220-1102 Practice Questions 1 — 50 Questions

Question 1

During a Windows 10 deployment, you need to ensure that a specific Group Policy setting is applied to a computer before any user logs on. Which policy processing mode should you configure?

Accepted Answer

Computer Configuration. Computer Configuration policies in Group Policy apply to the computer itself and take effect at boot, before user logon. User Configuration policies apply only after a user logs on. To ensure a setting is applied before any user logs on, it must be placed under Computer Configuration.

Answer

Loopback processing mode

Answer

User Configuration

Answer

Administrative Templates

Question 2

After installing a new printer driver, a user's Windows 11 computer crashes with a blue screen error every time they try to print. The computer works fine otherwise. Which boot option should be used to restore functionality without affecting user data?

Accepted Answer

Boot into Safe Mode and uninstall the printer driver.. The problem is caused by a faulty driver, and the safest way to recover is to boot into Safe Mode, which loads only essential drivers. From Safe Mode, the technician can uninstall the problematic printer driver. This tests understanding of Safe Mode as a troubleshooting environment for driver conflicts.

Answer

Use Last Known Good Configuration to revert driver changes.

Answer

Run System Restore from the recovery environment.

Answer

Perform a clean installation of Windows 11.

Question 3

A user reports that their Windows 10 computer is infected with a virus that keeps reinstalling itself after removal. What should you do to remediate this persistent infection?

Accepted Answer

Boot from a rescue disc or USB and run an antivirus scan. A virus that reinstalls itself likely has a rootkit or persistent mechanism. Booting from trusted media and scanning the offline system ensures the malware cannot run, allowing complete removal.

Answer

Run a system restore to a previous restore point

Answer

Disable System Restore and then run an antivirus scan in normal mode

Answer

Reinstall Windows from the recovery partition

Question 4

During a routine check, a technician finds that a user's Windows 10 computer has an outdated antivirus that hasn't updated in 3 months. The user claims they never saw any update prompts. What is the most likely reason and the appropriate remediation?

Accepted Answer

The Windows Update service is disabled; re-enable it and set to automatic. Outdated antivirus often results from the update service being disabled or misconfigured. Checking the Windows Update or antivirus update service ensures that automatic updates can run, preventing future lapses.

Answer

The antivirus subscription has expired; renew it

Answer

The user has manually set the antivirus to manual update mode

Answer

The computer is infected with a virus that blocks updates

Question 5

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

Accepted Answer

Use a Group Policy to allow only the specific USB device by hardware ID, then remove the allowance after use. Group Policy can be used to block all USB storage by default, but you can create an exception by allowing specific devices via device ID or by using a more granular policy. The best approach is to temporarily grant access to the specific device, then reapply the block.

Answer

Disable the USB blocking Group Policy for the entire domain

Answer

Give the manager a company-approved USB drive and tell them to use it only once

Answer

Create a local admin account on the manager's workstation and disable the USB block locally

Question 6

A customer reports that their Windows 10 laptop is displaying pop-up ads even when no browser is open. They suspect a malware infection. Which of the following should you do first to remediate this issue?

Accepted Answer

Disconnect the network cable, boot into Safe Mode, then run a full antivirus scan.. The first step in malware remediation is to disconnect from the network to prevent further communication with command-and-control servers. Then boot into Safe Mode to prevent malicious processes from loading, and run a full antivirus scan. This isolates the threat before attempting removal.

Answer

Run a full antivirus scan while the system is connected to the internet.

Answer

Perform a System Restore to a point before the pop-ups started.

Answer

Immediately reinstall Windows 10 to ensure complete removal.

Question 7

A user calls the help desk because their workstation is running very slowly and they notice unusual network activity. You suspect ransomware. What should you do first to contain the threat?

Accepted Answer

Disconnect the workstation from the network immediately.. The immediate priority is containment to prevent the ransomware from spreading to other systems on the network. Isolating the workstation by disconnecting it from the network is the first step, followed by notifying the security team.

