CompTIA A+ Core 2 220-1202 (220-1202) — Questions 1–75

The tasklist command displays a list of running processes along with memory usage (in kilobytes) directly from the command prompt. It is a built-in Windows tool, so no extra software is needed. Other options either do not show process details or require additional tools.

WPA3-SAE is the strongest available wireless security protocol, providing forward secrecy and stronger authentication than WPA2. It is the correct choice for maximum security.

The correct answer is Finder Preferences because sidebar visibility of folders is controlled there, not in System Settings or via Spotlight. This question tests knowledge of basic macOS UI customization, a common support task.

Mobile Device Management (MDM) solutions allow administrators to push configuration profiles and restrictions, such as Wi-Fi settings and camera disablement. This is the standard enterprise tool for managing multiple devices centrally.

Cable locks are a simple and effective physical security control to prevent laptop theft by securing the device to a desk or fixed object. This scenario tests the understanding of basic physical deterrents against opportunistic theft in an office environment.

The Programs and Features applet provides access to the 'Change' option for installed programs, which includes compatibility settings. The 'Run this program as an administrator' option is found in the Compatibility tab of the program's properties, accessible from Programs and Features or directly from the shortcut.

Option C is correct because recent Windows updates have tightened security around legacy scripting hosts, including cscript.exe and wscript.exe. Specifically, Microsoft has introduced a default behavior that blocks VBScript execution via the Windows Script Host unless explicitly allowed by Group Policy or registry settings. Since the user reports that only the VBScript logon script fails while other scripts work, the most likely cause is that the update disabled VBScript execution, not that the script was deleted or that the script host was changed to PowerShell.

Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

The 'net user' command lists all local user accounts on a Windows system, which is necessary to identify hidden or unauthorized accounts. Piping 'net user Administrator' through 'findstr /i active' filters the output to show whether the built-in Administrator account is enabled or disabled, as the status line contains 'Active' or 'Account active' depending on the locale. This combination directly fulfills the requirement to list all accounts and check the Administrator account's status from the command line.

Controlled Folder Access is a feature of Windows Defender Exploit Guard, found in the Windows Security app under Virus & threat protection > Manage ransomware protection. It must be enabled and configured with protected folders and allowed apps.

WPA2-Enterprise uses RADIUS for authentication. A common issue is that the laptop's certificate for the corporate network has expired or is not trusted by the specific RADIUS server. Guest networks often use simpler authentication like PSK, which bypasses certificate requirements.

The Task Manager's Startup tab is the correct modern tool to enable or disable startup programs. It shows the impact of each program and allows changes that take effect after a reboot, without needing to uninstall anything.

Option B is correct because OAuth tokens or app-specific passwords bypass the need for the primary password, allowing persistent access even after a password change. Since the user's iPhone shows no suspicious apps and the password was recently changed, a stolen token is the most plausible vector for unauthorized email access via Exchange ActiveSync or modern authentication.

Ransomware often enters via email attachments or malicious downloads. User education on safe browsing and email practices is critical to prevention. This tests understanding of the human factor in security and the limitations of technical controls alone.

The `winreg` module is the standard Python library for accessing the Windows registry. `OpenKey` opens a specified registry key, and `QueryValueEx` retrieves the value data and type for a given value name. This allows the script to check for the software's registry key and conditionally skip installation if it exists.

This is a classic baiting attack using physical media. The attacker left a USB drive with an enticing label (bait) in a location where an employee would find it, hoping they would plug it in and execute malware.

A hybrid cloud combines private and public cloud resources, allowing sensitive or frequently accessed data to remain on-premises (private cloud) while using public cloud for scalability and backup. This reduces latency for local users and minimizes egress fees for large data transfers. Public cloud alone would introduce latency and egress costs; community cloud is for shared organizations; private cloud alone doesn't leverage cloud scalability.

Event Viewer (C) is the correct tool because it logs detailed error messages from the print spooler service (spoolsv.exe) under 'Windows Logs > System' or 'Applications and Services Logs > Microsoft > Windows > PrintService'. When a Windows update breaks printing for a single user, Event Viewer captures spooler errors such as access denied, driver conflicts, or RPC failures that are not shown in other tools.

