220-1102 Hard Questions — 25 Difficult Questions

Question 1

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Group Policy Preferences to set the local administrator password.. Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Answer

Store the password in a plain text file and have the script read it.

Answer

Embed the password in the script using a variable and run it from a hidden share.

Answer

Use a scheduled task that runs the script as SYSTEM.

Question 2

A company is decommissioning a data center and must destroy 1000 HDDs and 200 SSDs. The policy mandates that all data be destroyed on-site and that the drives be rendered physically unusable. Which combination of methods is most efficient?

Accepted Answer

Use a hard drive shredder to shred all drives.. Shredding physically destroys both HDDs and SSDs in a single pass, meeting the policy requirement for on-site destruction and rendering drives physically unusable. Degaussing is ineffective for SSDs due to their flash memory, and overwriting is too slow for 1000 drives and also ineffective for SSDs with TRIM or wear-leveling. Shredding is the most efficient method for mixed media at scale.

Answer

Degauss all drives and then recycle them.

Answer

Overwrite all drives with a three-pass wipe.

Answer

Use a degausser for HDDs and a secure erase for SSDs.

Question 3

An organization experiences a data breach when an attacker physically removes hard drives from a decommissioned server that was placed in a storage area without being properly sanitized. What physical security control should have been implemented?

Accepted Answer

Use a degausser to erase the hard drives before disposal.. The core issue is that the hard drives were not properly sanitized before disposal, allowing an attacker to recover data from them. A degausser is a physical security control that uses a strong magnetic field to erase data on magnetic media, such as hard disk drives (HDDs), rendering the drives unreadable and unrecoverable. This directly addresses the root cause of the breach by ensuring data is destroyed before the hardware leaves a secure environment.

Answer

Install a surveillance camera in the storage area.

Answer

Require a smart card to access the storage area.

Answer

Apply tamper-evident seals to the server chassis.

Question 4

A technician is performing a routine software update on a finance department server. The change management documentation specifies that the update must be applied during a maintenance window from 2:00 AM to 4:00 AM. At 3:30 AM, the update fails with an error. The technician has no rollback plan documented. What should the technician do?

Accepted Answer

Leave the server in its current state and escalate the issue to the change manager.. The technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Answer

Attempt to roll back the update using the server’s built-in recovery options.

Answer

Continue troubleshooting until the maintenance window ends, then document the failure.

Answer

Reboot the server to clear the error and retry the update.

Question 5

A user's Windows 10 laptop is experiencing random restarts, especially under heavy load like gaming or video rendering. The Event Viewer shows multiple 'Kernel-Power 41' critical errors. The CPU temperature is normal, and the power supply is functioning. Which component is most likely causing the issue?

Accepted Answer

The graphics card is overheating.. Kernel-Power 41 errors indicate unexpected shutdowns or restarts. The symptoms of random restarts specifically under heavy load like gaming or video rendering, with normal CPU temperature and a functioning power supply, strongly suggest an issue with the graphics card. Gaming and video rendering heavily utilize the GPU, and if it's overheating (which is not ruled out by the normal CPU temperature), it can cause the system to shut down or restart unexpectedly to prevent damage, leading to a Kernel-Power 41 error.

Answer

The RAM is faulty.

Answer

The motherboard is failing.

Answer

The Windows installation is corrupt.

Question 6

A company uses a private cloud for its internal applications. The IT team wants to ensure that if one physical host fails, the virtual machines running on it can be automatically restarted on another host with minimal downtime. Which feature should they implement?

Accepted Answer

High availability. High availability (HA) is the correct feature because it is designed to automatically restart virtual machines on a surviving host within a cluster when a physical host fails. HA uses heartbeat monitoring between hosts and a resource manager to detect failures and trigger VM restarts, minimizing downtime without requiring manual intervention.

Answer

Fault tolerance

Answer

Live migration

Answer

Snapshots

Question 7

During a security audit, a technician discovers that a company Android device has an app that can read SMS messages and access contacts without the user's knowledge. The app was sideloaded. What built-in Android security feature could have prevented this?

Accepted Answer

Google Play Protect. Google Play Protect is the correct answer because it is Android's built-in security feature that scans apps for malicious behavior, including those sideloaded from outside the Play Store. It can block or warn about apps that request excessive permissions like reading SMS and accessing contacts without user knowledge. This feature would have prevented the malicious app from being installed or alerted the user before installation.

Answer

Samsung Knox

Answer

Android Device Manager

Answer

Verified Boot

Question 8

A technician is troubleshooting a network issue for a remote employee. The employee's internet connection is unstable, and the technician suspects the home router. The employee is not technical and becomes defensive when the technician asks about their router setup. Which approach is MOST effective?

