220-1202 practice questions with answers

Answer: A) System Configuration (msconfig)

System Configuration (msconfig) supports Selective startup: you hide Microsoft services, disable the third-party ones, and re-enable them one at a time to find the service causing a problem. Safe Mode loads a fixed minimal set and does not allow that per-service control.

• ACorrect. On the Services tab of System Configuration, the technician can hide Microsoft services, click Disable all, and then select services one at a time, restarting after each change. Clearing any item switches the General tab to Selective startup. Microsoft documents this process for finding the service that causes a startup problem.
• BIncorrect. Safe Mode starts Windows with a fixed, minimal set of drivers and services. The technician cannot choose which individual third-party services load, so it cannot be used to re-enable them one at a time.
• CIncorrect. Event Viewer displays logged errors and warnings, which can help identify a failing component. It cannot stop services from loading at the next startup.
• DIncorrect. Resource Monitor shows real-time CPU, memory, disk, and network use by running processes and services. It does not configure which services load during startup.

Answer: A) Extend

• AExtend mode treats the second monitor as additional desktop space, letting different windows/content appear on each screen — the opposite of Duplicate mode, which mirrors the identical image on both displays.
• BDuplicate mode mirrors the exact same image on both screens, the opposite of the additional usable desktop space being requested here.
• C"Second screen only" disables the primary display entirely and shows everything only on the second monitor — not the extended, dual-active-display setup being requested.
• DAirplane mode disables wireless radios; it has no relationship to multi-monitor display configuration.

Answer: A) Prevent access to registry editing tools

'Prevent access to registry editing tools' disables Regedit.exe however it is launched and shows a policy message. The 'Don't run' and 'Run only' app-list policies only cover programs started by File Explorer, so users can get around them from Cmd.exe.

• ACorrect. This setting disables Regedit.exe. When a user tries to start it, a message says a policy setting prevents the action. It doesn't depend on how the program is launched, and it leaves Cmd.exe and batch files available.
• BIncorrect. Microsoft documents that this setting only blocks programs started by the File Explorer process. If users can open Cmd.exe, they can still start a listed program from the command window, so it doesn't meet the requirement.
• CIncorrect. This allow list also only applies to programs started by File Explorer, so users with Cmd.exe access can get around it. It would also block every other program not on the list.
• DIncorrect. This setting blocks the interactive Cmd.exe window, which users need to keep. It doesn't disable Regedit.exe itself.

Answer: A) The group still exists for compatibility, but most of its extra permissions were removed beginning with Windows Vista

Since Windows Vista, Power Users has been a legacy group with most of its permissions removed. It's kept only for backward compatibility, and Administrator and Standard user are the account types that matter.

• ACorrect. Starting with Windows Vista, Microsoft removed most of the permissions granted to Power Users. The group was kept because some organizations had assigned it permissions and depended on it. Membership no longer gives a meaningful middle tier of privileges, so the account types that matter are Administrator and Standard user.
• BIncorrect. Power Users was never merged into Administrators. Its permissions were reduced, not raised to full administrative rights.
• CIncorrect. Members' ability to install software and drivers was a known way to escalate to administrator, which is why Microsoft stripped the group's permissions in Vista. It isn't a recommended privilege tier today.
• DIncorrect. Remote Desktop Users is a separate built-in group that grants remote sign-in rights. Power Users wasn't renamed to it and has no role in RDP access.

Answer: A) It lowers the risk of a faulty patch breaking apps, but extends exposure to known vulnerabilities

Requiring approval before patching lets IT catch compatibility problems before production. The cost is a longer window in which systems stay exposed to vulnerabilities that are already known.

• ACorrect. Testing before deployment catches compatibility problems before they reach production. But until the patch is approved, the systems stay vulnerable to flaws that have already been disclosed and may be actively exploited. Many organizations shorten this window by fast-tracking critical patches.
• BIncorrect. This reverses the trade-off. Approval delays deployment, which increases exposure, and the testing reduces, rather than raises, the chance of a faulty patch breaking apps.
• CIncorrect. A zero-day has no patch yet, so an approval process can't protect against it. Approving patches also doesn't prevent a failed update from being uninstalled or rolled back.
• DIncorrect. Bandwidth isn't the security trade-off here, and approving patches has nothing to do with turning off the firewall.

Answer: A) Shadow IT; company data sits in a service whose security and compliance IT has never assessed or controlled

Using technology without IT approval or review is shadow IT. The main concern is that company data sits in a service IT has not vetted and cannot see or control.

