Courseiva

CompTIA A+ Core 2 220-1202 (220-1202) — Questions 1–75

495 questions total · 7pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 7

Page 2
1
MCQeasy

A user reports that their Windows 10 PC is running slowly and they suspect a background process is consuming too much memory. You need to identify the process and its memory usage without installing any additional tools. Which command-line tool should you use?

A.ipconfig
B.tasklist
C.chkdsk
D.sfc /scannow
AnswerB

The `tasklist` command-line utility is the correct tool because it provides a detailed list of all running processes on a local or remote Windows system, including their Process ID (PID), session name, and crucial memory usage statistics. This utility is highly effective for identifying which applications or background services are consuming excessive RAM or other resources, directly contributing to a slow or unresponsive PC. By analyzing its output, a technician can quickly pinpoint resource-intensive tasks that may need to be terminated or investigated further.

Why this answer

B is correct because the `tasklist` command displays a list of all currently running processes on a Windows system, including their memory usage (in kilobytes) under the 'Mem Usage' column. This built-in command-line tool allows you to identify which process is consuming excessive memory without installing any third-party software, directly addressing the user's need to diagnose a slow PC.

Exam trap

The trap here is that candidates may confuse `tasklist` with `ipconfig` or `sfc` because they are all common Windows command-line tools, but only `tasklist` is designed to display process information and memory usage.

How to eliminate wrong answers

Option A is wrong because `ipconfig` is used to display network configuration details (e.g., IP address, subnet mask, default gateway) and has no capability to list running processes or their memory usage. Option C is wrong because `chkdsk` checks the file system and disk for errors and bad sectors, but it does not provide any information about running processes or memory consumption. Option D is wrong because `sfc /scannow` scans and repairs protected system files, but it does not list processes or report memory usage.

Full explanation →
2
MCQeasy

A user calls the help desk saying that after upgrading to macOS Ventura, the 'Documents' folder in the sidebar keeps disappearing after every reboot. They need it to stay visible. Which macOS feature or tool should you use to fix this?

A.System Settings > Desktop & Dock
B.Finder > Preferences > Sidebar
C.Terminal command 'defaults write com.apple.finder ShowSidebar -bool true'
D.Spotlight Preferences
AnswerB

Within Finder, accessing its Preferences and navigating to the "Sidebar" tab presents a comprehensive list of categories and locations, such as Favorites, iCloud, Locations, and Tags. Users can precisely select which specific folders, devices, or network shares appear in the Finder's sidebar by checking or unchecking the corresponding boxes. This direct graphical interface is the intended and most straightforward method for enabling or disabling the visibility of individual items for quick access.

Why this answer

The visibility of folders like 'Documents' in the Finder sidebar is controlled directly through Finder's own preferences, not through global system settings. By opening Finder > Preferences > Sidebar, you can check the 'Documents' checkbox, which persists the folder's visibility across reboots. This setting is stored per-user in the Finder plist and is not affected by macOS upgrades.

Exam trap

The trap here is that candidates confuse the global 'Show Sidebar' toggle (which hides the entire sidebar) with the per-item visibility settings in Finder's preferences, leading them to choose the Terminal command or System Settings instead of the correct Finder-specific interface.

How to eliminate wrong answers

Option A is wrong because System Settings > Desktop & Dock controls the Dock, Stage Manager, and desktop appearance, but does not include any options for customizing the Finder sidebar. Option C is wrong because the command 'defaults write com.apple.finder ShowSidebar -bool true' only toggles the entire sidebar's visibility (show/hide), not the individual items within it; the specific folder visibility is controlled by a different key (e.g., 'SidebarDevicesSectionDisclosedState'). Option D is wrong because Spotlight Preferences manage search indexing and results, not the persistent visibility of folders in the Finder sidebar.

Full explanation →
3
MCQmedium

During a software deployment, a technician needs to ensure that a company-issued Android device automatically connects to the corporate Wi-Fi network and disables the camera for security. Which mobile OS tool should be used to enforce these policies?

A.Use the Android Debug Bridge (ADB) to manually set Wi-Fi and camera permissions
B.Configure the device's built-in Guest Mode
C.Deploy a Mobile Device Management (MDM) profile
D.Install a third-party camera-blocking app from the Play Store
AnswerC

Deploying a Mobile Device Management (MDM) profile is the most effective and scalable solution for enforcing specific device configurations and security policies across an enterprise fleet. MDM allows administrators to centrally define and push profiles that automatically configure Wi-Fi networks, disable device cameras, and apply other security restrictions to numerous devices simultaneously. This ensures consistent policy adherence, simplifies mass deployment, and provides ongoing remote management capabilities for compliance and security.

Why this answer

Mobile Device Management (MDM) solutions allow administrators to push configuration profiles and restrictions, such as Wi-Fi settings and camera disablement. This is the standard enterprise tool for managing multiple devices centrally.

Full explanation →
4
MCQeasy

A customer reports that their laptop was stolen from their desk over the weekend. The laptop contained sensitive client data. Which physical security control should have been implemented to prevent this theft?

A.Biometric authentication
B.Cable lock
C.Full disk encryption
D.Smart card reader
AnswerB

A cable lock is a physical security device specifically designed to deter and prevent the physical theft of a laptop. It utilizes a hardened steel cable that attaches to a security slot (e.g., Kensington lock slot) on the laptop and then anchors to a stationary object like a desk or table. This creates a tangible barrier, making it significantly more difficult and time-consuming for an opportunistic thief to steal the device, directly addressing the concern of physical asset protection.

Why this answer

A cable lock is a physical security control that physically secures the laptop to a desk or immovable object, preventing unauthorized removal. In this scenario, the laptop was stolen from the desk, so a cable lock would have directly prevented the theft by tethering the device in place.

Exam trap

CompTIA often tests the distinction between physical security controls that prevent theft (like cable locks) versus controls that protect data after theft (like encryption), leading candidates to confuse data protection with physical prevention.

How to eliminate wrong answers

Option A is wrong because biometric authentication (e.g., fingerprint or facial recognition) is an access control mechanism that verifies identity, but it does not physically prevent the laptop from being taken. Option C is wrong because full disk encryption protects data confidentiality if the laptop is stolen, but it does not prevent the theft itself. Option D is wrong because a smart card reader is an authentication device that requires a smart card for access, but it does not physically secure the laptop to a location.

Full explanation →
5
MCQmedium

A user reports that a VBScript logon script that maps network drives stopped working after a Windows update. The script uses the MapNetworkDrive method. Other scripts on the same computer work fine. What is the most likely cause?

A.The script file was deleted by Windows Defender.
B.The update changed the default script host to PowerShell.
C.The update disabled VBScript execution for security reasons.
D.The network share requires SMB 2.0, which is no longer supported.
AnswerC

Microsoft has progressively implemented stricter security measures, which include restricting or disabling VBScript execution in various contexts due to its historical use as an attack vector. Recent Windows updates can introduce or enforce Group Policy settings or registry changes that specifically disable VBScript execution, particularly for scripts originating from less trusted zones or those not explicitly signed. This security hardening aims to reduce the attack surface, preventing older, less secure scripting technologies from being exploited.

Why this answer

Recent Windows updates have tightened security around legacy scripting hosts, including cscript.exe and wscript.exe. Specifically, Microsoft has introduced a default behavior that blocks VBScript execution via the Windows Script Host unless explicitly allowed by Group Policy or registry settings. Since the user reports that only the VBScript logon script fails while other scripts work, the most likely cause is that the update disabled VBScript execution, not that the script was deleted or that the script host was changed to PowerShell.

Exam trap

The trap here is that candidates may assume a network or SMB protocol issue (Option D) because the script maps network drives, but the question explicitly states other scripts work, pointing to a scripting engine change rather than a network problem.

How to eliminate wrong answers

Option A is wrong because Windows Defender does not delete legitimate logon scripts; it quarantines detected malware, and the user reports other scripts work fine, indicating no system-wide deletion. Option B is wrong because Windows updates do not change the default script host from VBScript to PowerShell; the default host for .vbs files remains wscript.exe unless explicitly reconfigured, and PowerShell scripts use a different file extension (.ps1). Option D is wrong because SMB 2.0 is still supported in modern Windows versions; the issue is specific to VBScript execution, not network protocol compatibility.

Full explanation →
6
MCQhard

A technician is tasked with disposing of a server that contains multiple SAS hard drives. The company's data destruction policy mandates that drives must be rendered unreadable by any means. Which combination of methods ensures compliance?

A.Perform a full format on each drive.
B.Use a degausser on each drive and then shred them.
C.Overwrite each drive with zeros using a software tool.
D.Remove the drives and store them in a locked cabinet.
AnswerB

Using a degausser on each drive effectively neutralizes the magnetic fields that store data on traditional hard disk drives (HDDs), rendering the data unreadable and unrecoverable. Following degaussing with physical shredding ensures complete destruction of the drive platters and components, making data recovery absolutely impossible. This two-step process provides the highest level of data security and meets stringent government and industry data destruction standards for magnetic media.

Why this answer

Degaussing destroys the magnetic field on SAS hard drives, making data unrecoverable, and shredding physically destroys the platters, ensuring compliance with a policy that mandates drives be rendered unreadable by any means. This combination addresses both magnetic and physical recovery methods, which is necessary for high-security data destruction.

Exam trap

CompTIA A+ often tests the misconception that a full format or software overwrite is sufficient for secure data destruction, but the key trap here is that the policy requires drives to be rendered unreadable by any means, which mandates physical destruction or degaussing, not just logical erasure.

