220-1102 Practice Question: Runs outside the main Windows operating system.

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  System Restore

  System Restore reverts system files and settings to a previous point, but does not scan for or remove malware.

• ✗

  Safe Mode

  Safe Mode loads Windows with minimal drivers, but the malware might still be active and prevent tools from running.

• ✗

  Last Known Good Configuration

  This option is used to boot with the last successful configuration; it is not a malware scanning tool.

Technical deep dive

How to think about this question

Windows Defender Offline is specifically designed to address malware infections that are deeply embedded within the operating system or actively prevent security tools from running. When initiated, it reboots the computer into a minimal, pre-boot environment, essentially a separate operating system, where Windows Defender can run a full scan without interference from the active Windows installation or any malware residing within it. This isolation is crucial because the malware in this scenario is preventing access to critical system tools like Task Manager and Command Prompt, indicating it has a strong foothold and is actively trying to evade detection and removal. By operating outside the compromised OS, Windows Defender Offline can access and clean files that would otherwise be locked or protected by the malware. This approach fundamentally differs from the other options. System Restore, while useful for reverting system changes, does not scan for or remove malware; it merely rolls back system files to an earlier state, which might still contain the infection. Safe Mode loads a stripped-down version of Windows, but the malware could still be active or have components that prevent security software from functioning effectively, especially if it's designed to detect and disable antivirus in minimal environments. Last Known Good Configuration is a boot option for resolving startup issues caused by recent driver or system changes, not a tool for malware remediation. The ability of Windows Defender Offline to operate independently of the main Windows installation is what makes it the most effective solution for stubborn, system-level malware.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…