220-1102 Hard Questions — 25 Difficult Questions

Question 1

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

Accepted Answer

Disable the account to prevent further access.. The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Answer

Reset the account password and enable MFA.

Answer

Review the server logs to determine the extent of the breach.

Answer

Notify the employee's manager and HR department.

Question 2

A technician is installing a new UPS (Uninterruptible Power Supply) in a server rack. The UPS is heavy and must be mounted securely. What is the most important safety consideration during installation?

Accepted Answer

Use a lifting team or mechanical lift to position the UPS.. The UPS is a heavy piece of equipment, and improper lifting can cause serious injury or damage. Using a lifting team or mechanical lift ensures safe handling and prevents back strain, crush injuries, or dropping the unit, which is the primary safety concern during physical installation.

Answer

Ensure the UPS is connected to a grounded outlet before mounting.

Answer

Verify that the UPS batteries are charged before installation.

Answer

Install the UPS at the top of the rack for better airflow.

Question 3

A security incident response team needs to find all files in /var/www that have the SUID bit set, which may indicate a privilege escalation risk. Which command should they use?

Accepted Answer

find /var/www -type f -perm /4000. Option B is correct because the `find` command with `-perm /4000` matches any file that has the SUID bit set (the 4000 octal permission), regardless of other permission bits. The `/` prefix tells `find` to match if any of the specified permission bits are set, which is the precise way to locate files with the SUID bit enabled. This command will recursively search `/var/www` for regular files (`-type f`) with the SUID bit, helping identify potential privilege escalation risks.

Answer

find /var/www -type f -perm 4000

Answer

ls -la /var/www | grep '^...s'

Answer

chmod -R u+s /var/www

Question 4

A change advisory board (CAB) approves a network switch replacement, but the technician discovers during implementation that the new switch requires a different firmware version than documented. The change plan does not include a rollback for this scenario. What is the best course of action?

Accepted Answer

Stop the implementation and contact the CAB for a revised change plan.. When an undocumented deviation occurs during a change, the technician should halt the implementation and contact the CAB for guidance. Proceeding without approval risks network instability, and the CAB can provide a revised plan or approve the firmware change.

Answer

Proceed with the firmware update and document the change afterward.

Answer

Use the old switch firmware on the new switch to match the documentation.

Answer

Implement the switch and create a separate change request for the firmware.

Question 5

A technician is performing a routine software update on a finance department server. The change management documentation specifies that the update must be applied during a maintenance window from 2:00 AM to 4:00 AM. At 3:30 AM, the update fails with an error. The technician has no rollback plan documented. What should the technician do?

Accepted Answer

Leave the server in its current state and escalate the issue to the change manager.. Option B is correct because the technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Answer

Attempt to roll back the update using the server’s built-in recovery options.

Answer

Continue troubleshooting until the maintenance window ends, then document the failure.

Answer

Reboot the server to clear the error and retry the update.

Question 6

A technician is troubleshooting a recurring network outage that occurs every Tuesday at 3 PM. After reviewing the change log, the technician finds that a scheduled backup job runs at that time. What is the best course of action?

Accepted Answer

Document the correlation and propose a change to the backup schedule.. This question tests the ability to correlate documented changes with incidents. The best action is to update the documentation to reflect the impact and then work with the change advisory board to reschedule the backup or mitigate the outage.

Answer

Disable the backup job immediately to restore network stability.

Answer

Increase the network bandwidth to accommodate the backup traffic.

Answer

Ignore the issue since the backup is a critical process.

Question 7

A company is experiencing a security incident where an attacker gained access to the internal network via a compromised VPN account. The technician must prevent future attacks. Which two-factor authentication method should the technician implement for VPN access?

Accepted Answer

Implement a time-based one-time password (TOTP) via an authenticator app. Two-factor authentication (2FA) adds a second factor beyond the password, such as a one-time code from an authenticator app. This significantly reduces the risk of account compromise even if the password is stolen.

Answer

Require a complex password with a minimum length of 20 characters

Answer

Restrict VPN access to specific IP addresses

Answer

Enable single sign-on (SSO) with Active Directory

Question 8

A company requires that all remote access sessions be recorded for compliance purposes. The current VPN solution does not support session recording. Which of the following additional technologies can be integrated to capture and store remote desktop sessions?

Accepted Answer

Implement a Remote Desktop Gateway with session recording software. A Remote Desktop Gateway (RD Gateway) can be configured to broker and log RDP sessions, and when combined with a session recording solution, it can capture all activity. VPN alone does not provide session recording, and other methods like VNC or SSH typically lack built-in recording features.