How to eliminate wrong answers

Option A is wrong because a full format only removes the file system pointers and may not overwrite all sectors, leaving data recoverable with forensic tools. Option C is wrong because overwriting with zeros using a software tool may not be effective on SAS drives if the drive's firmware remaps bad sectors or if the drive is damaged, and it does not physically destroy the media. Option D is wrong because storing drives in a locked cabinet does not destroy or render data unreadable; it only delays access, violating the policy that mandates drives must be rendered unreadable by any means.

Full explanation →
7
MCQhard

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

A.Store the password in a plain text file and have the script read it.
B.Use Group Policy Preferences to set the local administrator password.
C.Embed the password in the script using a variable and run it from a hidden share.
D.Use a scheduled task that runs the script as SYSTEM.
AnswerB

Group Policy Preferences (GPP) provides a secure and scalable method for setting local administrator passwords across multiple machines. When configured, GPP encrypts the password using AES-256 within the Group Policy Object (GPO) itself. The client-side extension then decrypts and applies the password locally, preventing its exposure in plain text during transmission or storage on the client, thus centralizing and securing the deployment.

Why this answer

Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Exam trap

CompTIA often tests the misconception that embedding a password in a script variable or using SYSTEM-level execution is sufficient for security, when in fact the password remains visible in the script file itself, which is the core vulnerability being assessed.

How to eliminate wrong answers

Option A is wrong because storing the password in a plain text file and having the script read it leaves the password fully visible and accessible to anyone who can read the file, violating the requirement to not leave the password visible. Option C is wrong because embedding the password in a script variable, even if run from a hidden share, still exposes the password in plain text within the script file itself, which can be viewed by anyone with access to the share or the script. Option D is wrong because using a scheduled task running as SYSTEM does not address the password visibility issue—the script would still need to contain or reference the password in plain text, or rely on an insecure storage method.

Full explanation →
8
MCQhard

A security incident occurred on a Windows 10 workstation where an attacker gained administrative access and created several hidden user accounts. You need to ensure no unauthorized accounts exist and that the built-in Administrator account is disabled. Which two tools can you use from the command line to list all user accounts and check the status of the Administrator account?

A.Use 'net user' to list accounts and 'net user Administrator | findstr /i active' to check status.
B.Use 'whoami' to list current user and 'net localgroup Administrators' to see group members.
C.Use 'dir C:\Users' to list user profile folders and 'net accounts' to see password policies.
D.Use 'gpresult /R' to list applied policies and 'net start' to see running services.
AnswerA

The 'net user' command is a fundamental Windows command-line utility for managing local user accounts. Executing 'net user' without arguments lists all local user accounts on the system, which is crucial for identifying unauthorized or suspicious accounts during a security incident. To check the status of a specific account, such as 'Administrator', 'net user Administrator' displays detailed information, including the "Account active" status. Piping this output to 'findstr /i active' efficiently filters for and confirms the account's enabled or disabled state, directly addressing the need to check account status.

Why this answer

The 'net user' command lists all local user accounts on a Windows system, which is necessary to identify hidden or unauthorized accounts. Piping 'net user Administrator' through 'findstr /i active' filters the output to show whether the built-in Administrator account is enabled or disabled, as the status line contains 'Active' or 'Account active' depending on the locale. This combination directly fulfills the requirement to list all accounts and check the Administrator account's status from the command line.

Exam trap

CompTIA often tests the distinction between listing all accounts versus showing only the current user or group membership, leading candidates to confuse 'whoami' or 'net localgroup' with account enumeration commands.

How to eliminate wrong answers

Option B is wrong because 'whoami' only displays the currently logged-in user, not a list of all accounts, and 'net localgroup Administrators' shows group membership, not the status of the Administrator account itself. Option C is wrong because 'dir C:\Users' lists user profile folders, which may not exist for hidden accounts or system accounts, and 'net accounts' displays password and lockout policies, not account status. Option D is wrong because 'gpresult /R' shows applied Group Policy settings, not user accounts, and 'net start' lists running services, which is irrelevant to account enumeration or status checking.

Full explanation →
9
MCQhard

A security incident occurred where an employee's workstation was infected with ransomware. The IT manager wants to ensure that all future workstations have Controlled Folder Access enabled to protect critical data from unauthorized changes. Which Windows Security applet should be used to configure this?

A.Windows Security > Firewall & network protection
B.Windows Security > App & browser control
C.Windows Security > Device security
D.Windows Security > Virus & threat protection > Manage ransomware protection
AnswerD

This is the correct and precise navigation path within Windows Security to configure Controlled Folder Access, a critical component of Microsoft Defender's ransomware protection. Within 'Manage ransomware protection,' users can enable or disable this feature, designate specific folders to be protected from unauthorized modification, and explicitly whitelist legitimate applications that are permitted to make changes to the contents of those protected directories, effectively preventing ransomware from encrypting valuable data.

Why this answer

Controlled Folder Access is a feature of Windows Defender Exploit Guard, found in the Windows Security app under Virus & threat protection > Manage ransomware protection. It must be enabled and configured with protected folders and allowed apps.

Full explanation →
10
MCQmedium

A user reports that their Windows 10 PC is running slowly and they suspect too many programs are starting automatically. They want to disable a few startup items without uninstalling them. Which tool should you use to manage these startup programs?

A.Services.msc
B.Task Manager > Startup tab
C.Control Panel > Programs and Features
D.Settings > Apps > Startup
AnswerB

The Task Manager's Startup tab provides a comprehensive overview of all user-installed applications configured to launch automatically with Windows. It displays crucial information such as the program's name, publisher, status (enabled/disabled), and its impact on system startup time, making it the most effective tool for identifying and disabling unwanted startup programs that often appear in the system tray.

Why this answer

Task Manager's Startup tab provides a straightforward interface to enable or disable startup programs without uninstalling them. It displays each startup item's name, publisher, status, and startup impact, allowing users to selectively disable unwanted entries. This is the correct tool for managing startup programs in Windows 10.

Exam trap

The trap here is that candidates confuse the Settings > Apps > Startup page (which is a simplified version) with the full-featured Task Manager Startup tab, or they mistakenly think Services.msc is the correct tool because they associate 'startup' with 'services'.

How to eliminate wrong answers

Option A is wrong because Services.msc manages Windows services (background processes that run independently of user logon), not user-installed startup programs; disabling a service could break system functionality. Option C is wrong because Control Panel > Programs and Features is used to uninstall or change installed programs, not to manage their startup behavior. Option D is wrong because Settings > Apps > Startup in Windows 10 only shows a list of startup apps with toggle switches, but it does not provide the detailed startup impact information or the ability to manage all startup items (e.g., those from the registry or startup folder) that Task Manager's Startup tab offers.

Full explanation →
11
MCQhard

A technician is investigating a security incident where a user's corporate email account was accessed from an unknown device. The user's iPhone shows no suspicious apps, and the password was recently changed. Which of the following is the MOST likely cause?

A.The user's iCloud account was compromised, and the email is synced via Exchange.
B.An OAuth token or app-specific password was stolen and used to access the account.
C.The user's iPhone has a jailbreak that hides malicious apps.
D.The corporate email server has a backdoor account.
AnswerB

OAuth tokens and app-specific passwords provide delegated access to an account without exposing the user's primary password. Once stolen or maliciously generated, these credentials can grant persistent, unauthorized access to specific services, like email, even if the main account password is subsequently changed. This mechanism allows an attacker to bypass traditional password authentication and maintain access, aligning with a scenario where suspicious activity continues despite password resets.

Why this answer

OAuth tokens or app-specific passwords bypass the need for the primary password, allowing persistent access even after a password change. Since the user's iPhone shows no suspicious apps and the password was recently changed, a stolen token is the most plausible vector for unauthorized email access via Exchange ActiveSync or modern authentication.

Exam trap

CompTIA often tests the distinction between password-based attacks and token-based persistence, where candidates mistakenly assume that changing the password immediately revokes all access, ignoring OAuth tokens or app-specific passwords that remain valid.

How to eliminate wrong answers

Option A is wrong because iCloud compromise alone does not directly grant access to a corporate Exchange email account unless the email is configured via iCloud Mail or the iCloud Keychain stores the Exchange credentials; the scenario specifies the email is synced via Exchange, not iCloud. Option C is wrong because a jailbreak that hides malicious apps is unlikely to be the cause given the user's iPhone shows no suspicious apps, and jailbreak detection would typically flag such behavior; moreover, hidden apps would still leave traces in system logs or profiles. Option D is wrong because a backdoor account on the corporate email server would be a server-side vulnerability, not a client-side issue, and the question focuses on the user's device and account access; such a backdoor would not be tied to the user's specific password change.

Full explanation →
12
MCQhard

A technician is troubleshooting a computer that has been infected with ransomware. The ransomware encrypted files and left a note demanding payment. After removing the malware, what is the most important step to prevent future infections?

A.Reinstall the operating system
B.Update all software to the latest versions
C.Implement a strict backup policy and educate users on phishing
D.Disable all browser plugins
AnswerC

Implementing a strict backup policy ensures that critical data can be restored in the event of a ransomware attack, significantly mitigating data loss and the pressure to pay a ransom. Concurrently, educating users on identifying and avoiding phishing attempts directly addresses the most common initial infection vector for ransomware. This proactive combination tackles both the consequences of an attack and the primary cause, offering a comprehensive defense.

Why this answer

Ransomware often enters through phishing emails or unpatched vulnerabilities. While removing the malware is necessary, preventing future infections requires a combination of user education to avoid phishing attempts and a strict backup policy to ensure data can be restored without paying the ransom. Without addressing the root cause (user behavior and data resilience), the system remains vulnerable to reinfection.