Option C is correct because ransomware encrypts files with a key known only to the attacker, making decryption without the key impossible. Disconnecting from the network prevents the ransomware from spreading to other systems, and restoring from a verified backup is the only reliable way to recover the original files without paying the ransom.

Option C is correct because lithium-ion batteries, even if not visibly swollen, degrade over time and can still pose a fire or chemical hazard if improperly disposed. The proper procedure is to safely discharge the battery using a certified load to remove residual energy, then recycle it through a certified lithium battery recycler to comply with environmental regulations and safety standards.

This question tests knowledge of Windows Defender Application Guard and Windows Sandbox features. The message indicates that Application Guard is blocking the app from accessing certain resources. Application Guard uses hardware isolation to run untrusted applications in a container, and updates may change its default behavior or policies.

This question tests the ability to correlate documented changes with incidents. The best action is to update the documentation to reflect the impact and then work with the change advisory board to reschedule the backup or mitigate the outage.

WPA2-PSK with a 64-character key is extremely long and easy to mistype. The smartphone likely has an incorrect password stored, so it authenticates to the router but fails to get an IP address because the router rejects the mismatched key during the 4-way handshake.

This question tests knowledge of Windows Defender Application Control (WDAC) and AppLocker. WDAC is a more modern and secure solution that can enforce code integrity policies based on publisher signatures, while AppLocker is a legacy feature. WDAC can be configured to allow only signed apps from trusted publishers, providing strong application control.

Audit Account Management policy must be enabled to log events like user account creation. This is configured in Local Security Policy or Group Policy under Advanced Audit Policy Configuration. Without this audit setting, account creation events are not recorded in the Security log.

CRT monitors contain hazardous materials such as lead, phosphor, and other heavy metals that are harmful to the environment if disposed of in landfills. Certified e-waste recycling centers follow strict environmental regulations to safely dismantle and recycle these components, preventing toxic substances from contaminating soil and groundwater.

For large-scale on-site destruction, a hard drive shredder can physically destroy both HDDs and SSDs quickly and efficiently. Degaussing works for HDDs but not SSDs, and it does not physically destroy the drives. Overwriting is too time-consuming for 1200 drives.

Assigned Access (formerly Kiosk Mode) in Windows 10/11 allows a device to run a single app in full-screen, locking down the system. It can be configured via Settings > Accounts > Other users > Set up a kiosk. This ensures users cannot exit the app or access other parts of the OS.

Windows 10 includes compatibility modes that emulate older versions of Windows. Running the installer in compatibility mode for Windows 7 can often resolve version-check errors, as it tricks the application into thinking it is running on a compatible OS.

Proper disposal procedures, such as degaussing or physical destruction, ensure that data on decommissioned drives cannot be recovered. This scenario tests understanding of the full lifecycle of physical media security.

Option B is correct because the change management process requires that any issues discovered during pilot testing be formally documented and addressed before full deployment. Since the application conflicts with the VPN client, the technician must submit a revised change request that includes a resolution plan (e.g., updating the application, modifying VPN configuration, or scheduling a coordinated deployment). This ensures compliance with organizational change control policies and minimizes risk to production systems.

Error code 0xc000007b is a STATUS_INVALID_IMAGE_FORMAT error, typically indicating a mismatch between 32-bit and 64-bit binaries. The most common cause is a missing or corrupted Visual C++ Redistributable package, which provides essential runtime libraries (e.g., MSVCR120.dll) that the application depends on. Without these libraries, the application cannot load correctly, even if the Windows version matches.

This question tests the process of installing an OS on a VM. The correct method is to mount the ISO file as a virtual optical drive and boot from it. Copying the ISO to the virtual disk or using a USB drive would not work directly, and the hypervisor's default settings are not relevant to OS compatibility.

The 'ActiveX component can't create object' error occurs when the VBScript's CreateObject call fails because the COM class it references is not available. This typically means the DLL that implements the COM object is not registered (e.g., via regsvr32) or the application that provides the object is not installed on the system. Without the registered COM component, the script cannot instantiate the object, leading to this specific runtime error.