Answer

Use SSH tunneling for all remote access

Answer

Configure the VPN to use PPTP instead of L2TP

Answer

Deploy a VNC server on each remote workstation

Question 9

A technician is writing a Python script to automate the cleanup of user profiles on a Windows server. The script must iterate through all user profile folders in 'C:\Users', check the last modified date, and delete profiles older than 90 days. Which scripting concept is essential for this task?

Accepted Answer

A for loop to iterate over folders. This question tests understanding of loops, conditionals, and file system operations in a scripting language. A 'for' loop is needed to iterate through each folder, combined with an 'if' statement to check the date condition. Without a loop, the script would only process one folder. Error handling is important but not the core concept for iteration.

Answer

Error handling with try-except

Answer

A while loop with a counter

Answer

A function to calculate date difference

Question 10

A technician is troubleshooting a network issue and needs to access the user's computer remotely. The user is in a different city and speaks with a heavy accent, making communication difficult. The technician has trouble understanding the user's description of the error. What is the best approach?

Accepted Answer

Ask the user to type the error message in a chat window to avoid miscommunication.. This question tests adaptability and respectful communication when language barriers exist. The correct answer uses a collaborative, patient approach to ensure understanding without causing embarrassment.

Answer

Speak slowly and loudly, repeating each question until the user understands.

Answer

Ask the user to transfer the call to a colleague who speaks English more clearly.

Answer

Proceed with remote access without further communication, assuming you can diagnose the issue visually.

Question 11

A user reports that their Windows 10 PC is unable to connect to network shares on a server, but internet access works fine. You suspect the 'Workstation' service is not running. Which administrative tool should you use to verify and start this service?

Accepted Answer

Services console to locate the 'Workstation' service and start it.. The 'Workstation' service (LanmanWorkstation) is a core Windows service that enables the computer to initiate outbound SMB connections to network shares. The Services console (services.msc) is the correct administrative tool to check the status of this service and start it if it is stopped. Option C directly addresses the need to verify and manage this service.

Answer

Task Manager > Startup tab to check if the service is enabled.

Answer

Network and Sharing Center to run the network troubleshooter.

Answer

Device Manager to reinstall the network adapter driver.

Question 12

You are troubleshooting a Windows 10 PC that fails to boot with the error 'Boot Configuration Data is missing.' Which built-in tool can you use from the Windows Recovery Environment to rebuild the BCD store?

Accepted Answer

Bootrec.exe. Bootrec.exe is the correct built-in tool for rebuilding the Boot Configuration Data (BCD) store from the Windows Recovery Environment (WinRE). The specific command 'bootrec /rebuildbcd' scans all disks for Windows installations and allows you to rebuild the BCD store, directly addressing the 'Boot Configuration Data is missing' error. Other tools like SFC, Diskpart, and CHKDSK do not have the capability to reconstruct the BCD store.

Answer

System File Checker (sfc /scannow)

Answer

Diskpart

Answer

CHKDSK

Question 13

A technician needs to deploy a custom Windows 10 image to 50 identical workstations. The image must include specific drivers, applications, and settings. Which tool should the technician use to create and manage the deployment image?

Accepted Answer

System Preparation Tool (Sysprep). System Preparation Tool (Sysprep) is used to generalize a Windows installation so it can be imaged and deployed to multiple computers. DISM is used to capture and apply images, but Sysprep is required to prepare the OS for imaging. Windows PE is a minimal OS for deployment tasks, not for creating the image. Windows ADK includes deployment tools but Sysprep is the specific tool for image preparation.

Answer

Deployment Image Servicing and Management (DISM)

Answer

Windows Preinstallation Environment (Windows PE)

Answer

Windows Assessment and Deployment Kit (Windows ADK)

Question 14

A user is unable to change their desktop background because the option is grayed out. You suspect a Group Policy setting is enforcing a specific wallpaper. Which Control Panel tool would you use to check if a Group Policy is applied, and what is the specific path to verify this setting?

Accepted Answer

Administrative Tools > Local Security Policy. The Administrative Tools in Control Panel provides access to 'Local Security Policy' or 'Group Policy Management' for advanced users. However, the quickest way to check applied policies is to run 'rsop.msc' from the Run dialog, which is not in Control Panel. The correct answer tests knowledge that Administrative Tools contains shortcuts to policy editors, but the specific tool is not directly in Control Panel. The best choice is Administrative Tools > Local Security Policy or Group Policy Editor, depending on Windows edition.