Accepted Answer

Say, 'Let's work together to check a few things on your router to improve your connection.'. It uses a collaborative, non-confrontational approach that respects the employee's lack of technical knowledge and defuses defensiveness. By saying 'Let's work together,' the technician invites the employee to participate without blame, making it easier to guide them through checking the router's configuration (e.g., verifying Wi-Fi channel congestion, checking for firmware updates, or reviewing DHCP lease times) without requiring the employee to understand technical details. This aligns with CompTIA's emphasis on professionalism and effective communication in remote troubleshooting.

Answer

Tell the employee that their router is probably cheap and needs replacement.

Answer

Ask the employee to run a command prompt command without explanation.

Answer

Escalate the issue to a senior technician without further attempts.

Question 9

A user reports that a script they run daily now fails with 'Text file busy' error. The script is located on an NFS mount. Which command will show if the script is currently being used by another process?

Accepted Answer

lsof /path/to/script. `lsof /path/to/script` lists all processes that have the file open, including those holding it for execution. The 'Text file busy' error occurs when a process is executing the script (the text segment is mapped), and `lsof` can detect this by showing the file descriptor or memory mapping for the running process.

Answer

fuser /path/to/script

Answer

ps aux | grep script

Answer

strace -p $(pgrep script)

Question 10

A user reports that their Windows 10 PC is infected with malware that keeps reinstalling after removal. You need to boot into a minimal environment to run antivirus scans without malware interference. Which advanced startup option should you use?

Accepted Answer

Safe Mode. Safe Mode (B) loads Windows with a minimal set of drivers and services, preventing malware that runs as a startup program or service from loading. This allows antivirus software to scan and remove the infection without interference, addressing the scenario where malware reinstalls after removal in a normal boot.

Answer

Enable Boot Logging

Answer

Last Known Good Configuration

Answer

Debugging Mode

Question 11

A security audit reveals that a user's Windows 10 workstation has remote desktop enabled, which violates company policy. You need to disable Remote Desktop and ensure it cannot be easily re-enabled by the user. Which Control Panel tool should you use?

Accepted Answer

System > Remote Desktop. The Remote Desktop setting is managed through System Properties > Remote tab, which can be accessed via Control Panel > System > Remote Desktop. Disabling it here prevents the user from easily re-enabling it through the Settings app, as the Control Panel path requires administrative privileges to modify, whereas the Settings app may allow a standard user to toggle it. This directly addresses the audit finding by enforcing the policy at the system level.

Answer

Windows Defender Firewall

Answer

User Accounts > Manage another account

Answer

Administrative Tools > Services

Question 12

A security analyst discovers that an attacker has been using a compromised VPN account to access the corporate network. The account belongs to a former employee who was terminated two weeks ago. Which of the following should the analyst do immediately to prevent further unauthorized access?

Accepted Answer

Disable the former employee's VPN account. Disabling the former employee's VPN account immediately stops the attacker from using the compromised credentials to access the corporate network. This is the most direct and effective action to prevent further unauthorized access, as the account is the vector being exploited. Other steps like log review or server reconfiguration are important but secondary to cutting off the active attack path.

Answer

Review the VPN logs to determine the extent of the breach

Answer

Change the VPN server's shared secret

Answer

Notify the former employee about the security incident

Question 13

A technician needs to configure a Windows 10 computer to use a static IP address of 192.168.1.100 with subnet mask 255.255.255.0 and default gateway 192.168.1.1. Which command-line tool and syntax should be used?

Accepted Answer

netsh interface ip set address "Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1. The `netsh interface ip set address` command is the proper Windows command-line tool to configure a static IP address, subnet mask, and default gateway. The syntax `"Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1` specifies the interface name, the static keyword, the IP address, the subnet mask, the default gateway, and the metric (1), which matches the required configuration.

Answer

ipconfig /setaddress 192.168.1.100

Answer

netstat -r

Answer

ping 192.168.1.1

Question 14

During a routine check, a technician finds that a user's Windows 10 computer has an outdated antivirus that hasn't updated in 3 months. The user claims they never saw any update prompts. What is the most likely reason and the appropriate remediation?

Accepted Answer

The Windows Update service is disabled; re-enable it and set to automatic. The most likely reason the antivirus hasn't updated in 3 months is that the Windows Update service (wuauserv) is disabled. Many Windows 10 antivirus solutions, including Windows Defender, rely on the Windows Update service to download definition updates. If this service is disabled, the antivirus cannot receive updates, and the user would not see update prompts because the update mechanism itself is non-functional. Re-enabling the service and setting it to automatic allows updates to flow normally.