• ACorrect. Shadow IT is the use of apps or services without IT approval or oversight. The main risk is that company data ends up in a service nobody has vetted for security, data handling or compliance, and IT can't see or control it.
• BIncorrect. BYOD is about employees using their own hardware. The scenario is about an unapproved cloud service, and nothing in it says which devices were used.
• CIncorrect. An insider threat involves misuse, often intentional, by trusted users. These employees were using a convenient tool for normal work, not trying to steal or harm.
• DIncorrect. Piracy means using software without a valid license. The service is free, and the real problem is that it was never approved or reviewed, not a licensing violation.

Answer: A) Detecting and alerting on physical entry that doesn't go through a badge read, such as a forced door

Badge readers control and log credentialed entry. Intrusion sensors add detection and alerting for physical entry that bypasses the badge read, such as a forced or propped door. The two layers work together in a defense-in-depth design.

• ACorrect. Door contacts and motion detectors sense physical events like a door opening or movement in the room, no matter whether a badge was presented. They raise an alert for forced entry, a propped door, or entry through another opening. Monitored intrusion detection is meant to detect these events and alert personnel automatically.
• BIncorrect. Checking credentials and deciding whether to unlock is the job of the access control system itself. Door contacts and motion detectors don't authenticate anyone.
• CIncorrect. The badge system already creates the identity-based audit trail of authorized entries. Motion and door sensors only report that an event happened, not who caused it.
• DIncorrect. Allowing only one person per credential is done by an access control vestibule (mantrap) or turnstile. Contact and motion sensors can detect activity, but they can't physically limit how many people pass through.

Answer: A) Official store apps go through a review before publication, which lowers the chance of installing malicious code

Limiting installs to the official app store means every app has passed the store's review first. Sideloading and third-party stores skip that review, so malware is more likely to get onto the device.

• ACorrect. Official app stores review and vet apps before publishing them. Unofficial stores and sideloaded installer files usually skip that vetting, so blocking them lowers the risk of installing malware. Review lowers the risk but does not remove it.
• BIncorrect. Installing an app from an unknown source does not block OS updates. The risk is that the app itself may be malicious or tampered with, because no store review has checked it.
• CIncorrect. Device storage encryption is a platform or MDM setting and does not depend on where an app was installed from. The difference between the sources is vetting, not encryption.
• DIncorrect. Store apps run sandboxed with only the permissions they are granted, not elevated system privileges. The policy exists to limit installs to vetted sources.

Answer: A) Review the Diagnostics-Performance Operational log in Event Viewer for shutdown events that name a slow application or service

When shutdown is slow, a single app, service, or device is often taking too long to stop. Windows records shutdown performance in Event Viewer's Diagnostics-Performance log, which can identify that component so the technician can investigate it instead of guessing.

• ACorrect. Event Viewer's Applications and Services Logs include Windows performance diagnostics that track system shutdown. These events can name the specific application, service, or device that delayed shutdown, so the technician can investigate that component directly.
• BIncorrect. Windows doesn't have to empty or process the Temp folder before powering off. Disk Cleanup frees space but doesn't identify the component that is holding up shutdown.
• CIncorrect. The paging file size doesn't control how long services and applications take to stop. Changing it is a guess that doesn't diagnose the cause of the delay.
• DIncorrect. The message stays on screen because shutdown is still in progress, not because of a display fault. Rolling back the video driver without evidence doesn't address the component that is actually slow to stop.

Answer: A) From an elevated prompt, run DISM with /Online /Cleanup-Image /RestoreHealth, then run sfc /scannow and restart

Microsoft documents 0x800f081f as component store corruption. The fix is to run DISM RestoreHealth, then SFC, then restart. The other options are documented fixes for different Windows Update errors.

• ACorrect. Microsoft's Windows Update error reference lists 0x800f081f as component store corruption. The listed fix is to repair the component store with Dism /Online /Cleanup-Image /RestoreHealth, run sfc /scannow, and restart the device.
• BIncorrect. Microsoft gives this fix for 0x80070bc9 (ERROR_FAIL_REBOOT_REQUIRED), which happens when Group Policy keeps TrustedInstaller set to Manual. It doesn't repair a corrupted component store.
• CIncorrect. Checking firewall and proxy rules is the fix for connection and timeout errors such as 0x80072EFD and 0x80072EE2. Error 0x800f081f comes from the servicing stack and points to component store corruption, not a network problem.
• DIncorrect. Signing in and allowing a restart is the fix for 0x80240020 (WU_E_NO_INTERACTIVE_USER). It doesn't repair the missing or corrupted component store source files behind 0x800f081f.

