View Full CompTIA 220-1202 Exam Dumps and Practice Test Dumps.

 

Question 41

Which type of malware is designed to encrypt a victim’s files and demand payment for recovery?

1. Spyware
2. Adware
3. Ransomware
4. Rootkit

Correct Answer: 3

Explanation

Ransomware is malware that encrypts files or otherwise prevents users from accessing their data and then demands payment from the victim. It can spread through malicious attachments, compromised websites, stolen credentials, or vulnerable systems. Technicians should isolate an infected system from networks to help prevent further spread and preserve evidence when appropriate. Paying the attacker does not guarantee successful recovery. A reliable backup strategy is one of the most important defenses because clean backups can allow affected systems and data to be restored without relying on the attacker.

Question 42

A technician receives an email that appears to come from a manager requesting an urgent password reset. The message contains a suspicious link. What type of attack is this most likely?

1. Phishing
2. Tailgating
3. Shoulder surfing
4. Dumpster diving

Correct Answer: 1

Explanation

Phishing is a social engineering technique in which an attacker attempts to deceive a user into revealing information, opening malicious content, or visiting a fraudulent website. Attackers often create a sense of urgency and impersonate trusted individuals such as managers, banks, or service providers. A suspicious password-reset link should not be opened simply because the message appears legitimate. The technician should verify the request through an independent communication method and report the suspicious message according to organizational procedures.

Question 43

Which security principle requires a user to receive only the access necessary to perform assigned duties?

1. Defense in depth
2. Least privilege
3. Separation of duties
4. Nonrepudiation

Correct Answer: 2

Explanation

The principle of least privilege limits users and processes to only the permissions required to perform their authorized tasks. This reduces the potential impact if an account is compromised or misused. For example, a standard employee should not automatically receive administrative rights when those privileges are unnecessary. Least privilege can be implemented through account permissions, group memberships, application controls, and administrative policies. Technicians should periodically review permissions because unnecessary privileges can remain after job responsibilities change.

Question 44

Which malware type can secretly record a user’s keystrokes?

1. Trojan
2. Worm
3. Keylogger
4. Logic bomb

Correct Answer: 3

Explanation

A keylogger is designed to capture keyboard input, potentially allowing an attacker to obtain usernames, passwords, messages, or other sensitive information. Keyloggers may exist as software-based malware or, less commonly, as physical devices. If a technician suspects a compromised workstation, the system should be isolated and examined using approved security procedures. Sensitive credentials should not be entered into a potentially compromised system until the infection has been addressed. Multi-factor authentication can also reduce the impact of stolen passwords.

Question 45

Which wireless security protocol provides stronger modern protection than WPA2 and supports current Wi-Fi security features?

1. WEP
2. WPA
3. WPA2
4. WPA3

Correct Answer: 4

Explanation

WPA3 is a modern wireless security protocol that provides improvements over older wireless security standards. It offers stronger protections for supported wireless networks and improves security during authentication. WEP is obsolete and should not be used for modern deployments because its security weaknesses are well known. WPA2 remains widely deployed, but WPA3 is the newer standard where compatible equipment is available. Technicians should also use strong authentication credentials and appropriate network configuration rather than relying on the protocol alone.

Question 46

A technician discovers that an employee installed unauthorized software from an unknown website. What should the technician do first if malware infection is suspected?

1. Continue using the computer normally
2. Disconnect the affected system from the network
3. Delete every file immediately
4. Disable all security controls

Correct Answer: 2

Explanation

If malware infection is suspected, isolating the affected system from the network is an important early action. Disconnecting network connectivity can help prevent malware from communicating with external systems or spreading to shared resources and other devices. The technician should then follow the organization’s approved incident-response and malware-removal procedures. Immediately deleting files or disabling security tools can destroy useful evidence or make investigation more difficult. The exact response should follow documented procedures and the organization’s security requirements.

Question 47

Which physical security control is intended to prevent unauthorized people from following an authorized person through a secured entrance?

1. Mantrap
2. Screen lock
3. Encryption
4. Password manager

Correct Answer: 1

Explanation

A mantrap is a physical access-control arrangement using two doors or controlled entry points to help prevent unauthorized individuals from following an authorized person into a restricted area. The first door must typically close before the second door can open. Mantraps are useful in environments requiring stronger physical access control, such as data centers and secure facilities. They differ from logical controls such as passwords and encryption, which protect systems and information rather than directly controlling physical entry.