Exam trap

CompTIA often tests the misconception that technical controls alone (like reinstalling the OS or updating software) are sufficient, when in reality, user education and backup policies are the most critical steps to prevent future ransomware infections.

How to eliminate wrong answers

Option A is wrong because reinstalling the operating system removes the malware but does not address the underlying security gaps (e.g., unpatched software or user susceptibility to phishing) that allowed the infection. Option B is wrong because updating software patches known vulnerabilities, but it does not prevent infections caused by user actions like opening malicious email attachments or visiting compromised websites. Option D is wrong because disabling all browser plugins is overly restrictive and does not address the primary infection vector (phishing emails or drive-by downloads), nor does it protect against ransomware that arrives via other means like malicious macros in documents.

Full explanation →
13
MCQhard

A technician is writing a Python script to automate the installation of software on multiple Windows machines. The script needs to check if the software is already installed by looking for a specific registry key. If the key exists, the script should skip the installation. Which Python library and method should the technician use to read the registry?

A.Use the 'os' module with 'os.regread'
B.Use the 'subprocess' module to run 'reg query'
C.Use the 'winreg' module with 'OpenKey' and 'QueryValueEx'
D.Use the 'sys' module to access registry via system calls
AnswerC

The 'winreg' module is Python's standard library interface for interacting directly with the Windows Registry API. Using 'winreg.OpenKey()' allows a script to obtain a handle to a specific registry key, such as HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER, and then navigate to subkeys. Subsequently, 'winreg.QueryValueEx()' is the precise function designed to retrieve the data associated with a named value within that opened key, making this the most direct, efficient, and robust method for programmatic registry access.

Why this answer

The `winreg` module is the standard Python library for accessing the Windows registry. `OpenKey` opens a specified registry key, and `QueryValueEx` retrieves the value data and type for a given value name. This allows the script to check for the software's registry key and conditionally skip installation if it exists.

Exam trap

CompTIA often tests the distinction between general-purpose modules (`os`, `sys`, `subprocess`) and platform-specific modules (`winreg`), trapping candidates who assume a generic module can handle registry access or who overlook the native Python library for Windows registry operations.

How to eliminate wrong answers

Option A is wrong because the `os` module does not have an `os.regread` function; it provides operating system interfaces like file and process management, not registry access. Option B is wrong because while `subprocess` can run `reg query`, it is an indirect, slower, and less reliable method that requires parsing command output, whereas `winreg` provides direct, native registry access. Option D is wrong because the `sys` module provides system-specific parameters and functions (e.g., `sys.path`, `sys.argv`), not registry access; it cannot be used to read the registry via system calls.

Full explanation →
14
MCQhard

An employee finds a USB drive labeled 'Employee Bonuses Q4' in the parking lot and plugs it into their work computer to see the contents. The computer immediately begins exhibiting erratic behavior. Which social engineering attack was executed?

A.Phishing
B.Pretexting
C.Baiting
D.Tailgating
AnswerC

Baiting is a social engineering attack where an attacker leaves a physical, enticing object, such as a USB drive, CD, or even a mobile device, in a public or semi-public location. The item is often labeled provocatively (e.g., 'Employee Bonuses' or 'Confidential Data') to pique curiosity. The goal is for a curious victim to pick up the item and connect it to a computer, inadvertently introducing malware, ransomware, or other malicious payloads into the system.

Why this answer

Baiting. Baiting is a social engineering attack that uses a physical device (like a USB drive) or digital offer to lure a victim into taking an action that compromises security. In this scenario, the attacker left a USB drive labeled with an enticing file name ('Employee Bonuses Q4') in a public location, and the victim plugged it into their work computer, which then executed malicious code (e.g., autorun.inf or a malicious script) that caused erratic behavior.

This is a classic example of a physical baiting attack, distinct from phishing or pretexting which rely on digital communication or fabricated scenarios.

Exam trap

The trap here is that candidates often confuse baiting with phishing because both involve deception, but CompTIA A+ 220-1202 specifically tests the distinction that baiting uses a physical or digital lure (like a USB drive or free download) while phishing relies on electronic communication.

How to eliminate wrong answers

Option A is wrong because phishing is a social engineering attack delivered via electronic communication (e.g., email, SMS, or fake websites) that tricks the user into revealing credentials or clicking a malicious link, not by physically plugging in a USB drive. Option B is wrong because pretexting involves creating a fabricated scenario or false identity (e.g., impersonating IT support) to obtain information, not using a physical lure like a USB drive. Option D is wrong because tailgating (or piggybacking) is a physical security attack where an unauthorized person follows an authorized individual into a restricted area without proper authentication, not involving a USB drive or computer interaction.

Full explanation →
15
MCQeasy

A user is unable to print to a network printer after a Windows update. Other users on the same network can print successfully. Which Windows tool should you use to view detailed error messages related to the print spooler service?

A.Device Manager
B.Services.msc
C.Event Viewer
D.Performance Monitor
AnswerC

Event Viewer is the primary Windows utility for reviewing system, security, and application logs, including detailed event messages from services like the print spooler. When a print job fails, or the print spooler encounters an error, specific event IDs and descriptive messages are recorded here, often indicating the root cause, such as network connectivity issues, driver conflicts, or service crashes. This centralized logging makes it indispensable for diagnosing the underlying problem.

Why this answer

Event Viewer (C) is the correct tool because it logs detailed error messages from the print spooler service (spoolsv.exe) under 'Windows Logs > System' or 'Applications and Services Logs > Microsoft > Windows > PrintService'. When a Windows update breaks printing for a single user, Event Viewer captures spooler errors such as access denied, driver conflicts, or RPC failures that are not shown in other tools.

Exam trap

The trap here is that candidates confuse Services.msc (which only manages service state) with Event Viewer (which provides the actual error logs), leading them to pick B when they need to view detailed error messages.

How to eliminate wrong answers

Option A is wrong because Device Manager is used to view and manage hardware devices and drivers, but it does not show runtime error logs or service-specific messages from the print spooler. Option B is wrong because Services.msc allows you to start, stop, or restart the print spooler service and view its status, but it does not display detailed error messages or event logs. Option D is wrong because Performance Monitor tracks system performance counters (e.g., CPU, memory, print queue length) over time, but it does not log or display error messages from the print spooler service.

Full explanation →
16
MCQeasy

A user calls the help desk saying they cannot log into their Windows 10 workstation because a message claims their files are encrypted and they must pay a ransom. What is the most effective remediation approach?

A.Pay the ransom to get the decryption key
B.Reboot into Safe Mode and run a malware scan
C.Disconnect from the network and restore files from a verified backup
D.Run System Restore to a point before the attack
AnswerC

Disconnecting the infected system from the network immediately isolates the threat, preventing the ransomware from spreading to other network resources or communicating with command-and-control servers. Subsequently, restoring files from a verified, clean backup is the most effective and recommended method to recover encrypted data without paying the ransom. This process ensures data integrity and system functionality, adhering to best practices for ransomware incident response.

Why this answer

Ransomware encrypts files with a key known only to the attacker, making decryption without the key impossible. Disconnecting from the network prevents the ransomware from spreading to other systems, and restoring from a verified backup is the only reliable way to recover the original files without paying the ransom.

Exam trap

CompTIA often tests the misconception that removing the malware (via Safe Mode or System Restore) will undo the encryption, when in fact encryption is a cryptographic operation that persists after the malware is gone.

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee the attacker will provide a working decryption key, and it encourages further criminal activity. Option B is wrong because rebooting into Safe Mode and running a malware scan can remove the ransomware executable but cannot decrypt files that are already encrypted; the encryption persists. Option D is wrong because System Restore does not affect user files; it only restores system files and registry settings, leaving the encrypted files unchanged.

Full explanation →
17
MCQhard

A technician is decommissioning a server that contains a lithium-ion battery backup module. The battery is not swollen but is several years old. What is the proper disposal procedure?

A.Remove the battery and place it in the regular trash since it is not swollen.
B.Short the terminals to fully discharge the battery before disposal.
C.Discharge the battery using a proper load, then recycle it through a certified lithium battery recycler.
D.Store the battery in a metal container and return it to the manufacturer for disposal.
AnswerC

Discharging the battery using a proper load safely dissipates its residual energy, significantly reducing the risk of fire or explosion during handling and transport. Subsequently, recycling it through a certified lithium battery recycler ensures that hazardous materials are processed responsibly and valuable components are recovered. This approach adheres to environmental regulations, promotes resource conservation, and is the safest industry best practice for end-of-life battery management.

Why this answer

Lithium-ion batteries, even if not visibly swollen, degrade over time and can still pose a fire or chemical hazard if improperly disposed. The proper procedure is to safely discharge the battery using a certified load to remove residual energy, then recycle it through a certified lithium battery recycler to comply with environmental regulations and safety standards.

Exam trap

CompTIA often tests the misconception that a battery that is not swollen is safe for regular disposal, when in fact all lithium-ion batteries require special handling due to residual energy and chemical hazards.

How to eliminate wrong answers

Option A is wrong because placing a lithium-ion battery in regular trash violates environmental regulations (e.g., RCRA in the US) and creates fire and toxic waste hazards, regardless of whether it appears swollen. Option B is wrong because shorting the terminals of a lithium-ion battery can cause a short circuit, leading to rapid discharge, overheating, fire, or explosion; safe discharge requires a controlled load. Option D is wrong because storing a lithium-ion battery in a metal container without prior discharge or proper packaging can create a short-circuit risk and is not a standard disposal procedure; returning to the manufacturer is acceptable only if they provide a specific take-back program, but the question asks for the proper disposal procedure, which emphasizes safe discharge and certified recycling.