Answer: A) Check for the original profile folder under C:\Users and under C:\Windows.old\Users

Files that seem to vanish after a feature update are usually still on the drive, either in the original profile folder under C:\Users (when a temporary profile has loaded) or in Windows.old\Users. Check these locations before using recovery tools or resets.

• ACorrect. When Windows loads a temporary profile, the user's original profile folder and files usually still exist under C:\Users. After an upgrade, earlier data may also be under Windows.old\Users. Windows deletes Windows.old automatically after about 10 days, so check it promptly.
• BIncorrect. This step comes too early. The files most likely weren't deleted; the user just isn't signed in to their original profile. Undelete tools are for files that were actually deleted, and you should only use one after checking the known profile and Windows.old locations.
• CIncorrect. Resetting Windows is a disruptive step that doesn't fit this problem. It can remove the Windows.old data and complicate recovery before anyone has checked where the files actually are.
• DIncorrect. Windows discards a temporary profile when the user signs out, so any files copied into it can be lost. First recover the original profile or create a new permanent profile.

Answer: A) The other PCs send jobs to a print queue shared by the host PC's print spooler, so the host must be awake to serve them

A printer shared from a Windows PC is reached through that PC's print spooler, which acts as the print server. When the host sleeps, the shared queue becomes unreachable. Keep the host awake or give the printer its own network connection.

• AWhen a Windows PC shares a locally attached printer, its print spooler acts as the print server. It shares the print queue with print clients and sends their jobs on to the printer. If the host sleeps, that queue is unreachable, so the fix is to stop the host from sleeping or connect the printer directly to the network.
• BA USB-attached printer has no network IP address of its own, and a standard Windows client PC doesn't provide DHCP. The other PCs reach the printer through the host's shared queue, not directly over the network.
• CIf network discovery were the cause, the printer would be unavailable all the time, not only while the host sleeps. Printing also returns as soon as the host wakes, which points to the host being the dependency.
• DA corrupted driver would not fix itself when the host wakes. Here, printing returns with no reinstall, which fits a host-availability dependency, not a driver fault.

Answer: A) An Acceptable Use Policy (AUP)

• AAn AUP defines the rules and expectations for how employees may use company IT resources, covering things like permitted personal use, prohibited activities, and software installation rules, giving both employees and IT a clear, agreed-upon standard.
• BA Safety Data Sheet documents a specific chemical's handling/safety information, unrelated to IT resource usage rules.
• CA warranty card covers repair/replacement terms for a specific product, unrelated to IT usage rules.
• DA chain of custody form documents evidence handling for an investigation, unrelated to general IT usage policy.

Answer: A) Disconnect the server from the network and notify the security team as the incident response plan requires

For an active breach, first contain it, for example by isolating the system from the network, while keeping evidence intact, and report it through the incident response process. Remediation steps such as deleting files, reimaging or rebooting come later and destroy evidence if done first.

• ACorrect. Isolating the server from the network contains the active breach. Leaving it powered on keeps volatile evidence such as memory, running processes and open sessions. Reporting through the documented channel brings in the people responsible for investigation and chain of custody.
• BIncorrect. Deleting files changes the system and destroys evidence before the incident has been reported or scoped. The attacker's session also stays connected while the scan runs.
• CIncorrect. Reimaging is a recovery step. Doing it first wipes the forensic evidence needed to find out how the breach happened and what data was taken, and it skips reporting.
• DIncorrect. Powering off loses volatile evidence such as memory contents, running processes and network connections. It also skips the required notification, and the attacker could get back in after the restart.

Answer: A) Live data on the server, a nightly backup to a local tape library, and a copy replicated to cloud storage in another region

The 3-2-1 rule requires at least three copies of the data, on two different types of media, with at least one copy off-site. Only the server-plus-tape-plus-cloud plan meets all three conditions.

• ACorrect. This plan has three copies of the data: production, tape and cloud. They sit on at least two different types of media (server disk and tape, plus cloud), and the cloud copy is off-site. All three conditions of the 3-2-1 rule are met.
• BIncorrect. There are three copies, but all of them are on disk-type media in the same room. No copy is off-site, so a fire or flood could destroy every copy at once.
• CIncorrect. The off-site requirement is met, but there are only two copies of the data. The 3-2-1 rule calls for at least three.
• DIncorrect. A RAID 1 mirror is not a backup: deletions and corruption are copied to both drives instantly. Even if the mirror were counted, nothing is stored off-site.