Question 48

Which technique involves watching a person enter confidential information such as a password?

1. Phishing
2. Shoulder surfing
3. Spoofing
4. Pharming

Correct Answer: 2

Explanation

Shoulder surfing occurs when an attacker observes a person entering or viewing sensitive information. Passwords, PINs, account numbers, and confidential documents can all be exposed through this technique. It can happen in public places, offices, or other environments where unauthorized individuals can see a user’s screen or keyboard. Privacy screens, careful positioning of displays, and awareness of surrounding people can reduce the risk. Strong authentication methods can also help limit the consequences if one authentication factor is observed.

Question 49

A technician must permanently remove sensitive data from an old solid-state drive before disposal. Which method is most appropriate?

1. Quick format
2. File deletion
3. Secure erase
4. Rename the files

Correct Answer: 3

Explanation

Secure erase is designed to remove data from supported storage devices in a manner intended to make previous information difficult or impractical to recover. Simply deleting files or performing a quick format may leave recoverable information behind. Storage technology also matters because traditional overwrite approaches do not necessarily provide the same result on modern solid-state drives. Organizations should follow approved data-destruction procedures and applicable policies before disposing of storage media. Physical destruction may also be required when data sensitivity or organizational policy demands it.

Question 50

Which security measure requires two or more different authentication factors before access is granted?

1. Single sign-on
2. Multifactor authentication
3. Account lockout
4. Password expiration

Correct Answer: 2

Explanation

Multifactor authentication, or MFA, requires authentication using multiple factor categories, such as something the user knows, something the user has, or something the user is. For example, a password combined with a security token or biometric verification provides more protection than a password alone. MFA can reduce the impact of stolen passwords because an attacker may still lack the additional authentication factor. Technicians should configure MFA according to organizational security requirements and provide users with secure recovery methods.

Question 51

A Windows computer displays a blue screen shortly after a new driver is installed. What should the technician consider first?

1. Roll back or remove the recently installed driver
2. Replace the monitor
3. Change the desktop wallpaper
4. Reinstall the printer

Correct Answer: 1

Explanation

A recently installed driver is a likely suspect when a Windows system begins experiencing blue screen errors immediately afterward. The technician should consider booting into an appropriate recovery environment or Safe Mode and rolling back or removing the problematic driver. The exact cause should be confirmed rather than assuming every blue screen is driver-related. Event logs, crash information, and recent system changes can provide additional evidence. If the driver caused the problem, installing a verified compatible version may resolve the issue.

Question 52

A user reports that an application suddenly closes whenever a specific function is selected. Other applications work normally. What is the most appropriate troubleshooting approach?

1. Replace the system RAM immediately
2. Investigate the affected application and its configuration
3. Replace the network switch
4. Repartition the hard drive

Correct Answer: 2

Explanation

When one application repeatedly crashes while the rest of the operating system functions normally, troubleshooting should initially focus on that application. The technician can check application updates, configuration files, dependencies, permissions, available resources, and relevant error logs. Reproducing the issue can help determine whether the failure is consistent and tied to a specific function. Repairing or reinstalling the application may be appropriate after simpler causes are investigated. Replacing unrelated hardware would not be an efficient first response.

Question 53

A smartphone has become extremely slow after several unfamiliar applications were installed. What should the technician investigate?

1. Installed applications and potential malware
2. Printer toner level
3. Ethernet cable category
4. Desktop monitor refresh rate

Correct Answer: 1

Explanation

Unexpected applications can consume processing resources, memory, storage, battery power, or network bandwidth. They may also introduce unwanted or malicious behavior. A technician should review recently installed applications, remove unauthorized software when appropriate, check for security alerts, and examine device resource usage. The device should be handled according to organizational mobile-device policies. If compromise is suspected, additional security procedures may be necessary. The technician should avoid assuming that every performance problem is caused by hardware failure.

Question 54

A user cannot access a website because the browser repeatedly redirects to unfamiliar pages. Which issue should the technician investigate?

