12 real 220-1102 sample questions, each with a worked explanation and a rationale for every option, right and wrong. No account, no card. This is the reasoning the 220-1102 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real 220-1102 is Maximum of 90 questions questions in 90 minutes, pass mark 700 / 900. For a domain-by-domain breakdown and a study plan, read the 220-1102 study guide. The full bank has 300 questions.
lock_openFree sampleOperating Systemsmedium
Priya needs to move several 6 GB video files back and forth on a single USB flash drive that must be readable and writable on both Windows 11 and macOS without installing extra software. Which file system should she format the drive with?
- AexFAT, because it supports files well above 4 GB and is natively read/write on both Windows and macOScheck_circle Correct
- BFAT32, because it is the most widely supported removable-media format across desktop operating systems
- CNTFS, because it journals writes and both operating systems fully support reading and writing it
- Dext4, because it is a modern journaling file system that stores large media files reliably
Select exFAT for removable media that must carry files larger than 4 GB with native read/write access on both Windows and macOS. The two hard constraints are files over 4 GB and native read/write on Windows and macOS. FAT32 fails the size limit, NTFS is read-only on macOS by default, and ext4 is not natively mounted by either, so exFAT is the only format that satisfies all of them.
Why A is correct: exFAT was designed for flash media, removes the 4 GB per-file limit, and is natively read/write on modern Windows and macOS, meeting every constraint.
Why B is wrong: FAT32 is broadly compatible, which makes it tempting, but it caps individual files at 4 GB, so a 6 GB video will not fit.
Why C is wrong: NTFS handles large files, but macOS mounts NTFS volumes read-only by default, so Priya could not write to the drive without third-party drivers.
Why D is wrong: ext4 is a capable Linux file system, but neither Windows nor macOS mounts it natively, so it fails the cross-platform requirement.
lock_openFree sampleOperating Systemsmedium
A small firm still runs a line-of-business workstation on an operating system that has reached end-of-life, so the vendor no longer ships security patches. The machine must stay connected to the internet for daily work. What is the BEST long-term action for the technician to recommend?
- AInstall a reputable third-party antivirus suite so the workstation is protected despite the missing vendor patches
- BUpgrade or replace the workstation with a currently supported operating system that continues to receive security updatescheck_circle Correct
- CDisconnect the workstation from the network and move the work to another machine whenever internet access is needed
- DEnable the built-in firewall and restrict inbound ports to reduce the machine's exposed attack surface
An end-of-life operating system stops receiving security updates, so migrating to a supported OS is the only durable fix for the exposure. End-of-life means the vendor issues no further patches, so newly discovered vulnerabilities are never closed. Antivirus, firewalls, and isolation are stopgaps that mitigate but do not remediate; only moving to a supported OS restores a live security-update stream, which is why it is the best long-term recommendation.
Why A is wrong: Antivirus adds a layer of defence and feels sufficient, but it cannot patch unfixed OS vulnerabilities, so the underlying exposure remains.
Why B is correct: An end-of-life OS receives no further security fixes, so migrating to a supported OS is the only action that restores an ongoing patch stream and removes the root risk.
Why C is wrong: Isolation reduces risk, but the stem states the machine must stay online for daily work, so permanent disconnection does not fit the requirement.
Why D is wrong: Tightening the firewall is sound hardening, but it only limits exposure and still leaves unpatched vulnerabilities that an attacker can reach through allowed traffic.
lock_openFree sampleOperating Systemsmedium
Marcus is speccing Windows 11 for a new employee whose laptop must join the company Active Directory domain and have its system drive encrypted with BitLocker. Which edition should he deploy to meet both requirements without add-ons?
- AWindows 11 Home, which covers everyday business tasks and can be joined to the domain after enabling it
- BWindows 11 Home with a Microsoft account, which provides device encryption equivalent to full BitLocker
- CWindows 11 Pro, which supports Active Directory domain join and includes BitLocker drive encryptioncheck_circle Correct
- DWindows 11 in S mode, which is hardened for security and therefore well suited to domain-joined laptops
Windows Pro and higher are required for Active Directory domain join and BitLocker, features the Home edition does not provide. Active Directory domain join and full BitLocker are business features that Microsoft gates behind the Pro edition and above. Home editions cannot join a domain and lack manageable BitLocker, so Pro is the lowest edition that meets both requirements natively.
Why A is wrong: Home looks adequate for general work, but it cannot join an Active Directory domain and lacks BitLocker, so it fails both stated needs.