Full explanation →
18
MCQhard

A technician is troubleshooting a recurring network outage that occurs every Tuesday at 3 PM. After reviewing the change log, the technician finds that a scheduled backup job runs at that time. What is the best course of action?

A.Disable the backup job immediately to restore network stability.
B.Document the correlation and propose a change to the backup schedule.
C.Increase the network bandwidth to accommodate the backup traffic.
D.Ignore the issue since the backup is a critical process.
AnswerB

The most appropriate action is to thoroughly document the observed correlation between the recurring network outage and the backup job's execution time. This documentation provides essential evidence for a formal change request, which would then be submitted to the Change Advisory Board (CAB) for review. The CAB can then evaluate the proposed schedule modification, ensuring that network stability is improved without compromising data integrity or backup compliance.

Why this answer

This question tests the ability to correlate documented changes with incidents. The best action is to update the documentation to reflect the impact and then work with the change advisory board to reschedule the backup or mitigate the outage.

Full explanation →
19
MCQeasy

A customer complains that their new smartphone connects to their home Wi-Fi but has no internet access. The router is configured with WPA2-PSK and a 64-character pre-shared key. Other devices work fine. What is the most likely cause?

A.The smartphone's Wi-Fi antenna is faulty.
B.The smartphone is using a wrong or mistyped Wi-Fi password.
C.The router's DHCP server has run out of IP addresses.
D.The smartphone's DNS settings are misconfigured.
AnswerB

When a smartphone attempts to connect to a secure Wi-Fi network, it first associates with the access point. Following this, a security handshake (e.g., WPA2/WPA3 4-way handshake) occurs, requiring the correct pre-shared key (password). If the password is incorrect, this authentication handshake fails, preventing the device from obtaining a valid IP address from the DHCP server and establishing a secure, encrypted data link. Consequently, the smartphone might display "Connected" to the SSID but will be unable to send or receive internet traffic.

Why this answer

The most likely cause is a mistyped or incorrect Wi-Fi password. Since the smartphone connects to the Wi-Fi network (association and authentication succeed at Layer 2) but has no internet access, the device is likely using a wrong pre-shared key that still allows partial connectivity due to WPA2-PSK's four-way handshake behavior—if the key is incorrect, the handshake fails, but some implementations may show a 'connected' status without proper encryption. Other devices work fine, ruling out router-side issues like DHCP exhaustion or DNS misconfiguration.

Exam trap

The 220-1202 exam often tests the distinction between 'connected to Wi-Fi' (Layer 2 association) and 'has internet access' (Layer 3 connectivity), trapping candidates who assume any connectivity issue must be DHCP or DNS related, when the root cause is often an authentication failure due to a mistyped password.

How to eliminate wrong answers

Option A is wrong because a faulty Wi-Fi antenna would prevent the smartphone from connecting to the Wi-Fi at all, not just block internet access. Option C is wrong because if the router's DHCP server had run out of IP addresses, the smartphone would fail to obtain an IP address and would not show a 'connected' status; other devices working fine also indicates DHCP is functional. Option D is wrong because DNS misconfiguration would still allow the smartphone to have internet access via IP addresses (e.g., pinging 8.8.8.8 would work), and the symptom is a complete lack of internet access, not just name resolution failure.

Full explanation →
20
MCQhard

A security administrator needs to prevent users from running unauthorized software on Windows 10 Enterprise workstations. They want to allow only applications that are signed by approved publishers. Which Windows security feature should be configured?

A.Windows Defender Firewall with Advanced Security
B.BitLocker Drive Encryption
C.Windows Defender Application Control (WDAC)
D.User Account Control (UAC)
AnswerC

Windows Defender Application Control (WDAC) is a robust security feature that enforces code integrity policies to control which applications and drivers are allowed to run on a system. It operates on a whitelisting model, permitting only applications explicitly approved by the administrator, often based on digital signatures, file hashes, or specific publisher information. This mechanism directly prevents the execution of unapproved software, precisely meeting the requirement to block users from running unauthorized applications.

Why this answer

Windows Defender Application Control (WDAC) is the correct feature because it enforces an application control policy that allows only executables, scripts, and installers signed by approved publishers to run. Unlike AppLocker, WDAC operates at the kernel level and can be configured via Group Policy or MDM to create a trust chain based on the publisher's digital signature, effectively blocking all unauthorized software.

Exam trap

CompTIA often tests the distinction between application control (WDAC/AppLocker) and privilege elevation (UAC), so candidates mistakenly choose UAC because they associate it with blocking software, but UAC only prompts for admin approval, not publisher-based whitelisting.

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall with Advanced Security controls network traffic based on port, protocol, and IP address rules, not application execution or code signing. Option B is wrong because BitLocker Drive Encryption provides full-disk encryption to protect data at rest but does not enforce any application whitelisting or publisher signing policies. Option D is wrong because User Account Control (UAC) prompts for elevation of privileges but does not restrict which applications can run based on their digital signature or publisher; it only controls administrative consent.

Full explanation →
21
MCQhard

After a security incident, a forensic analyst needs to review the event logs on a Windows 10 system to determine when a specific user account was created. The logs are intact. Which Windows security setting must be enabled to ensure that account creation events are recorded?

A.Enable 'Audit Logon Events' in Local Security Policy.
B.Enable 'Audit Account Management' in Advanced Audit Policy.
C.Turn on 'File and Printer Sharing' in Network and Sharing Center.
D.Configure Windows Defender to scan for new accounts.
AnswerB

Enabling 'Audit Account Management' within the Advanced Audit Policy settings is the correct action because it specifically configures the operating system to log events related to user and group account management. This includes the creation, deletion, or modification of user accounts, security groups, and even password changes. For a forensic analyst investigating a security incident, these detailed logs are essential for identifying unauthorized account creation or privilege escalation, providing a clear audit trail of administrative changes.

Why this answer

User account creation is an account management event, not a logon event. In Windows 10, the 'Audit Account Management' policy under Advanced Audit Policy Configuration must be enabled to record Security Event ID 4720 (a user account was created). This setting logs all changes to user and group accounts, including creation, modification, and deletion.

Exam trap

The trap here is that candidates confuse 'Audit Logon Events' (which deals with authentication) with 'Audit Account Management' (which deals with account creation and modification), leading them to select the wrong policy for recording account creation.

How to eliminate wrong answers

Option A is wrong because 'Audit Logon Events' records logon/logoff attempts (Event IDs 4624, 4625), not account creation events; account creation falls under account management auditing. Option C is wrong because 'File and Printer Sharing' is a network discovery and sharing feature that has no impact on security event logging or auditing. Option D is wrong because Windows Defender is an antivirus/antimalware solution that does not audit account creation events; it does not generate or record security event logs for user account operations.

Full explanation →
22
MCQeasy

A technician needs to dispose of several old CRT monitors from an office. What is the proper disposal method according to environmental safety regulations?

A.Place them in the regular dumpster for bulk trash pickup.
B.Take them to a certified e-waste recycling center.
C.Smash the glass and separate the components for metal recycling.
D.Donate them to a local school for reuse.
AnswerB

Certified e-waste recycling centers possess the specialized equipment and trained personnel required to safely dismantle CRTs. They are equipped to properly separate and neutralize hazardous materials, such as leaded glass, mercury, and phosphors, preventing environmental contamination. Furthermore, these facilities recover valuable raw materials like copper, aluminum, and non-leaded glass, promoting resource conservation and ensuring compliance with stringent environmental regulations like the EPA's universal waste rule.

Why this answer

CRT monitors contain hazardous materials such as lead, phosphor, and other heavy metals that are harmful to the environment if disposed of in landfills. Certified e-waste recycling centers follow strict environmental regulations to safely dismantle and recycle these components, preventing toxic substances from contaminating soil and groundwater.

Exam trap

CompTIA often tests the misconception that donating or reusing old equipment is always the best environmental practice, but the trap here is that the question specifically asks about proper disposal according to environmental safety regulations, which mandates certified recycling for hazardous e-waste like CRTs.

How to eliminate wrong answers

Option A is wrong because placing CRT monitors in a regular dumpster violates environmental regulations due to the hazardous materials (lead, cadmium) they contain, which can leach into landfills. Option C is wrong because smashing the glass releases toxic phosphor dust and lead into the air and environment, posing health risks and violating safety protocols. Option D is wrong while donating for reuse may seem environmentally friendly, it does not address the eventual disposal of the monitors when they fail; proper disposal still requires certified recycling to handle the hazardous components at end-of-life.

Full explanation →
23
MCQmedium

A user is trying to install a legacy application on Windows 10, but the installer fails with a message about 'incompatible version'. The application is known to work on Windows 7. Which compatibility settings should you try first to allow the installation to proceed?

A.Set the installer to run as an administrator.
B.Enable the 'Reduced color mode' compatibility setting.
C.Right-click the installer, go to Properties > Compatibility, and check 'Run this program in compatibility mode for: Windows 7'.
D.Use the Program Compatibility Troubleshooter from the Control Panel.
AnswerC

This option is the direct and most effective solution for a legacy application failing due to an operating system version incompatibility. By selecting 'Run this program in compatibility mode for: Windows 7', the current Windows operating system (e.g., Windows 10 or 11) presents itself to the installer as if it were Windows 7. This 'shim' layer intercepts API calls and system information requests, allowing the application to proceed with installation, believing it is running on its intended older environment.

Why this answer

Windows 10 includes compatibility modes that emulate older versions of Windows. Running the installer in compatibility mode for Windows 7 can often resolve version-check errors, as it tricks the application into thinking it is running on a compatible OS.

Full explanation →
24
MCQmedium

A technician is deploying a new application to 20 sales laptops. The change management plan requires a pilot test on 2 laptops before full deployment. After testing, the technician finds the application works but conflicts with the VPN client. What should the technician do?

