CompTIA A+ Core 2 220-1202 practice test

During a Windows 10 deployment, you need to ensure that a specific Group Policy setting is applied to a computer before any user logs on. Which policy processing mode should you configure?

Trap 1: Loopback processing mode

Loopback processing is used to apply user policies based on the computer's location (e.g., in a specific OU), but it does not change the timing of policy application; it still requires a user logon.

Trap 2: User Configuration

User Configuration policies apply only when a user logs on, so they would not be in effect before the first user logs in.

Trap 3: Administrative Templates

Administrative Templates are a type of policy setting, not a processing mode. They can exist under both Computer and User Configuration.

A
Loopback processing mode
Why wrong: Loopback processing is used to apply user policies based on the computer's location (e.g., in a specific OU), but it does not change the timing of policy application; it still requires a user logon.
B
Computer Configuration
Policies under Computer Configuration are applied during system startup, before any user logs in. This ensures the setting is in effect for all users and at the login screen.
C
User Configuration
Why wrong: User Configuration policies apply only when a user logs on, so they would not be in effect before the first user logs in.
D
Administrative Templates
Why wrong: Administrative Templates are a type of policy setting, not a processing mode. They can exist under both Computer and User Configuration.

Question 2easymultiple choice

After installing a new printer driver, a user's Windows 11 computer crashes with a blue screen error every time they try to print. The computer works fine otherwise. Which boot option should be used to restore functionality without affecting user data?

Trap 1: Use Last Known Good Configuration to revert driver changes.

Last Known Good Configuration is available only for registry and driver changes that prevented boot, but it may not be effective if the system boots but crashes later.

Trap 2: Run System Restore from the recovery environment.

System Restore could work, but Safe Mode is quicker and more targeted for driver issues.

Trap 3: Perform a clean installation of Windows 11.

Clean installation is excessive and destructive; it should only be used when other recovery options fail.

A
Boot into Safe Mode and uninstall the printer driver.
Safe Mode loads minimal drivers, allowing the technician to remove the faulty driver without the crash occurring.
B
Use Last Known Good Configuration to revert driver changes.
Why wrong: Last Known Good Configuration is available only for registry and driver changes that prevented boot, but it may not be effective if the system boots but crashes later.
C
Run System Restore from the recovery environment.
Why wrong: System Restore could work, but Safe Mode is quicker and more targeted for driver issues.
D
Perform a clean installation of Windows 11.
Why wrong: Clean installation is excessive and destructive; it should only be used when other recovery options fail.

Question 3mediummultiple choice

A user reports that their Windows 10 computer is infected with a virus that keeps reinstalling itself after removal. What should you do to remediate this persistent infection?

Trap 1: Run a system restore to a previous restore point

System Restore may not remove all components, and the virus could persist in restore points or system files.

Trap 2: Disable System Restore and then run an antivirus scan in normal mode

While disabling System Restore helps, scanning in normal mode may still allow the virus to hide or reinfect.

Trap 3: Reinstall Windows from the recovery partition

Reinstalling is a last resort; booting from rescue media is less disruptive and often effective.

A
Run a system restore to a previous restore point
Why wrong: System Restore may not remove all components, and the virus could persist in restore points or system files.
B
Boot from a rescue disc or USB and run an antivirus scan
Booting from trusted media bypasses the infected OS, enabling thorough removal without the virus interfering.
C
Disable System Restore and then run an antivirus scan in normal mode
Why wrong: While disabling System Restore helps, scanning in normal mode may still allow the virus to hide or reinfect.
D
Reinstall Windows from the recovery partition
Why wrong: Reinstalling is a last resort; booting from rescue media is less disruptive and often effective.

Question 4easymultiple choice

A customer reports that their Windows 10 laptop is displaying pop-up ads even when no browser is open. They suspect a malware infection. Which of the following should you do first to remediate this issue?

Trap 1: Run a full antivirus scan while the system is connected to the…

Running a scan while connected may allow malware to communicate with its source, potentially downloading more payloads or evading detection.

Trap 2: Perform a System Restore to a point before the pop-ups started.

System Restore may not remove all malware, especially if it has infected system restore points or persists in user data.

Trap 3: Immediately reinstall Windows 10 to ensure complete removal.

Reinstalling is a last resort after less drastic remediation steps have failed or if the infection is severe; it is not the first step.

A
Run a full antivirus scan while the system is connected to the internet.
Why wrong: Running a scan while connected may allow malware to communicate with its source, potentially downloading more payloads or evading detection.
B
Disconnect the network cable, boot into Safe Mode, then run a full antivirus scan.
This is the correct sequence: disconnecting the network stops remote communication, Safe Mode limits malware activity, and scanning identifies and removes the threat.
C
Perform a System Restore to a point before the pop-ups started.
Why wrong: System Restore may not remove all malware, especially if it has infected system restore points or persists in user data.
D
Immediately reinstall Windows 10 to ensure complete removal.
Why wrong: Reinstalling is a last resort after less drastic remediation steps have failed or if the infection is severe; it is not the first step.

Question 5mediummultiple choice

A technician is configuring a new Windows 10 workstation for a user who handles sensitive financial data. The company policy mandates that the screen lock after 5 minutes of inactivity and require a password on wake. Which settings should the technician configure?

Trap 1: Set the power plan to turn off the display after 5 minutes.

Turning off the display does not lock the workstation; the user can wake it without authentication unless a password on wake is also set in power options.

Trap 2: Enable the 'Require password on wakeup' setting in the power plan…

This requires a password when waking from sleep, but it does not automatically lock the workstation after 5 minutes of inactivity if the screen saver is not set.

Trap 3: Set the computer to sleep after 5 minutes and require a password on…

Sleep mode may take longer to resume and could interfere with background tasks; the policy specifies screen lock, not sleep.

A
Set the power plan to turn off the display after 5 minutes.
Why wrong: Turning off the display does not lock the workstation; the user can wake it without authentication unless a password on wake is also set in power options.
B
Configure the screen saver to start after 5 minutes and check 'On resume, display logon screen.'
This combination locks the workstation after 5 minutes of inactivity and requires the user to log in again, meeting the policy.
C
Enable the 'Require password on wakeup' setting in the power plan only.
Why wrong: This requires a password when waking from sleep, but it does not automatically lock the workstation after 5 minutes of inactivity if the screen saver is not set.
D
Set the computer to sleep after 5 minutes and require a password on wake.
Why wrong: Sleep mode may take longer to resume and could interfere with background tasks; the policy specifies screen lock, not sleep.

Question 6hardmultiple choice

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

Trap 1: Reset the account password and enable MFA.

While these are important, the first step must be to disable the account to stop ongoing unauthorized access immediately.

Trap 2: Review the server logs to determine the extent of the breach.

Log review is important for investigation, but containment (disabling the account) should come first to prevent further damage.

Trap 3: Notify the employee's manager and HR department.

Notification is part of the incident response process, but the immediate technical step is to disable the compromised account.

A
Reset the account password and enable MFA.
Why wrong: While these are important, the first step must be to disable the account to stop ongoing unauthorized access immediately.
B
Disable the account to prevent further access.
Disabling the account is the first containment step; it stops the attacker from using the credentials while the investigation and remediation proceed.
C
Review the server logs to determine the extent of the breach.
Why wrong: Log review is important for investigation, but containment (disabling the account) should come first to prevent further damage.
D
Notify the employee's manager and HR department.
Why wrong: Notification is part of the incident response process, but the immediate technical step is to disable the compromised account.