A strong sulfur smell and warm casing from a UPS battery indicate thermal runaway, a condition where internal chemical reactions generate excessive heat, potentially leading to fire or explosion. The immediate priority is to disconnect the UPS from mains power to stop charging and remove it to a safe, well-ventilated outdoor area to mitigate the risk of toxic gas release or catastrophic failure.

SSDs require special handling because their wear-leveling and TRIM features can make traditional overwriting unreliable. A secure erase command (ATA Secure Erase) is designed for SSDs to reset all cells to an unallocated state.

This question tests iOS update management. The correct answer is 'Software Update' in Settings > General, which allows the user to upgrade to iOS 16. The error indicates the app requires a newer OS version, and updating the OS is the standard solution.

This tests understanding of file permissions and groups. By adding 'appuser' to the file's group and granting group write permission, the user can edit without being owner.

Local Security Policy (secpol.msc) allows configuring password policies like minimum length and complexity for local accounts. This is applied via Account Policies > Password Policy. It ensures that any new password meets the requirements.

iCloud Drive with 'Optimize Mac Storage' automatically moves rarely used files to iCloud and keeps recent files locally. This is the correct feature for automatic space management. Manual archiving or external drives require user action, and Time Machine is for backups only.

Option C is correct because it demonstrates the professional communication and empathy required in a support role. The technician remains calm, acknowledges the user's frustration, and immediately provides a technical solution—recovering the file from the Recycle Bin or a backup. This aligns with CompTIA's emphasis on active listening, de-escalation, and problem-solving without dismissing the user's concerns.

This is a vishing (voice phishing) attack, a social engineering technique where the attacker uses phone calls to trick victims into providing sensitive information or remote access. Legitimate companies like Microsoft do not make unsolicited support calls.

Option B is correct because the first step in handling a potential malware infection professionally is to gather information from the user without judgment. Asking the user to describe what they installed and from where helps the technician understand the attack vector (e.g., a fake pop-up ad), which is critical for selecting the appropriate remediation steps and for any future security awareness training. This approach maintains trust and encourages the user to report issues promptly, which is essential for effective incident response.

Authentication factors are categorized as something you know (password), something you have (token or phone), and something you are (biometrics). A one-time code sent to a mobile phone is considered 'something you have' because access to the phone is required. This question tests the classification of multi-factor authentication components.

Changing network settings requires admin privileges by default for security. The correct approach is to grant the user admin rights, which eliminates the prompt but also gives full system access. Other options either don't work or compromise security.

File and Printer Sharing (option B) is the correct feature because it enables the Server Message Block (SMB) protocol on the workstation, which is the underlying protocol Windows uses for shared folder access. Without this service running and allowed through the firewall, other devices cannot connect to the workstation's shared resources, regardless of network discovery or firewall settings.

Creating a system restore point before modifying the registry is the correct safety procedure because it captures the current system state, including registry keys, drivers, and system files. If the registry edit causes instability or boot failure, the restore point allows the technician to revert the system to its previous working configuration without data loss. This is a standard best practice for any registry modification, as even minor errors can render the system unbootable.

This scenario exploits the principle of authority, as the attacker impersonates a trusted IT department figure. Social engineers often use authority to bypass security protocols by making victims feel compelled to comply. The correct response is to never share credentials, regardless of who asks.

Network segmentation, often achieved through VLANs, separates network traffic into distinct broadcast domains. A guest VLAN can be configured with access only to the internet, while internal resources remain on a separate VLAN with restricted access. This question tests the understanding of network segmentation as a logical security control.

This question tests knowledge of virtualization types and their capabilities. Type 1 hypervisors run directly on hardware and provide strong isolation, but they lack direct USB passthrough in many configurations. Type 2 hypervisors, like VMware Workstation or VirtualBox, run on top of an OS and commonly support USB passthrough, making them suitable for this scenario.

The System File Checker (sfc /scannow) scans protected system files and replaces corrupted ones with cached copies. If the application relies on system files, sfc can fix the issue. DISM repairs the system image itself, chkdsk checks disk errors, and tasklist lists processes.

Option A is correct because it directly addresses the root cause (DHCP lease renewal changing the printer's IP) and provides a clear, non-technical explanation to the user while outlining the solution (assigning a static IP). This demonstrates effective communication and professionalism by taking ownership of the issue and preventing recurrence, aligning with CompTIA's troubleshooting methodology.