A.Deploy the application to all laptops and disable the VPN client on each.
B.Document the conflict and submit a revised change request with a resolution plan.
C.Continue with the deployment and note the conflict in the change log.
D.Uninstall the VPN client from all laptops and reinstall after the deployment.
AnswerB

This is the correct procedure according to IT best practices and established change management frameworks. When an unforeseen conflict arises during a deployment, the technician must halt the current process, thoroughly document the discovered incompatibility, and then propose a revised plan to address the issue. Submitting a new change request ensures that all stakeholders are informed, potential impacts are assessed, and an approved, controlled resolution is implemented, maintaining system stability and security.

Why this answer

The change management process requires that any issues discovered during pilot testing be formally documented and addressed before full deployment. Since the application conflicts with the VPN client, the technician must submit a revised change request that includes a resolution plan (e.g., updating the application, modifying VPN configuration, or scheduling a coordinated deployment). This ensures compliance with organizational change control policies and minimizes risk to production systems.

Exam trap

CompTIA often tests the misconception that a discovered conflict can be ignored or worked around without formal change management approval, tempting candidates to choose options that prioritize speed over process compliance.

How to eliminate wrong answers

Option A is wrong because deploying the application to all laptops and disabling the VPN client on each bypasses the change management process and could disrupt remote access for sales staff, violating security and operational requirements. Option C is wrong because continuing with deployment while merely noting the conflict in the change log fails to resolve the known issue, which could lead to widespread VPN failures and non-compliance with the pilot test requirement. Option D is wrong because uninstalling the VPN client from all laptops before deployment is a disruptive workaround that ignores the root cause and may violate security policies; the conflict should be resolved through proper change management, not by removing critical software.

Full explanation →
25
MCQmedium

A user installs a new application and immediately receives a 'The application was unable to start correctly (0xc000007b)' error. The application worked on another computer with the same Windows version. Which component is most likely causing this error?

A.The application requires a newer version of DirectX.
B.The Visual C++ Redistributable package is missing or corrupted.
C.The user does not have administrative privileges.
D.The hard drive has bad sectors affecting the application files.
AnswerB

Error 0xc000007b, or STATUS_INVALID_IMAGE_FORMAT, frequently occurs when an application cannot correctly load a required dynamic-link library (DLL) due to a binary architecture mismatch, such as a 64-bit application attempting to load a 32-bit DLL or vice versa. This often points to a dependency on a specific version of the Visual C++ runtime libraries that is either absent or corrupted on the system. Reinstalling the appropriate Visual C++ Redistributable package for the application's architecture (x86 or x64) typically resolves this by providing the necessary runtime components.

Why this answer

Error code 0xc000007b is a STATUS_INVALID_IMAGE_FORMAT error, typically indicating a mismatch between 32-bit and 64-bit binaries. The most common cause is a missing or corrupted Visual C++ Redistributable package, which provides essential runtime libraries (e.g., MSVCR120.dll) that the application depends on. Without these libraries, the application cannot load correctly, even if the Windows version matches.

Exam trap

CompTIA often tests the 0xc000007b error by pairing it with a plausible but incorrect option like DirectX, exploiting the fact that many candidates associate all 'missing DLL' errors with DirectX or graphics issues.

How to eliminate wrong answers

Option A is wrong because DirectX errors usually produce different error codes (e.g., 0xc000007b is not a DirectX-specific error) and DirectX is primarily for graphics APIs, not general application startup. Option C is wrong because insufficient administrative privileges typically trigger 'Access Denied' or UAC prompts, not error 0xc000007b. Option D is wrong because bad sectors on the hard drive would cause file read errors or data corruption, not a specific STATUS_INVALID_IMAGE_FORMAT error; the error occurs before the application files are fully read.

Full explanation →
26
MCQmedium

A user reports that a scheduled task runs a VBScript every morning, but the script fails with an 'ActiveX component can't create object' error. The script uses a COM object to interact with an application. What is the most likely cause of this error?

A.The script is running with insufficient permissions to create files
B.The COM object's DLL is not registered or the application is not installed
C.The script contains a syntax error in the CreateObject line
D.The scheduled task is set to run when the user is not logged in
AnswerB

The 'ActiveX component can't create object' error (runtime error 429) is a direct indication that the operating system cannot locate or instantiate the requested Component Object Model (COM) component. This almost always occurs because the necessary COM server, often a Dynamic Link Library (DLL) or Executable (EXE), is either not properly registered in the Windows Registry or the application package containing the component is not installed on the system. Without proper registration, the `CreateObject` function cannot find the class ID (CLSID) or programmatic ID (ProgID) required to create an instance of the object.

Why this answer

The 'ActiveX component can't create object' error occurs when the VBScript's CreateObject call fails because the COM class it references is not available. This typically means the DLL that implements the COM object is not registered (e.g., via regsvr32) or the application that provides the object is not installed on the system. Without the registered COM component, the script cannot instantiate the object, leading to this specific runtime error.

Exam trap

CompTIA often tests the distinction between runtime COM registration errors and other script failures, so the trap here is that candidates mistakenly attribute the error to permissions or syntax when the root cause is a missing or unregistered COM component.

How to eliminate wrong answers

Option A is wrong because insufficient permissions to create files would produce a 'Permission denied' error, not an 'ActiveX component can't create object' error, which is specifically about COM instantiation failure. Option C is wrong because a syntax error in the CreateObject line would cause a compile-time error (e.g., 'Expected end of statement') before the script even attempts to create the object, not a runtime 'ActiveX component can't create object' error. Option D is wrong because the scheduled task running when the user is not logged in can cause issues with interactive desktop access or network drives, but it does not prevent COM object creation; the error is about the COM component itself being missing or unregistered, not about session context.

Full explanation →
27
MCQhard

A technician is called to a server room where a UPS battery is emitting a strong sulfur smell and the casing feels warm. What immediate action should the technician take?

A.Open the UPS to ventilate the battery compartment.
B.Continue monitoring the UPS until it shuts down automatically.
C.Disconnect the UPS from the mains and move it outside to a safe area.
D.Spray the UPS with a fire extinguisher as a precaution.
AnswerC

Disconnecting the UPS from the AC mains immediately removes its primary power source, preventing further charging or electrical stress that could worsen an internal fault or battery thermal runaway. Moving the unit to a safe, isolated outdoor area minimizes the risk of fire, toxic fume exposure, or explosion impacting critical infrastructure or personnel within the server room. This action prioritizes safety and containment above all else.

Why this answer

A strong sulfur smell and warm casing from a UPS battery indicate thermal runaway, a condition where internal chemical reactions generate excessive heat, potentially leading to fire or explosion. The immediate priority is to disconnect the UPS from mains power to stop charging and remove it to a safe, well-ventilated outdoor area to mitigate the risk of toxic gas release or catastrophic failure.

Exam trap

CompTIA often tests the misconception that opening the UPS or using a fire extinguisher is a safe first response, when in fact the correct action is to isolate and remove the hazard to prevent escalation of thermal runaway.

How to eliminate wrong answers

Option A is wrong because opening the UPS battery compartment exposes the technician to toxic hydrogen sulfide gas and risks electrical shock or short circuits from exposed terminals, worsening the hazard. Option B is wrong because continuing to monitor the UPS while it is in thermal runaway allows the condition to escalate, increasing the likelihood of fire, explosion, or release of corrosive electrolyte. Option D is wrong because spraying a UPS with a fire extinguisher is premature and ineffective—thermal runaway is an internal chemical process, not an open flame, and extinguisher discharge can cause electrical shorts or damage equipment without addressing the root cause.

Full explanation →
28
MCQmedium

A technician is tasked with decommissioning a RAID array of SSDs that stored proprietary source code. The company policy requires that the drives be reused in another department. Which method ensures data is securely removed while preserving the SSDs?

A.Run a full format on each SSD.
B.Use the drive manufacturer's secure erase utility.
C.Degauss the SSDs.
D.Overwrite the drives with zeros three times.
AnswerB

Using the drive manufacturer's secure erase utility is the most effective and recommended method for decommissioning an SSD. This utility sends an ATA SECURITY ERASE UNIT command directly to the SSD controller, which then executes a low-level operation to reset all NAND flash memory cells to their factory default state. This process ensures that all data, including that in over-provisioned areas and remapped blocks, is irreversibly erased at the hardware level, rendering it unrecoverable while also restoring the drive's performance for future reuse.

Why this answer

The drive manufacturer's secure erase utility (e.g., ATA Secure Erase) issues a hardware-level command that triggers the SSD's internal controller to cryptographically erase all data by resetting the encryption key, which is instantaneous and preserves the drive's health. This method is specifically designed for SSDs because traditional overwriting (like zero-filling) is ineffective on SSDs due to wear-leveling and garbage collection, which can leave data remnants in over-provisioned or reallocated sectors.

Exam trap

Candidates often mistakenly believe that multiple overwrites (like the DoD 5220.22-M standard) are universally effective, but SSDs require a different approach due to their internal architecture. Degaussing is destructive for magnetic drives and not applicable to flash-based storage.

How to eliminate wrong answers

Option A is wrong because a full format on an SSD does not securely erase data; it only marks the file system as empty and may trigger a TRIM command, but data remains recoverable until overwritten by new writes. Option C is wrong because degaussing an SSD destroys the magnetic storage medium (NAND flash is not magnetic), rendering the drive completely inoperable and unusable for reuse, which violates the policy to preserve the drives. Option D is wrong because overwriting SSDs with zeros three times is ineffective due to wear-leveling and the SSD's inability to guarantee that all logical blocks map to the same physical cells, leaving data potentially recoverable from over-provisioned or retired blocks.