Answer

Run a full antivirus scan on the affected workstation.

Answer

Back up all files to an external drive before taking action.

Answer

Restart the computer and boot into Safe Mode.

Question 8

A technician is configuring a new Windows 10 workstation for a user who handles sensitive financial data. The company policy mandates that the screen lock after 5 minutes of inactivity and require a password on wake. Which settings should the technician configure?

Accepted Answer

Configure the screen saver to start after 5 minutes and check 'On resume, display logon screen.'. The screen saver settings in Windows include an option to 'On resume, display logon screen,' which locks the workstation after the screen saver activates. Setting the screen saver timeout to 5 minutes and enabling the logon screen requirement meets the policy.

Answer

Set the power plan to turn off the display after 5 minutes.

Answer

Enable the 'Require password on wakeup' setting in the power plan only.

Answer

Set the computer to sleep after 5 minutes and require a password on wake.

Question 9

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

Accepted Answer

Disable the account to prevent further access.. The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Answer

Reset the account password and enable MFA.

Answer

Review the server logs to determine the extent of the breach.

Answer

Notify the employee's manager and HR department.

Question 10

A user reports that their external hard drive is no longer recognized by Windows. They suspect it might be infected with malware from a previous connection. You run a security scan and find no threats. What is the most likely cause of the drive not being recognized?

Accepted Answer

The USB controller driver is corrupted or outdated.. When a drive is not recognized after a suspected malware incident, the issue is often driver-related or due to a corrupted file system, not necessarily malware. Reinstalling or updating the USB controller driver in Device Manager can resolve recognition issues. The correct answer is to check Device Manager for driver issues.

Answer

The drive is permanently damaged by malware.

Answer

The user needs to format the drive to remove malware.

Answer

Windows Firewall is blocking the external drive.

Question 11

A customer complains that their iPhone's Wi-Fi keeps disconnecting and reconnecting. They have already rebooted the phone and the router. Which of the following is the MOST likely cause?

Accepted Answer

The phone's Wi-Fi profile is corrupted.. This scenario tests knowledge of common mobile Wi-Fi issues. After basic steps, forgetting and reconnecting to the network often resolves profile corruption or authentication problems.

Answer

The phone's SIM card is faulty.

Answer

The Wi-Fi network password was changed recently.

Answer

The phone's operating system needs a full restore via iTunes.

Question 12

A user reports that their Android phone's screen is unresponsive to touch, but the buttons and notification LED still work. They have already performed a forced restart. What should the technician do NEXT?

Accepted Answer

Boot the phone into Safe Mode to check if the issue persists.. This scenario tests troubleshooting touchscreen issues. Since a forced restart didn't help, booting into Safe Mode can determine if a third-party app is causing the problem.

Answer

Replace the screen assembly.

Answer

Perform a factory reset from the recovery menu.

Answer

Update the phone's firmware using a computer.

Question 13

A customer's iPhone is experiencing frequent app crashes and the device feels warm to the touch. They have not installed any new apps recently. What is the most likely cause?

Accepted Answer

The operating system needs to be updated.. Overheating in mobile devices often leads to performance throttling and app instability. This scenario suggests a resource-intensive background process or a failing battery, but the most common cause of overheating and crashes without new apps is an outdated OS with known bugs. Keeping iOS updated resolves many stability issues.

Answer

The device has a virus or malware.

Answer

The battery is failing and needs replacement.

Answer

Too many apps are running in the background.

Question 14

A user complains that their Android phone's battery drains quickly after installing a new weather app. The phone is warm to the touch even when idle. What should you do to resolve this?

Accepted Answer

Check battery usage in Settings to see which app is consuming power.. Battery drain and overheating after app installation indicate a misbehaving app. The best first step is to check battery usage statistics to identify the culprit, then force stop or uninstall that app. This is a standard Android troubleshooting procedure.

Answer

Replace the battery immediately.