Why B is wrong: Home offers a limited device-encryption feature that tempts as a substitute, but it is not manageable BitLocker and Home still cannot join a domain.
Why C is correct: Pro is the entry edition that includes both domain join and BitLocker, so it satisfies both requirements out of the box without any add-on.
Why D is wrong: S mode sounds security-focused, but it only runs Store apps and does not add domain join, so it does not meet the requirement.
Security (25% of the exam)
lock_openFree sampleSecuritymedium
Priya is redeploying a working laptop SSD to another employee. Company policy requires that the previous user's data be unrecoverable, but the drive itself must stay functional for reuse. Which method should she use?
- ADegauss the SSD using a magnetic degausser rated for the drive's capacity before reassigning it.
- BDelete the existing partitions and perform a quick format of the volume before handing it over.
- CShred the SSD in an approved media shredder and provision a brand-new drive instead.
- DRun the drive's built-in ATA Secure Erase so the flash cells are reset while the SSD stays usable.check_circle Correct
When media must be reused, choose a sanitisation method such as Secure Erase rather than a destructive method or a superficial format. Reuse rules out physical destruction, and SSDs are immune to degaussing because they use non-magnetic flash storage, so a controller-level Secure Erase is the correct sanitisation that preserves the drive.
Why A is wrong: Degaussing is tempting because it works on magnetic media, but an SSD stores data in flash cells that a magnetic field cannot erase, so the data survives.
Why B is wrong: A quick format only clears the file table, so the underlying data remains and is trivially recovered with forensic tools, failing the unrecoverable requirement.
Why C is wrong: Shredding does make data unrecoverable, but it destroys the drive and defeats the stated requirement to reuse the same SSD.
Why D is correct: Secure Erase issued to the SSD controller sanitises every cell, including spare blocks, and leaves a fully working drive that can be reissued.
lock_openFree sampleSecuritymedium
A mechanical hard drive holding sensitive client records has failed: it no longer spins up and the BIOS cannot detect it. The drive will be retired, and management wants the highest assurance the data cannot be recovered. What should the technician do?
- APhysically destroy the drive by shredding it or drilling through the platters so the media cannot be read.check_circle Correct
- BRun a multi-pass overwrite utility such as DBAN against the drive to sanitise every sector.
- CIssue the ATA Secure Erase firmware command to sanitise the drive before disposal.
- DDelete the volumes and quick-format the disk, then send it out for standard recycling.
For a failed or inaccessible drive requiring maximum assurance, physical destruction is the correct method because software sanitisation needs a working drive. Software wiping and firmware erase both require an accessible, responsive drive; a dead disk that will not spin up or be detected can only be guaranteed sanitised by physically destroying the platters.
Why A is correct: Physical destruction is the only method that works when the drive is inaccessible, and it gives the highest assurance because the platters can no longer be read by any tool.
Why B is wrong: Overwriting sounds thorough, but software wiping needs a drive the system can access, and this drive will not spin up or be detected, so the pass cannot run.
Why C is wrong: Secure Erase is a valid sanitisation command, but it requires the controller to respond, which is impossible on a drive the BIOS cannot even detect.
Why D is wrong: A quick format leaves data recoverable and, like the other software options, cannot be performed on a drive that will not power up or mount.
lock_openFree sampleSecuritymedium
A technician must sanitise a tray of solid-state drives so they can be reissued, and a colleague suggests running them through the department's magnetic degausser. What is the best approach and why?
- ADegauss each SSD with the department's degausser, which reliably erases any storage device it processes.
- BUse the manufacturer's secure-erase utility, which resets the flash cells while keeping each SSD usable.check_circle Correct
- COverwrite each SSD three times with zeros, since repeated passes guarantee every flash cell is cleared.
- DShred each SSD in an approved media destroyer to be certain the flash chips cannot be read.
SSDs are immune to degaussing; a controller secure erase or cryptographic erase is the correct reusable sanitisation method for flash media. Because SSDs store data in non-magnetic flash and remap blocks through wear-levelling, neither degaussing nor plain overwriting is reliable, so the vendor secure-erase command is the correct choice for reuse.
Why A is wrong: Degaussing is the classic trap here: it erases magnetic platters, but SSD data lives in flash cells that are unaffected by the magnetic field, so nothing is sanitised.
Why B is correct: A controller-level secure erase, sometimes implemented as a cryptographic erase, sanitises all flash on the SSD and leaves the drive fully functional for reuse.
Why C is wrong: Multi-pass overwrites are designed for magnetic disks; on SSDs wear-levelling remaps cells so overwrites may miss data, and the controller command is the reliable method.