Full explanation →
29
MCQhard

A user's iPhone is running iOS 15 and they are unable to install a new app from the App Store. The error message says 'Unable to Download App. This app requires iOS 16 or later.' However, the user's iPhone model supports iOS 16. Which built-in iOS feature should the technician use to resolve this?

A.Offload the app and reinstall it.
B.Clear the App Store cache by force-closing the app.
C.Perform a factory reset.
D.Update iOS via Settings > General > Software Update.
AnswerD

Navigating to Settings > General > Software Update allows the user to download and install the latest available version of iOS that is compatible with their specific iPhone model. By updating the device from iOS 15 to iOS 16, the iPhone will then meet the minimum operating system requirement specified by the application developer. This direct action resolves the core compatibility issue, thereby enabling the successful download and installation of the desired app.

Why this answer

The error message explicitly states that the app requires iOS 16 or later, and the user's iPhone model supports iOS 16. The correct resolution is to update the device's operating system via Settings > General > Software Update, which is the built-in mechanism for installing iOS updates. This directly addresses the compatibility requirement by upgrading the OS to a version that meets the app's minimum deployment target.

Exam trap

The trap here is that candidates may confuse a storage or cache issue with a version compatibility issue, or incorrectly assume that a factory reset or app reinstall can bypass the OS version check, when in fact the error is a hard requirement enforced by the App Store's validation logic.

How to eliminate wrong answers

Option A is wrong because offloading and reinstalling the app does not change the iOS version; it only removes and re-downloads the app data, which would still fail with the same error if iOS 15 remains. Option B is wrong because clearing the App Store cache by force-closing the app does not alter the device's iOS version; it only refreshes temporary data and cannot resolve a version-based compatibility issue. Option C is wrong because performing a factory reset erases all content and settings but does not upgrade the iOS version; the device would still be on iOS 15 after the reset, so the app would still be incompatible.

Full explanation →
30
MCQmedium

During a security audit, you discover that a Windows 10 workstation has a weak local administrator password. The company policy requires all local admin passwords to be at least 12 characters with complexity. Which tool can enforce this policy for all future password changes on that workstation?

A.Local Users and Groups (lusrmgr.msc)
B.Local Security Policy (secpol.msc)
C.Registry Editor (regedit)
D.Windows Defender Firewall with Advanced Security
AnswerB

Local Security Policy (secpol.msc) is the correct administrative tool for configuring and enforcing a wide range of security settings on a local Windows computer, including detailed password policies. Within this console, administrators can define parameters like minimum password length, complexity requirements, password history to prevent reuse, and account lockout thresholds. These settings are crucial for establishing robust authentication security and mitigating brute-force attacks.

Why this answer

B is correct because the Local Security Policy (secpol.msc) includes the 'Password Policy' settings under Account Policies, where you can configure minimum password length (12 characters) and password complexity requirements. These settings are enforced by the Local Security Authority (LSA) for all future password changes on the workstation, directly aligning with the company policy.

Exam trap

The trap here is that candidates often confuse user account management tools (like lusrmgr.msc) with security policy enforcement tools, thinking they can set password requirements directly in the user properties, when in fact password policies are enforced system-wide via the Local Security Policy.

How to eliminate wrong answers

Option A is wrong because Local Users and Groups (lusrmgr.msc) is used to manage user accounts and groups, not to enforce password policies; it cannot set minimum length or complexity requirements. Option C is wrong because Registry Editor (regedit) can modify password policy values indirectly via registry keys (e.g., under HKLM\SAM), but it is not the intended tool for policy enforcement and lacks the structured interface and validation provided by secpol.msc. Option D is wrong because Windows Defender Firewall with Advanced Security manages network traffic filtering and firewall rules, not local password policies.

Full explanation →
31
MCQmedium

A technician is helping a user who is upset because their important presentation file was accidentally deleted. The user is very emotional and raising their voice. What is the best way for the technician to handle this situation?

A.Tell the user to calm down and that losing data is not a big deal.
B.Raise your voice to match the user's tone to show you are taking it seriously.
C.Listen calmly, apologize for the inconvenience, and explain steps to recover the file from the recycle bin or backup.
D.Transfer the call to a manager immediately.
AnswerC

This option demonstrates exemplary customer service and problem-solving skills, aligning with CompTIA A+ best practices. Listening calmly shows respect and allows the technician to fully understand the problem without interruption. Apologizing for the inconvenience validates the user's feelings and builds rapport. Subsequently, providing clear, actionable steps to recover the file, such as checking the Recycle Bin or backup solutions, offers a practical resolution and reassures the user.

Why this answer

It demonstrates the professional communication and empathy required in a support role. The technician remains calm, acknowledges the user's frustration, and immediately provides a technical solution—recovering the file from the Recycle Bin or a backup. This aligns with CompTIA's emphasis on active listening, de-escalation, and problem-solving without dismissing the user's concerns.

Exam trap

The trap here is that candidates may think escalating to a manager (Option D) is the safest choice, but CompTIA expects the technician to first apply technical troubleshooting and de-escalation techniques before transferring the call.

How to eliminate wrong answers

Option A is wrong because telling a user to 'calm down' and minimizing the loss of data dismisses their emotional state and violates professional conduct; it can escalate the situation and damage trust. Option B is wrong because matching the user's raised tone is confrontational and unprofessional; it does not de-escalate the situation and can lead to a hostile interaction. Option D is wrong because transferring the call to a manager immediately is premature; the technician should first attempt to resolve the issue using standard recovery methods (e.g., Recycle Bin, backup) before escalating.

Full explanation →
32
MCQmedium

A user reports receiving a phone call from someone claiming to be from 'Microsoft Support' saying their computer has a virus and asking for remote access to fix it. The user did not grant access. What type of attack was attempted?

A.Phishing
B.Vishing
C.Smishing
D.Pretexting
AnswerB

Vishing, a portmanteau of "voice" and "phishing," is a specific type of social engineering attack that leverages telephone calls to manipulate individuals. Attackers often impersonate legitimate entities like banks, technical support, or government agencies to trick victims into divulging personal data, financial information, or granting remote access to their systems. This method relies on the perceived urgency and directness of a live phone conversation to bypass typical digital security measures.

Why this answer

This is a vishing (voice phishing) attack, a social engineering technique where the attacker uses phone calls to trick victims into providing sensitive information or remote access. Legitimate companies like Microsoft do not make unsolicited support calls.

Full explanation →
33
MCQmedium

A user reports that their computer is running slowly after they installed a 'free system cleaner' from a pop-up ad. The technician suspects malware. What is the most appropriate first step in handling this situation professionally?

A.Immediately run a full antivirus scan and quarantine any threats found.
B.Ask the user to describe exactly what they installed and from where, without sounding accusatory.
C.Tell the user that installing software from pop-ups is dangerous and they should know better.
D.Remotely uninstall the program without informing the user.
AnswerB

Asking the user about recent installations is the most effective initial step because it directly addresses a common cause of system performance degradation: newly installed or conflicting software. This non-accusatory approach encourages the user to provide honest and detailed information, which is vital for accurate diagnosis and efficient troubleshooting. Gathering this specific context allows the technician to focus subsequent diagnostic efforts, rather than performing broad, undirected actions.

Why this answer

The first step in handling a potential malware infection professionally is to gather information from the user without judgment. Asking the user to describe what they installed and from where helps the technician understand the attack vector (e.g., a fake pop-up ad), which is critical for selecting the appropriate remediation steps and for any future security awareness training. This approach maintains trust and encourages the user to report issues promptly, which is essential for effective incident response.

Exam trap

CompTIA often tests the distinction between technical urgency and professional communication, where candidates mistakenly choose a technically correct action (like running a scan) over the professionally required first step of gathering information without blame.

How to eliminate wrong answers

Option A is wrong because immediately running a full antivirus scan without first gathering information from the user can disrupt their workflow, may miss root cause analysis (e.g., the specific file or URL involved), and does not address the professional need to understand the user's actions for future prevention. Option C is wrong because telling the user they should know better is accusatory and unprofessional; it damages the technician-user relationship and discourages the user from reporting future security incidents, which is a core violation of professional communication standards. Option D is wrong because remotely uninstalling the program without informing the user violates user consent and transparency, and it may remove evidence needed for deeper forensic analysis or for identifying additional malware components.

Full explanation →
34
MCQmedium

A company is implementing a new policy that requires users to authenticate using both a password and a one-time code sent to their mobile phone. What type of authentication factor is the one-time code?

A.Something you are
B.Something you know
C.Something you have
D.Somewhere you are
AnswerC

"Something you have" authentication factors rely on the user possessing a specific physical object or device. In this scenario, the one-time code is delivered to a user's phone, which is a tangible item they physically possess and control. The ability to receive and access this code on their device serves as proof of their identity, leveraging the possession of that specific hardware as the authentication factor.

Why this answer

Authentication factors are categorized as something you know (password), something you have (token or phone), and something you are (biometrics). A one-time code sent to a mobile phone is considered 'something you have' because access to the phone is required. This question tests the classification of multi-factor authentication components.

Full explanation →
35
MCQeasy

A user needs to access a shared folder on a Windows 10 workstation from their Windows 11 laptop. Both devices are on the same local network. Which Windows feature must be enabled on the workstation to allow file sharing?

A.Network Discovery
B.File and Printer Sharing
C.HomeGroup
D.Windows Firewall
AnswerB

File and Printer Sharing is the fundamental Windows network service that explicitly enables a workstation to host and provide access to its local folders and printers over the network. By activating this feature, the Server Message Block (SMB) protocol is enabled and configured to listen for incoming connections, allowing other network devices to connect to and access the shared resources. This service is specifically designed to facilitate the sharing of local resources, making it the direct and necessary component for allowing users to access a shared folder on the network, provided appropriate permissions are also configured.

