

Answer

The hard drive

Answer

The RAM

Question 6

A user calls the help desk stating that their laptop screen is cracked and they need it replaced. The company policy requires that all hardware repairs be performed by the IT department. The user is remote and cannot come to the office. Which of the following should the technician do FIRST?

Accepted Answer

Create a ticket, document the damage, and arrange for a depot repair or onsite service.. The first action is to create a ticket, document the damage, and arrange for repair via depot or onsite service. This complies with company policy, ensures proper asset tracking, and addresses the remote user's needs. Other options either bypass policy, delay the process, or fail to follow standard operating procedures. Proper documentation and authorized repair channels are essential.

Answer

Instruct the user to purchase a replacement screen online and install it themselves.

Answer

Remote into the laptop and run diagnostics to confirm the screen is cracked.

Answer

Ship the user a replacement laptop and have them return the damaged one.

Question 7

A technician is asked to dispose of several old company laptops that contain sensitive customer data. The company wants to ensure the data cannot be recovered while still allowing the laptops to be donated. Which of the following should the technician perform?

Accepted Answer

Perform a secure erase or overwrite the drives.. Secure erase or overwriting renders the original data unrecoverable while keeping the drive usable, so the laptops can be donated. Physical destruction prevents donation, and formatting or repartitioning leaves recoverable data. The technician should choose a sanitization method that meets both the security and reuse goals.

Answer

Run a standard format on the drives.

Answer

Delete all partitions and create a new one.

Answer

Physically destroy the hard drives.

Question 8

A user complains that every time they open their web browser, the homepage has changed to an unfamiliar search site and new toolbars appear. They did not change these settings. Which of the following is the MOST likely cause?

Accepted Answer

The browser has been infected with a potentially unwanted program (PUP).. The sudden appearance of toolbars and homepage changes without user action is characteristic of a potentially unwanted program. These are often bundled with free downloads and modify browser settings. The correct response is to identify and uninstall the PUP, then reset the browser to its default configuration to remove any remaining changes.

Answer

The DNS server is returning incorrect results.

Answer

The user's roaming profile is corrupt.

Answer

The browser needs to be updated to the latest version.

Question 9

A user reports that their Android smartphone is running very slowly and the battery drains quickly, even when the phone is idle. The user recently installed several new apps from a third-party app store. Which of the following should a technician do FIRST to troubleshoot the issue?

Accepted Answer

Check the battery usage statistics to identify power-hungry apps.. When a phone slows down and battery drains after installing new apps, the most efficient first step is to review battery usage statistics. This built-in tool identifies which apps are consuming the most power, allowing the technician to target the likely culprit without erasing data or removing all new apps.

Answer

Update the Android operating system to the latest version.

Answer

Uninstall all apps installed from the third-party store.

Answer

Perform a factory reset of the device.

Question 10

A technician is called to a user's desk where the user has left a sticky note with their password taped to the monitor. The technician needs to document this in the ticket. Which of the following should the technician do FIRST?

Accepted Answer

Report the security violation according to the organization's incident response policy.. The correct action is to report the security violation according to policy. Passwords left in plain sight are a serious security risk that must be escalated through proper channels. This allows the organization to handle the situation consistently, educate the user, and prevent similar incidents. Taking direct action like removing the note or sharing it could interfere with investigations or violate privacy.

Answer

Ignore it because it is the user's personal workspace and not the technician's concern.

Answer

Remove the sticky note and discard it, then close the ticket as resolved.

Answer

Take a photo of the sticky note and post it in the team chat as a joke.

Question 11

A user's Windows 10 laptop has become increasingly slow over the past month. The hard drive activity light is constantly on, and the system often freezes for several seconds. A technician suspects the issue is related to a failing hard disk drive (HDD). Which two of the following should the technician perform to confirm the diagnosis? (Choose two.)

Accepted Answer

Check the S.M.A.R.T. status using a diagnostic tool.. To confirm a failing HDD, the technician should check S.M.A.R.T. data for warning signs and run chkdsk /r to scan for and recover bad sectors. These tools directly assess the drive's health and can reveal physical errors, unlike defragmentation, memory testing, or disk cleanup, which address other issues.

Answer

Use Disk Cleanup to remove temporary files.

Answer

Run the Windows Memory Diagnostic tool.

Answer

Defragment the hard drive using the built-in Windows tool.

Question 12

A user complains that their Windows 10 computer takes a very long time to start up and become responsive after logging in. They have not installed any new programs. Which of the following should a technician check FIRST to improve startup performance?

Accepted Answer

The Task Manager Startup tab to disable unnecessary startup programs.. Slow startup and login are often caused by too many programs launching at startup. Task Manager's Startup tab lists these programs and their impact, allowing a technician to disable unnecessary ones. This is a quick, reversible step that often resolves the issue without deeper troubleshooting. Other tools are either not first-line or target different problems.

Answer

The System Configuration utility (msconfig) to set a selective startup.

Answer

The Event Viewer to look for errors during startup.

Answer

The Disk Management console to check for disk errors.

Question 13

A technician is troubleshooting a Windows 11 desktop that randomly freezes and displays a blue screen with the stop code DRIVER_IRQL_NOT_LESS_OR_EQUAL. The technician suspects a recently updated device driver. Which two tools or artifacts should the technician examine to identify the offending driver? (Choose two.)

Accepted Answer

The memory dump file analyzed with WinDbg. The memory dump analyzed with WinDbg names the faulting module directly, and Driver Verifier forces the misbehaving driver to crash deterministically so it can be identified. Together they move the investigation from a general bug check to a specific driver file that can be updated, rolled back, or removed.

Answer

Reliability Monitor

Answer

Event Viewer's System log

Answer

Performance Monitor's counter logs

Question 14

A technician is configuring a Windows 11 workstation that will be shared by multiple users in a lab. The requirement is that each user's documents and settings remain separate, and that the disk space used by each user's profile is limited to 500 MB. Which Windows feature should the technician use to enforce the storage limit?

Accepted Answer

Disk Quotas. Disk Quotas are the Windows feature designed to limit the amount of disk space individual users can consume on a volume. By enabling quotas on the volume storing user profiles and setting a 500 MB limit per user, the technician ensures each user's profile cannot exceed the specified size. Other options address data redirection, storage pooling, or privilege elevation, none of which enforce per-user storage limits.

Answer

Storage Spaces

Answer

Folder Redirection

Answer

User Account Control

Question 15

A user's Windows 11 laptop has become extremely slow, and Task Manager shows constant 100% disk usage with very low actual read/write throughput. The drive is a SATA SSD, and the system is fully updated. A technician notices the drive is using the standard Microsoft AHCI driver. Which of the following is the MOST likely cause?

Accepted Answer

The drive is using the wrong storage controller driver, causing high latency.. High disk active time with almost no throughput on a SATA SSD often stems from the storage controller driver. The generic Microsoft AHCI driver may not handle the drive's queuing and power features efficiently, causing latency. Installing the correct chipset or storage driver from the system or motherboard vendor is the most likely fix, after confirming SMART health is good.

Answer

The paging file is disabled, forcing excessive disk access.

Answer

The SSD is failing and should be replaced immediately.

Answer

Windows Search indexing is still building its initial index.