Answer

The antivirus subscription has expired; renew it

Answer

The user has manually set the antivirus to manual update mode

Answer

The computer is infected with a virus that blocks updates

Question 15

An IT manager wants to implement a data destruction policy that meets the U.S. Department of Defense (DoD) 5220.22-M standard for top-secret data. The drives are HDDs and will be reused within the organization. Which method is required?

Accepted Answer

Run a three-pass overwrite (zeros, ones, random).. The DoD 5220.22-M standard for top-secret data requires a three-pass overwrite (zeros, ones, and a random character) to ensure that residual magnetic data is unrecoverable. Since the drives are HDDs and will be reused, overwriting is the appropriate method because it sanitizes the media without destroying it. A single overwrite or degaussing would not meet the three-pass requirement, and physical destruction would prevent reuse.

Answer

Perform a single overwrite with zeros.

Answer

Use a degausser and then reformat the drive.

Answer

Physically destroy the drive with a hammer.

Question 16

During a forensic investigation, a technician needs to recover files that a user deleted from their Mac's internal SSD several days ago. The Trash has been emptied. Which macOS feature or tool should be attempted first to recover these files?

Accepted Answer

Restore from a Time Machine backup. Time Machine is the built-in macOS backup feature that automatically creates incremental backups of the system. If a Time Machine backup was made before the files were deleted, the user can browse the backup timeline and restore the deleted files directly, even after the Trash has been emptied. This is the simplest and most reliable first step because it does not require specialized tools or risk overwriting data.

Answer

Use the Terminal command 'fs_usage' to locate the deleted files

Answer

Run Disk Utility First Aid on the SSD

Answer

Use a third-party file recovery tool immediately

Question 17

A technician is investigating a privilege escalation vulnerability. They need to list all files in /usr/bin that have the SUID or SGID bit set and are owned by root. Which single command will achieve this?

Accepted Answer

find /usr/bin -user root -perm /6000. The `find` command with `-perm /6000` matches files where either the SUID (4000) or SGID (2000) bit is set, combined with `-user root` to restrict results to files owned by root. The `/` prefix in the permission mask tells `find` to match any of the specified bits, making it the precise single command for this task.

Answer

find /usr/bin -user root -perm -6000

Answer

find /usr/bin -user root -perm 4000 -o -perm 2000

Answer

ls -la /usr/bin | grep '^...s'

Question 18

A user's MacBook Air running macOS Ventura is experiencing intermittent kernel panics. The crashes seem to occur when the laptop is connected to a specific USB-C hub. Which macOS tool should you use to analyze the crash logs and identify the faulty driver?

Accepted Answer

Console. The Console app is the correct tool because it provides a centralized interface for viewing all system logs, including kernel panic reports (stored in /Library/Logs/DiagnosticReports). When a kernel panic occurs, macOS generates a .panic file containing stack traces and loaded kext (kernel extension) information. By examining these logs in Console, you can identify the specific kext or driver (e.g., a USB hub driver) that triggered the panic, especially when the crash is hardware-dependent like this USB-C hub scenario.

Answer

System Information

Answer

Activity Monitor

Answer

Terminal with 'sudo dmesg' command

Question 19

A system administrator needs to change the group ownership of a directory /srv/data and all its contents to 'datagroup'. Which command will accomplish this recursively?

Accepted Answer

chgrp -R datagroup /srv/data. The correct command is `chgrp -R datagroup /srv/data`. The `-R` (or `--recursive`) flag tells `chgrp` to operate on the directory and all its contents, changing the group ownership to 'datagroup'. This directly fulfills the requirement to change group ownership recursively.

Answer

chown datagroup: /srv/data

Answer

chmod -R g+rw /srv/data

Answer

groupmod -R datagroup /srv/data

Question 20

During a forensic investigation, an analyst needs to list all files in a directory that have been modified in the last 24 hours, including hidden files, and display the results with full path and timestamp. Which command should they use?

Accepted Answer

find . -mtime -1 -ls. The `find` command with `-mtime -1` lists files modified within the last 24 hours, and the `-ls` action displays detailed output including full path and timestamp. This approach inherently includes hidden files (those starting with a dot) because `find` traverses all directory entries by default, unlike `ls` which requires the `-a` flag to show hidden files.

Answer

ls -laR --time-style=full-iso | grep '2025-03-21'

Answer

stat * .* | grep Modify

Answer

find . -newer /tmp/ref -ls