Why this answer

File and Printer Sharing (option B) is the correct feature because it enables the Server Message Block (SMB) protocol on the workstation, which is the underlying protocol Windows uses for shared folder access. Without this service running and allowed through the firewall, other devices cannot connect to the workstation's shared resources, regardless of network discovery or firewall settings.

Exam trap

CompTIA often tests the distinction between Network Discovery (which only controls visibility) and File and Printer Sharing (which actually enables resource access), leading candidates to mistakenly select Network Discovery when the question asks about enabling file sharing.

How to eliminate wrong answers

Option A is wrong because Network Discovery only allows the workstation to see other devices on the network and be seen by them; it does not enable the actual sharing of folders or files. Option C is wrong because HomeGroup was removed from Windows 10 (version 1803 and later) and Windows 11; it is a deprecated feature and not required for standard SMB-based file sharing. Option D is wrong because Windows Firewall is a security component that can block or allow traffic, but it is not the feature that enables file sharing; in fact, File and Printer Sharing must be allowed as an exception within the firewall for sharing to work.

Full explanation →
36
MCQmedium

During a software installation, a technician receives an error that the system does not meet the minimum requirements. The technician decides to override the check by modifying the registry. What safety procedure should be followed before making registry changes?

A.Disable User Account Control (UAC).
B.Create a system restore point.
C.Run the installation as an administrator.
D.Close all other running applications.
AnswerB

Creating a system restore point captures a snapshot of critical system files, installed programs, the Windows Registry, and hardware drivers at a specific moment. If a software installation introduces instability, corrupts the registry, or causes other issues, this restore point enables the technician to revert the operating system to its prior, stable configuration, effectively undoing the problematic changes. This is the most direct and effective method for rollback protection against unforeseen installation problems.

Why this answer

Creating a system restore point before modifying the registry is the correct safety procedure because it captures the current system state, including registry keys, drivers, and system files. If the registry edit causes instability or boot failure, the restore point allows the technician to revert the system to its previous working configuration without data loss. This is a standard best practice for any registry modification, as even minor errors can render the system unbootable.

Exam trap

CompTIA often tests the distinction between permission elevation (running as admin) and system protection (restore point), leading candidates to mistakenly choose 'Run as administrator' because they think it bypasses the error, when in fact the question explicitly asks for the safety procedure before making registry changes.

How to eliminate wrong answers

Option A is wrong because disabling User Account Control (UAC) reduces system security by allowing all processes to run with elevated privileges without prompting, but it does not provide a rollback mechanism for registry changes; it only removes the elevation prompt, not the risk of corruption. Option C is wrong because running the installation as an administrator only ensures the installer has sufficient permissions to write to protected areas like the registry, but it does not create a backup or restore point; if the registry edit fails, there is no way to undo it. Option D is wrong because closing other applications reduces resource conflicts and potential interference during installation, but it does not safeguard against registry corruption; it is a general best practice for stability, not a safety procedure for registry modifications.

Full explanation →
37
MCQhard

A technician is troubleshooting a printer that is not printing. The user insists that the printer was working yesterday and nothing has changed. The technician finds that the printer's IP address has changed due to a DHCP lease renewal. What is the best way to explain this to the user?

A.Explain that the printer's IP address changed because of DHCP, and that you will assign a static IP to prevent future issues.
B.Tell the user that the network changed the printer's address and it is not your fault.
C.Use technical jargon like 'DHCP lease expiration' and 'subnet mask misconfiguration' to sound authoritative.
D.Say that the printer is faulty and needs to be replaced.
AnswerA

This is the most appropriate response because it clearly and concisely explains the root cause of the printer's inaccessibility, which is the DHCP server dynamically reassigning its IP address, in user-friendly terms. It also immediately offers a concrete, permanent solution by configuring a static IP address to prevent recurrence, demonstrating competence and a proactive approach to problem-solving. This approach builds user confidence and resolves the issue efficiently.

Why this answer

It directly addresses the root cause (DHCP lease renewal changing the printer's IP) and provides a clear, non-technical explanation to the user while outlining the solution (assigning a static IP). This demonstrates effective communication and professionalism by taking ownership of the issue and preventing recurrence, aligning with CompTIA's troubleshooting methodology.

Exam trap

The trap here is that candidates may choose Option C, thinking technical jargon demonstrates expertise, but CompTIA emphasizes explaining issues in user-friendly terms to maintain professionalism and trust.

How to eliminate wrong answers

Option B is wrong because it shifts blame to the network without offering a solution, which is unprofessional and fails to resolve the user's concern. Option C is wrong because using technical jargon like 'DHCP lease expiration' and 'subnet mask misconfiguration' without explanation confuses the user and violates the principle of clear communication. Option D is wrong because it incorrectly attributes the issue to a faulty printer, ignoring the actual DHCP-related IP change and leading to unnecessary replacement costs.

Full explanation →
38
MCQeasy

A user reports that their Android phone's battery drains rapidly after a recent app update. They have already tried restarting the device. Which of the following should a technician recommend FIRST to diagnose the issue?

A.Perform a factory reset.
B.Check battery usage in Settings to identify the app consuming the most power.
C.Replace the battery immediately.
D.Disable all background data.
AnswerB

The most logical and effective first step is to access the device's battery usage statistics, typically found within the "Settings" menu under "Battery" or "Device Care." This feature provides a detailed breakdown of power consumption by individual applications, system services, and hardware components over a specific period. Identifying the primary power-consuming entity allows for targeted troubleshooting, such as force-stopping, updating, or uninstalling a problematic app, without resorting to more drastic measures.

Why this answer

The first step in diagnosing rapid battery drain after an app update is to use the built-in battery usage tool in Android Settings. This tool provides a per-app breakdown of power consumption, allowing the technician to identify which specific app is consuming excessive energy without making invasive changes. Restarting the device already failed to resolve the issue, so checking battery stats is the logical next step before any destructive or restrictive actions.

Exam trap

CompTIA often tests the principle of 'least invasive first' in troubleshooting, and the trap here is that candidates may jump to a factory reset (Option A) as a quick fix, overlooking the simple diagnostic step of checking battery usage statistics that directly pinpoints the problematic app.

How to eliminate wrong answers

Option A is wrong because performing a factory reset is a drastic, data-destructive step that should only be considered after all non-destructive diagnostics have failed; it does not help identify the root cause and may unnecessarily erase user data. Option C is wrong because replacing the battery immediately assumes the hardware is faulty, but the problem started after a software update, making a software-related cause far more likely; battery replacement is premature without first verifying app-level power usage. Option D is wrong because disabling all background data is an overly broad and restrictive measure that can break legitimate app functionality; it should only be applied to the specific misbehaving app after identification, not as a blanket solution.

Full explanation →
39
MCQeasy

A small business deploys 20 Android tablets for inventory management. The tablets must remain in a single app (the inventory app) and prevent users from accessing settings or other apps. Which Android feature should you enable to lock the devices into this single-app mode?

A.Enable Guest Mode from the user switcher.
B.Use the Screen Pinning feature in Security settings.
C.Set up a separate user account with restricted profile.
D.Activate Factory Reset Protection (FRP).
AnswerB

Screen Pinning, also known as "Pin windows" or "App pinning," is an Android security feature designed to lock the device to a single application. Once activated, the user cannot exit the pinned application, access other apps, or navigate to system settings without first entering a predefined PIN, pattern, or password. This mechanism effectively prevents unauthorized users from accessing sensitive device functions or other applications, making it ideal for dedicated-purpose devices like inventory tablets.

Why this answer

Screen Pinning (option B) is the correct Android feature to lock a device into a single app. When enabled, it prevents users from leaving the pinned app, accessing the home screen, recent apps, or notification shade without entering a PIN or password. This is ideal for kiosk-mode deployments like inventory management tablets, as it restricts the device to exactly one application.

Exam trap

The trap here is that candidates confuse 'restricted profiles' (which limit app access but still allow app switching) with 'screen pinning' (which truly locks the device to one app), leading them to select option C instead of the correct B.

How to eliminate wrong answers

Option A is wrong because Guest Mode creates a temporary user account with its own apps and settings, but it does not lock the device to a single app; the guest can still navigate to other apps or system settings. Option C is wrong because a restricted profile limits which apps a secondary user can access, but it still allows the user to switch between permitted apps and access system UI elements like the status bar; it does not enforce single-app confinement. Option D is wrong because Factory Reset Protection (FRP) is a security feature that prevents unauthorized use of a device after a factory reset by requiring the previous Google account credentials; it has no function for locking the device into a single app during normal operation.

Full explanation →
40
MCQmedium

A user reports that their Windows 10 laptop suddenly shows a black screen with a movable mouse cursor after logging in. They can press Ctrl+Alt+Del to open the security screen. Which troubleshooting step should you perform first to restore the desktop?

A.Boot into Safe Mode and run System File Checker (sfc /scannow).
B.Press Ctrl+Alt+Del, open Task Manager, then run a new task and type 'explorer.exe'.
C.Perform a system restore to a point before the issue started.
D.Check the display driver by pressing Windows+P and switching display modes.
AnswerB

The 'explorer.exe' process is the core Windows shell, responsible for rendering the desktop, taskbar, and file explorer windows. When a user encounters a black screen with a movable cursor but can access the Ctrl+Alt+Del security screen, it indicates that the operating system kernel is functional, but the shell has failed to launch or has crashed. Manually launching 'explorer.exe' via Task Manager effectively restarts this critical process, often restoring the graphical user interface without requiring a full system reboot or more invasive troubleshooting steps.