Why D is wrong: Shredding does sanitise the flash, but it destroys the drives, and the requirement is to reissue them, so a non-destructive method is needed.
lock_openFree sampleSoftware Troubleshootingmedium
Priya updated a banking app on her Android phone and now it force-closes the instant she taps its icon, while every other app runs normally. She does not want to lose her saved logins or in-app data. Which action should the technician try FIRST?
- AClear the app's storage and data from Settings so the app starts from a completely fresh state on next launch.
- BUninstall the app and reinstall the current version from the official app store to replace any damaged program files.
- CForce stop the app, then clear only its cache from Settings, leaving saved data and logins intact before relaunching.check_circle Correct
- DPerform a factory reset of the phone to clear any system-wide corruption that may be affecting the application at launch.
When an app crashes after an update, clear its cache first because it is the least-destructive fix that preserves user data. An app update can leave incompatible cached temporary files that make the app fail at launch. Clearing the cache forces those files to be rebuilt while leaving accounts and saved data untouched, so it is the correct first step before the more destructive clear-data or reinstall options.
Why A is wrong: Clearing storage does often fix a corrupt-state crash, but it also wipes saved logins and in-app data, so it is not the first, least-destructive step when that data must be kept.
Why B is wrong: Reinstalling can resolve the crash, but it is more disruptive than clearing the cache and can remove locally stored data, so it is tried after the lighter step fails.
Why C is correct: Clearing the cache removes stale temporary files left by the update that commonly cause launch crashes, and it preserves accounts and saved data, so it is the correct least-destructive first step.
Why D is wrong: A factory reset is far too drastic for a single misbehaving app and erases all user data, so it is a last resort and never the first action here.
lock_openFree sampleSoftware Troubleshootingmedium
Marcus reports that his company iPhone, which used to last all day, now drains from full to empty by early afternoon after he installed several new apps. Battery health still reads 92 percent. What should the technician check FIRST to identify the cause?
- AEnable Low Power Mode so the phone throttles background activity, then ask Marcus whether the battery lasts longer over the next few days.
- BReplace the battery, because rapid drain from a phone that once lasted all day points to a worn cell that can no longer hold its rated charge.
- CPerform a factory reset and set the phone up as new to clear whatever background process is consuming the charge so quickly.
- DOpen the battery usage screen in Settings to see the per-app breakdown and find which newly installed app is consuming the most power.check_circle Correct
Diagnose sudden mobile battery drain by reading the per-app battery usage screen to identify the offending app before applying fixes. Battery drain that starts right after installing apps, with battery health still high, is almost always a misbehaving app running in the background. The per-app battery usage screen quantifies each app's consumption, letting the technician identify the culprit before choosing a targeted fix rather than guessing.
Why A is wrong: Low Power Mode can extend runtime, but applying a mitigation before finding the cause skips identifying which app is responsible, so it is not the correct first diagnostic step.
Why B is wrong: A worn battery does cause drain, but 92 percent battery health and the onset right after new installs point to software, so a hardware swap is premature.
Why C is wrong: A reset might stop the drain, but it is heavy-handed and destroys the evidence before the offending app is identified, so it is not the first step.
Why D is correct: The battery usage breakdown names the specific app draining the charge, and the drain began right after new installs, so checking it first correctly identifies the cause before any fix is applied.
lock_openFree sampleSoftware Troubleshootingmedium
Aisha's Android tablet has become completely unresponsive: the screen is on but frozen, and no taps or button presses register. It is not connected to a charger and shows no sign of physical damage. What is the BEST first action for the technician to take?
- APerform a soft reset by holding the power button, or the documented button combination, to force the frozen device to restart.check_circle Correct
- BPerform a factory reset from recovery mode to clear the system fault that has caused the tablet to stop responding to input.
- CConnect the tablet to a charger and wait, since a fully drained battery is the usual reason a screen freezes and stops responding.
- DBoot the tablet into safe mode to load only system apps and confirm whether a third-party app is causing the device to hang.
For a frozen, unresponsive mobile device, perform a soft reset first because it clears the hung state without losing any user data. A soft reset forces the operating system to restart, clearing the memory state that caused the freeze while leaving apps and data intact. Because it is non-destructive and resolves most one-off hangs, it is the correct first action before any reset, safe-mode, or hardware step.
Why A is correct: A soft reset (forced restart) clears the hung software state without erasing any user data, so it is the correct, least-destructive first action for a frozen but otherwise healthy device.
