220-1102 Practice Question: A technician is supporting a field engineer tablet

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  Local Users and Groups

  Local user management does not directly address the stated issue.

• ✗

  System Restore

  System Restore is useful for reversing certain Windows changes but is not the best fit for this specific goal.

• ✗

  Event Viewer

  Event Viewer is useful for logs, but this scenario requires a different primary tool or control.

Technical deep dive

How to think about this question

The core concept being tested here is the critical importance of maintaining the integrity of potential evidence, which is paramount in forensic investigations or situations where legal action might be involved. Chain of custody documentation is a meticulous record-keeping process that tracks the possession, handling, and transfer of physical or digital evidence from the moment it is collected until it is presented in court or disposed of. This documentation ensures that the evidence has not been tampered with, altered, or contaminated, thereby preserving its authenticity and admissibility. In the scenario of a field engineer's tablet, which may contain critical operational data or even evidence of a security incident, establishing a clear chain of custody immediately upon seizure or discovery is the best practice to prevent challenges to its validity later on. It details who had access to the device, when, and for what purpose, creating an unbroken audit trail. This procedure stands apart from the other options because it directly addresses the 'evidence' aspect of the question. Local Users and Groups is for managing user accounts and permissions, which is a system administration task unrelated to evidence preservation. System Restore is a Windows feature designed to revert system files and settings to a previous state, useful for troubleshooting software issues but destructive to potential evidence if not handled carefully and documented. Event Viewer provides logs of system events, which can be part of evidence, but the Event Viewer itself is a tool for viewing data, not a procedure for securing and documenting the handling of the entire device as potential evidence. The chain of custody is a procedural control that overlays any technical actions taken on the device, ensuring accountability and integrity.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…