Answer

System > Advanced system settings > Performance

Answer

Personalization > Background

Answer

Ease of Access Center > Make the computer easier to see

Question 15

A security incident occurred where an employee's workstation was infected with ransomware. The IT manager wants to ensure that all future workstations have Controlled Folder Access enabled to protect critical data from unauthorized changes. Which Windows Security applet should be used to configure this?

Accepted Answer

Windows Security > Virus & threat protection > Manage ransomware protection. Controlled Folder Access is a feature of Windows Defender Exploit Guard, found in the Windows Security app under Virus & threat protection > Manage ransomware protection. It must be enabled and configured with protected folders and allowed apps.

Answer

Windows Security > Firewall & network protection

Answer

Windows Security > App & browser control

Answer

Windows Security > Device security

Question 16

A technician needs to configure a Windows 10 kiosk machine that runs a single full-screen application for public use. They want to prevent users from accessing the desktop, taskbar, or any other system functions. Which Settings page should they use to set up this restricted user experience?

Accepted Answer

Settings > Accounts > Other users > Set up a kiosk. Option C is correct because the 'Set up a kiosk' option under Settings > Accounts > Other users is the dedicated Windows 10 feature for configuring an assigned access kiosk. This setting restricts the user to a single full-screen Universal Windows Platform (UWP) app and blocks access to the desktop, taskbar, and other system functions, meeting the exact requirement for a public-facing kiosk.

Answer

Settings > Personalization > Start

Answer

Control Panel > User Accounts > Manage User Accounts

Answer

Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings

Question 17

A user reports that their Windows 11 laptop's battery drains quickly even when idle. They have already checked for background apps and power-hungry processes. Which single Settings page can you use to generate a detailed battery usage report showing which apps and hardware have consumed the most power over the last 24 hours?

Accepted Answer

Settings > System > Power & battery > Battery usage. The correct tool is 'Battery usage' under Settings > System > Power & battery. This page provides a graph and detailed list of app and hardware power consumption, which can help identify the cause of rapid drain.

Answer

Settings > System > Power & battery > Battery saver

Answer

Control Panel > Power Options > Edit Plan Settings

Answer

Settings > Privacy & security > Diagnostics & feedback

Question 18

A security incident occurred where an unauthorized user gained access to a workstation. The security team needs to review detailed logs of all user logon attempts, including successful and failed logins, for the past 48 hours. Which administrative tool and specific log should you access to provide this information?

Accepted Answer

Event Viewer > Windows Logs > Security. Event Viewer's Windows Logs > Security log records all security-related events, including logon attempts (success and failure). This is the standard location for auditing user activity. Other logs like System or Application do not focus on authentication events.

Answer

Event Viewer > Windows Logs > System

Answer

Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager

Answer

Computer Management > System Tools > Shared Folders > Sessions

Question 19

A user's Windows 10 PC is experiencing random freezes and application crashes. You suspect a corrupted system file. You run sfc /scannow but it reports that it cannot repair some files. What is the next best step to repair the system files using a DISM command?

Accepted Answer

Run DISM /Online /Cleanup-Image /RestoreHealth. The correct next step is to run DISM /Online /Cleanup-Image /RestoreHealth because SFC (System File Checker) relies on a healthy component store (WinSxS) to replace corrupted files. When SFC cannot repair files, it indicates the component store itself may be damaged. DISM repairs the component store by using Windows Update as the source, or a specified repair source, thereby enabling SFC to succeed on a subsequent scan.

Answer

Run chkdsk /f

Answer

Run System Restore

Answer

Run Windows Update

Question 20

A security incident has occurred: a user's Mac running macOS Ventura was infected with malware that modified system files. The technician needs to boot the Mac into a mode that loads only essential Apple-signed kernel extensions and prevents third-party software from loading, in order to safely remove the malware. Which startup mode should they use?

Accepted Answer

Safe Mode (Shift key during startup).. Safe Mode (Shift key during startup) is correct because it forces macOS to load only essential kernel extensions that are signed by Apple, disables all third-party startup items and login items, and runs a directory integrity check. This minimal environment prevents the malware from loading its own kernel extensions or other malicious code, allowing the technician to safely remove the infected files without interference.

Answer

Single-user mode (Command + S).

Answer

Verbose mode (Command + V).

Answer

Target Disk Mode (T key).