Why B is wrong: A factory reset can clear a persistent fault, but it wipes all user data and is far too drastic before a simple restart has even been tried, so it is not the first action.
Why C is wrong: A dead battery would leave the screen off, not frozen while lit, so charging does not address the hung state and wastes time before the correct restart.
Why D is wrong: Safe mode is a useful next step for a repeating freeze, but a device that is already frozen must be force-restarted before it can boot into any mode, so this cannot come first.
lock_openFree sampleOperational Procedureseasy
A user phones the service desk because a shared office printer keeps jamming. So the ticket can be tracked and reassigned to another technician if needed, which detail is most important to capture when first logging the ticket?
- AThe technician's own mobile number so the user can bypass the queue and call back directly later
- BThe affected user's name and contact details together with a clear description of the reported problemcheck_circle Correct
- CA guess at the most likely root cause, entered before any diagnosis has actually been carried out
- DThe final resolution steps, which the technician writes in full before starting any troubleshooting
A ticket must first capture who is affected and a clear problem description so any technician can track, contact, and resolve it. A ticketing system tracks work through its lifecycle; without the requester's identity and a clear symptom description, the ticket cannot be triaged, reassigned, or matched to the caller, which is exactly what tracking depends on.
Why A is wrong: It feels helpful and personal, but routing calls around the ticketing system leaves the issue untracked and impossible to reassign.
Why B is correct: Correct: identifying the user and the symptom is the core of a ticket, letting any technician pick it up, contact the user, and track it to closure.
Why C is wrong: Recording a theory looks proactive, but an unverified guess logged as fact can mislead the next technician and is not the priority at intake.
Why D is wrong: Resolution notes matter, but they cannot be known at logging time; writing them before diagnosis records a fix that has not happened.
lock_openFree sampleOperational Procedureseasy
An IT department takes delivery of 20 new laptops that will be issued to staff over the coming weeks. Following asset management best practice, what should a technician do before handing any of them out?
- AStore them in a locked cupboard and issue them out without recording any of the serial numbers
- BAdd the purchase price of each laptop to the ticketing system so the help desk can view it
- CRecord each device in the asset inventory with a unique asset tag and its assigned usercheck_circle Correct
- DEmail the warranty paperwork to each user and then delete the local copies that IT holds
Asset management means recording every device in an inventory with a unique asset tag and assigned owner before it is deployed. Asset management tracks hardware across its lifecycle. Assigning a unique asset tag and logging the owner in an inventory database is what lets IT audit, locate, and account for each device, which cannot be done after untagged units leave the store room.
Why A is wrong: Physical security is sensible, but issuing hardware with no recorded serials means the organisation cannot track, audit, or recover the devices.
Why B is wrong: Cost data has its place, but the ticketing system tracks support requests, not hardware inventory, so this is the wrong system for the record.
Why C is correct: Correct: tagging and inventorying each unit with its owner is the core of asset management, giving IT lifecycle tracking, accountability, and audit records.
Why D is wrong: Users may want warranty details, but deleting IT's own records destroys the documentation asset management is meant to preserve centrally.
lock_openFree sampleOperational Procedureseasy
After resolving a recurring VPN connection error, a technician wants other staff to be able to fix the same issue themselves next time without opening a ticket. Which documentation system is the best place to record the fix?
- AThe acceptable use policy, so that all staff formally agree to follow the corrective steps
- BA personal notes file kept on the technician's own laptop purely for quick reference later
- CThe asset management record attached to the one specific device that was affected first
- DThe knowledge base, as a searchable article describing the symptom and the resolutioncheck_circle Correct
A knowledge base holds searchable, reusable articles so known fixes can be found and applied without raising a fresh ticket. The purpose of a knowledge base is to capture repeatable solutions in a searchable, shared form. Documenting the symptom and fix there lets others resolve the same issue independently, which is exactly the self-service outcome the technician wants.
Why A is wrong: An AUP defines what users are permitted to do; it is not where troubleshooting steps belong, so staff would not find a fix there.
Why B is wrong: Private notes help that one technician, but nobody else can search or reach them, so the fix is not shared with the wider team.
Why C is wrong: Asset records track hardware details, not reusable how-to guidance, and tying a general fix to one device hides it from everyone else.
Why D is correct: Correct: a knowledge base stores searchable, reusable articles so staff and technicians can self-serve a known fix instead of raising a ticket.
Examworthy is not affiliated with or endorsed by CompTIA. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. 220-1102 and related marks belong to their respective owners.
