hardMultiple Choice
220-1202 Practice Question: That their Windows 10 PC is infected with malware…
A user reports that their Windows 10 PC is infected with malware that keeps reinstalling after removal. You need to boot into a minimal environment to run antivirus scans without malware interference. Which advanced startup option should you use?
⚠ Common exam trap
CompTIA A+ candidates often mistakenly think that Last Known Good Configuration (C) can remove malware, but it only reverts driver/registry changes and does not clean infections that persist across boots. Safe Mode is the correct choice for malware removal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Mode
Safe Mode (B) loads Windows with a minimal set of drivers and services, preventing malware that runs as a startup program or service from loading. This allows antivirus software to scan and remove the infection without interference, addressing the scenario where malware reinstalls after removal in a normal boot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Boot Logging
Why it's wrong here
Boot Logging records loaded drivers to ntbtlog.txt during a normal startup; it neither disables third-party services nor prevents malware from loading. It is tempting because it is an advanced startup diagnostic, and would be correct when identifying which driver fails to load during a boot problem.
- ✓
Safe Mode
Why this is correct
Safe Mode loads only core drivers and services, preventing malware configured as a startup service or driver from launching. This gives a minimal environment where antivirus scans can run without the infection reinstalling itself during normal boot.
- ✗
Last Known Good Configuration
Why it's wrong here
Last Known Good Configuration restores the previous driver and registry settings from a successful logon; it does not create a minimal environment and leaves installed malware intact. It is tempting because it is a recovery option, and would be correct after a faulty driver or configuration change causes startup failure.
- ✗
Debugging Mode
Why it's wrong here
Debugging Mode loads kernel debugging support and passes control to a host debugger over a serial or network connection; it does not strip third-party drivers and services to a minimal set. It is tempting because it is an advanced boot option, and would be correct when kernel-level troubleshooting with WinDbg is required.
Go deeper
Related to this question
About these practice questions
This 220-1202 question is part of Courseiva's 687-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.