1. Browser hijacking
2. Low printer ink
3. Display resolution
4. Defective keyboard

Correct Answer: 1

Explanation

Browser hijacking occurs when unwanted software or configuration changes redirect browser traffic, modify search settings, alter the homepage, or otherwise interfere with normal browsing. Technicians should inspect browser extensions, installed applications, proxy settings, DNS configuration, and security software results. Suspicious extensions or software should be removed according to approved procedures. The system should also be scanned for malware when appropriate. Persistent redirection can indicate a broader compromise, so technicians should not simply change the browser homepage without investigating the underlying cause.

Question 55

Which backup strategy maintains multiple copies of data on different types of media, including one copy stored off-site?

1. 3-2-1 backup strategy
2. Full disk formatting
3. RAID 0
4. Incremental patching

Correct Answer: 1

Explanation

The 3-2-1 backup strategy recommends maintaining three copies of important data, using at least two different types of storage media, with at least one copy kept off-site. The approach reduces the risk that a single hardware failure, theft, fire, or other incident will destroy every copy. Backups should also be tested periodically because having backup files does not guarantee successful recovery. Organizations should select backup schedules, retention periods, and storage locations based on business requirements and data importance.

Question 56

A technician needs to document the actions taken to resolve a customer’s support issue. Where should this information normally be recorded?

1. Ticketing system
2. BIOS settings
3. Temporary browser history
4. Screen saver configuration

Correct Answer: 1

Explanation

A ticketing system provides a centralized location for documenting customer issues, troubleshooting actions, resolutions, and relevant communication. Accurate ticket notes allow other technicians to understand what has already been attempted and prevent unnecessary repetition. Documentation can also support reporting, escalation, auditing, and future troubleshooting. Notes should be factual, professional, and clear while avoiding unnecessary sensitive information. Technicians should follow organizational documentation standards and update tickets throughout the troubleshooting process rather than relying on personal notes.

Question 57

Before replacing a component on a production computer, an organization requires approval and documentation of the planned modification. What process is being followed?

1. Change management
2. Social engineering
3. Data destruction
4. Authentication

Correct Answer: 1

Explanation

Change management is a controlled process for planning, approving, documenting, implementing, and reviewing changes to IT systems. It helps organizations reduce unexpected outages and ensures that significant modifications are properly evaluated. A change request may include the reason for the change, affected systems, implementation steps, risks, testing requirements, and rollback procedures. Following change management is especially important in production environments where an apparently simple modification can affect users or dependent services.

Question 58

Which action best protects a technician from electrostatic discharge when working inside a computer?

1. Wear an ESD wrist strap connected appropriately to ground
2. Work on carpet while wearing synthetic clothing
3. Increase the computer’s fan speed
4. Spray compressed air directly onto powered components

Correct Answer: 1

Explanation

An appropriately used ESD wrist strap helps safely dissipate static electrical charge from a technician while servicing electronic components. Static discharge can damage sensitive components even when the damage is not immediately visible. Technicians should also work in an appropriate environment and follow the manufacturer’s and organization’s safety procedures. Power should be removed when required, and components should be handled by appropriate surfaces rather than contacts or exposed circuitry. ESD precautions are especially important when handling memory, processors, expansion cards, and storage components.

Question 59

A technician needs to remotely assist a user while allowing the user to see the technician’s actions on the desktop. Which technology is appropriate?

1. Remote desktop or remote assistance software
2. Disk partitioning
3. File compression
4. BIOS flashing

Correct Answer: 1

Explanation

Remote desktop or remote assistance technologies allow a technician to access or interact with a user’s computer over a network, depending on the specific tool and configuration. Remote support can reduce response time and eliminate the need for physical travel. Before establishing a remote session, technicians should verify authorization and follow organizational security requirements. Remote access should use secure authentication and appropriate encryption. When the session ends, the technician should disconnect and ensure that temporary access mechanisms are not left enabled unnecessarily.

Question 60

Which practice is most appropriate when communicating technical information to a nontechnical customer?

1. Use complex terminology whenever possible
2. Explain the issue clearly using understandable language
3. Avoid explaining the problem entirely
4. Blame the customer for causing the issue

Correct Answer: 2

Explanation

Effective technical support requires communication that matches the customer’s level of technical understanding. A technician should explain the issue clearly, avoid unnecessary jargon, describe the proposed solution, and confirm that the customer understands any required actions. Professional communication should remain respectful and focused on resolving the problem rather than assigning blame. Clear communication can improve customer confidence and reduce misunderstandings. When technical terms are necessary, the technician should explain them in simple language rather than assuming the customer already understands them.