Option B is correct because the first step in diagnosing rapid battery drain after an app update is to use the built-in battery usage tool in Android Settings. This tool provides a per-app breakdown of power consumption, allowing the technician to identify which specific app is consuming excessive energy without making invasive changes. Restarting the device already failed to resolve the issue, so checking battery stats is the logical next step before any destructive or restrictive actions.

Android's Screen Pinning feature allows you to lock the device to a single app, requiring a PIN or password to exit. This is ideal for kiosk-style deployments. Guest Mode and Multi-User Mode do not restrict app access, and Factory Reset Protection is a security feature for lost devices.

A black screen with a cursor after login often indicates that the Windows Explorer shell (explorer.exe) has crashed or is not starting properly. Using Task Manager to manually restart the explorer.exe process is a quick and non-destructive first step that often resolves the issue without rebooting.

The correct first action is to disconnect the PC from the network (Option C). This immediately isolates the infected system, preventing the ransomware from communicating with its command-and-control (C2) server to exfiltrate data or encrypt additional network shares. It also stops the ransomware from spreading laterally to other devices on the same LAN, which is critical for containment before any remediation steps are taken.

The immediate priority is to disconnect the computer from the network to stop the botnet communication and prevent further spam. Then, the technician should identify and terminate the malicious process. Scanning without disconnecting may allow continued data exfiltration.

Android's Screen Pinning allows locking the device to a single app, requiring a PIN to exit. This is ideal for kiosk scenarios. Other options like Guest Mode or Safe Mode do not provide the same level of restriction.

The correct answer is A because chmod 644 /etc/passwd sets the permissions to rw-r--r--, which is the standard for /etc/passwd. This removes the world-writable and executable bits.

The Settings app (or Control Panel > Network and Sharing Center) is the correct place to configure VPN connections in Windows 11. The other tools are not used for VPN setup.

Windows Defender Antivirus can be configured to scan removable drives upon insertion via Group Policy or the Windows Security app. This ensures automatic malware scanning without user intervention.

Option C is correct because the error 'Windows cannot verify the publisher of this driver software' indicates that the driver lacks a valid digital signature, which is required by default on 64-bit Windows 10. The Advanced Startup Options menu provides a direct way to boot with 'Disable driver signature enforcement' temporarily, allowing the unsigned driver to load for the current session without permanently altering the system's security policy.

Exposing RDP directly to the internet is risky due to brute-force attacks. A VPN creates an encrypted tunnel, authenticating the user before allowing access to the internal network, making it far more secure. This is the recommended best practice.

Android includes a hidden 'Diagnostics' or 'Hardware Test' mode (often accessed via a code like *#0*# on Samsung devices) that allows you to test individual hardware components including the touchscreen, display colors, and sensors. The Developer Options 'Show taps' only visualizes touches but does not run a systematic test. Safe Mode only disables third-party apps, and a factory reset is too drastic.

Task Scheduler (taskschd.msc) is the tool for viewing, creating, and disabling scheduled tasks. Malware often uses scheduled tasks for persistence. The other tools do not manage scheduled tasks.

This question tests understanding of jailbreaking risks. The correct answer is that jailbreaking removes sandbox restrictions, allowing apps to access data from other apps, which can lead to data leakage. This is a primary concern for corporate devices handling sensitive information.

Holding Command (⌘) and R during startup boots the Mac into macOS Recovery, which provides access to Disk Utility, Terminal, and the ability to reinstall macOS. From there, you can run First Aid on the startup disk. Option (⌥) boots into Startup Manager, and Shift boots into Safe Mode.

The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Attempting to decrypt without tools or paying the ransom are not recommended initial actions.

A full overwrite using disk-wiping software destroys data while leaving the drive functional for reuse. Degaussing destroys data but renders the drive unusable. Physical destruction also prevents reuse.

Content Security Policy (CSP) is a browser security mechanism that can block malicious scripts, reducing XSS impact. This tests advanced knowledge of browser security features. Other options are either unrelated or less effective against XSS.

The most reliable method is to verify the email's authenticity by checking the full email header and sender domain. Hovering over the link to see the actual URL can also reveal a phishing site, but checking the header confirms the source.