Answer

Perform a factory reset to remove all apps.

Answer

Update the phone's operating system to the latest version.

Question 15

A user reports that their iPad will not rotate the screen when they turn the device sideways. The rotation lock icon appears in the status bar. What is the most likely cause?

Accepted Answer

Rotation lock is enabled in Control Center or via the side switch.. The rotation lock icon indicates the feature is enabled. On an iPad, this can be controlled via the Control Center or a physical switch on the side. The technician should disable rotation lock before any other troubleshooting.

Answer

The accelerometer is faulty.

Answer

The app being used does not support rotation.

Answer

The device needs a software update to fix a rotation bug.

Question 16

A company's Android devices are failing to connect to the corporate email server after a security policy update. The devices show 'Authentication failed' for the email app. What is the most likely cause?

Accepted Answer

The email app's server settings (IMAP/POP/SMTP) are no longer correct.. After a security policy update, authentication failures often stem from outdated or incorrect server settings. The most common change is an updated server address or port. The technician should verify the incoming/outgoing server settings in the email app.

Answer

The devices need a factory reset to clear cached credentials.

Answer

The SIM cards are deactivated.

Answer

The devices are infected with malware that blocks email.

Question 17

A company deploys a custom app via MDM to Android devices. Users report that the app crashes immediately upon launch. The app works fine on the developer's test device. What is the most likely cause?

Accepted Answer

The app requires a specific Android API level that is not present on the deployed devices.. App crashes on deployment often stem from missing dependencies or incompatible API levels. The most common cause is that the target devices are running an older Android version than the app's minimum SDK. The technician should check the app's manifest requirements against the device OS version.

Answer

The MDM profile is corrupt and needs to be re-pushed.

Answer

The devices have insufficient storage space.

Answer

The app is not signed with the correct enterprise certificate.

Question 18

A customer reports that their computer shuts down unexpectedly after a few minutes of use. The system feels hot to the touch, and the fan is running loudly. What is the most appropriate first step for a technician to take to ensure safety while diagnosing the issue?

Accepted Answer

Unplug the computer, let it cool for 30 minutes, then inspect for dust or fan failure.. This question tests knowledge of electrical safety and proper handling of overheated equipment. The correct answer is to unplug the computer to prevent electrical shock or fire, then allow it to cool before inspecting internal components. Attempting to open a hot system or ignoring the heat can lead to injury or further damage.

Answer

Immediately open the case and touch the CPU heatsink to check temperature.

Answer

Spray compressed air into the vents while the system is running to clear dust.

Answer

Replace the power supply unit immediately to fix the overheating.

Question 19

During a network upgrade, a technician needs to run new Ethernet cables through a drop ceiling. The technician notices that some existing cables are resting on the ceiling tiles and are not secured. What safety concern should the technician address?

Accepted Answer

Secure all cables to the ceiling grid using appropriate cable supports.. Unsecured cables on ceiling tiles can cause the tiles to fall, creating a head injury risk and damaging equipment. Cables should be secured to the building structure using J-hooks or cable trays. This also prevents tripping hazards and maintains fire code compliance.

Answer

Leave the cables as they are and run the new cables alongside them.

Answer

Use zip ties to attach the cables to the sprinkler pipes for stability.

Answer

Remove the existing cables and replace them with the new ones.

Question 20

A technician is tasked with decommissioning a server that contains a RAID array of hard drives. The drives are still functional, but the data must be securely erased. What is the most secure method to ensure data cannot be recovered?

Accepted Answer

Use a degausser to erase the magnetic data on the drives.. Degaussing destroys the magnetic field on the platters, making data unrecoverable. Physical destruction is also secure, but degaussing is the most efficient for bulk drives. Simply reformatting or overwriting may leave recoverable data.

Answer

Perform a quick format of each drive.

Answer

Overwrite the drives with zeros using a low-level format.

Answer

Physically destroy the drives with a hammer.