Why this answer

A black screen with a cursor after login often indicates that the Windows Explorer shell (explorer.exe) has crashed or is not starting properly. Using Task Manager to manually restart the explorer.exe process is a quick and non-destructive first step that often resolves the issue without rebooting.

Full explanation →
41
MCQeasy

A user calls the help desk saying their PC suddenly displays a ransom note demanding payment in Bitcoin to unlock their files. They cannot open any documents or images. What is the first action you should take?

A.Pay the ransom to get the decryption key.
B.Run a full antivirus scan immediately.
C.Disconnect the PC from the network.
D.Restore files from a recent backup without disconnecting.
AnswerC

Disconnecting the PC from the network is the critical first step to contain a ransomware infection. This action immediately prevents the ransomware from encrypting shared network drives, cloud storage, or other network-accessible resources. It also severs communication with the attacker's command and control (C2) server, stopping further instructions or data exfiltration, thereby limiting the scope of damage to the infected machine itself.

Why this answer

The correct first action is to disconnect the PC from the network (Option C). This immediately isolates the infected system, preventing the ransomware from communicating with its command-and-control (C2) server to exfiltrate data or encrypt additional network shares. It also stops the ransomware from spreading laterally to other devices on the same LAN, which is critical for containment before any remediation steps are taken.

Exam trap

CompTIA often tests the principle of 'containment before eradication' — the trap here is that candidates may jump to scanning (Option B) or backup restoration (Option D) without first isolating the system, which would allow the ransomware to continue spreading or re-encrypting files during those actions.

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee you will receive a working decryption key, and it encourages further criminal activity; law enforcement and security best practices strongly advise against paying. Option B is wrong because running a full antivirus scan while the PC is still connected to the network allows the ransomware to continue communicating with its C2 server and potentially encrypt more files or spread to other systems; containment must come first. Option D is wrong because restoring files from a backup without first disconnecting the network risks re-infection if the backup media is still accessible over the network or if the ransomware is still active and can immediately re-encrypt the restored files.

Full explanation →
42
MCQhard

A technician is investigating a computer that has been sending spam emails from the user's account without their knowledge. The user has not installed any new software recently. The technician finds a process running that matches a known botnet client. Which two steps should the technician take first to mitigate the threat?

A.Disconnect the computer from the network and terminate the malicious process.
B.Run a full antivirus scan and then update the firewall rules.
C.Change the user's email password and run a malware scan.
D.Reboot the computer into Safe Mode and then run a scan.
AnswerA

This is the correct initial response to an active botnet infection. Disconnecting the computer from the network immediately severs its communication with the botnet's command-and-control (C2) server, preventing it from receiving further instructions or participating in malicious activities like sending spam. Concurrently, terminating the malicious process halts the immediate execution of the malware on the system, mitigating ongoing resource consumption and preventing further damage. This two-pronged approach prioritizes immediate containment and neutralization of the active threat.

Why this answer

The immediate priority is to disconnect the computer from the network to stop the botnet communication and prevent further spam. Then, the technician should identify and terminate the malicious process. Scanning without disconnecting may allow continued data exfiltration.

Full explanation →
43
MCQhard

A malicious script is suspected to have changed permissions on critical system files. The administrator needs to restore the /etc/passwd file to its default permissions, which are 644. The file is currently 777. Which command will set the correct permissions?

A.chmod 644 /etc/passwd
B.chmod 600 /etc/passwd
C.chmod 755 /etc/passwd
D.chmod 444 /etc/passwd
AnswerA

This command correctly sets the permissions for /etc/passwd. The `6` grants read and write access to the owner (typically root), while the first `4` grants read-only access to the group, and the second `4` grants read-only access to others. This configuration is the secure default, allowing system processes and users to read necessary account information without permitting unauthorized modifications, which is crucial for system functionality and security.

Why this answer

Chmod 644 /etc/passwd sets the permissions to rw-r--r--, which is the standard for /etc/passwd. This removes the world-writable and executable bits.

Full explanation →
44
MCQeasy

A company policy requires that all USB flash drives be automatically scanned for malware when inserted. Which Windows security setting should be configured to enforce this?

A.Enable Windows Defender Real-time Protection
B.Configure BitLocker To Go
C.Enable Windows Firewall
D.Set User Account Control to Always Notify
AnswerA

Windows Defender Real-time Protection actively monitors file system activity, including the insertion of removable media like USB flash drives. Upon detection of a new drive or file access, it automatically scans for known malware signatures and suspicious behaviors using heuristic analysis. This immediate scanning capability is crucial for preventing the introduction of malicious software from external sources into the company's systems, directly addressing the policy requirement.

Why this answer

Windows Defender Real-time Protection (now part of Microsoft Defender Antivirus) automatically scans removable media, including USB flash drives, for malware upon insertion. This setting enforces the company policy by ensuring that any file accessed or executed from the drive is checked against known threat signatures in real time, without requiring manual scans.

Exam trap

The trap here is that candidates confuse encryption (BitLocker To Go) with malware scanning, or assume that network firewalls or UAC can protect against threats introduced via removable media, when only real-time antimalware scanning directly addresses the policy requirement.

How to eliminate wrong answers

Option B is wrong because BitLocker To Go provides encryption for USB drives to protect data at rest, not malware scanning. Option C is wrong because Windows Firewall controls network traffic based on rules and does not scan local storage devices for malware. Option D is wrong because User Account Control (UAC) prompts for administrative consent before system changes but does not perform any malware detection or scanning of inserted media.

Full explanation →
45
MCQmedium

A user on a Windows 10 computer is unable to install a new application because they receive an error that 'Windows cannot verify the publisher of this driver software.' The application is from a trusted vendor. Which tool should you use to temporarily disable driver signature enforcement to complete the installation?

A.Device Manager
B.System Configuration (msconfig)
C.Advanced Startup Options (Disable driver signature enforcement)
D.Command Prompt with bcdedit /set testsigning on
AnswerC

The 'Disable driver signature enforcement' option, found within the Windows Recovery Environment's Advanced Startup Options, is specifically designed for troubleshooting scenarios where a legitimate but unsigned driver needs to be installed. Selecting this option allows the system to boot temporarily with driver signature enforcement disabled for that single startup session, enabling the installation of the problematic driver without permanent security compromises. This targeted approach provides a safe and effective method to address driver installation issues without weakening overall system integrity.

Why this answer

The error 'Windows cannot verify the publisher of this driver software' indicates that the driver lacks a valid digital signature, which is required by default on 64-bit Windows 10. The Advanced Startup Options menu provides a direct way to boot with 'Disable driver signature enforcement' temporarily, allowing the unsigned driver to load for the current session without permanently altering the system's security policy.

Exam trap

The trap here is that candidates often confuse 'bcdedit /set testsigning on' (which permanently enables test-signed drivers) with the temporary disable option in Advanced Startup Options, or they mistakenly think Device Manager or msconfig can override driver signature enforcement at the boot level.

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware devices and update drivers, but it cannot bypass driver signature enforcement; it will still block installation of an unsigned driver. Option B is wrong because System Configuration (msconfig) is used to configure boot options like safe mode or startup services, but it does not have a built-in setting to disable driver signature enforcement; you would need to use Advanced Startup Options or a command-line tool. Option D is wrong because 'bcdedit /set testsigning on' enables Test Signing mode, which permanently allows unsigned drivers to load, but this is a persistent change that weakens security and is not intended for a one-time installation; it also requires a reboot and leaves the system in a less secure state.

Full explanation →
46
MCQeasy

A small business owner wants to allow a remote employee to access their office desktop from home, but is concerned about security. They currently have a standard router with a public IP. Which of the following is the most secure method to enable this access?

A.Enable port forwarding on the router for TCP 3389 to the desktop's IP address.
B.Configure a VPN server on the office network and have the employee connect via VPN before using RDP.
C.Use a third-party remote desktop service like TeamViewer without additional configuration.
D.Change the RDP port to a non-standard port number and enable port forwarding.
AnswerB

Configuring a Virtual Private Network (VPN) server establishes an encrypted tunnel between the remote employee's device and the office network. This requires the employee to authenticate to the VPN server first, effectively placing their device *inside* the office network virtually. Only then can RDP traffic traverse the secure, authenticated tunnel, preventing direct exposure of RDP to the public internet and significantly enhancing security.

Why this answer

Exposing RDP directly to the internet is risky due to brute-force attacks. A VPN creates an encrypted tunnel, authenticating the user before allowing access to the internal network, making it far more secure. This is the recommended best practice.

Full explanation →
47
MCQeasy

A company uses a cloud-based SaaS application for customer relationship management (CRM). Several employees report that they cannot access the CRM this morning, but internet connectivity is working. The IT support team checks the cloud provider's status page and finds no reported outages. What should the technician check next?

A.Verify that the DNS server is resolving the CRM URL correctly.
B.Check if the users' accounts have expired or if passwords need to be reset.
C.Reboot the company's firewall to clear any temporary blocks.
D.Reinstall the CRM application on the affected workstations.
AnswerB

Individual user access issues to a SaaS application are frequently attributed to account-specific problems. This includes scenarios where a user's password has expired according to organizational policy, the account has been locked due to multiple failed login attempts, or the account itself has been disabled. These are common administrative tasks that directly affect only specific users, aligning with the problem description.

Why this answer

When a cloud service is accessible to some but not others, the issue is often local authentication or configuration. Expired credentials or browser cache problems are common causes. The cloud provider's status page shows no outage, so the issue is likely client-side.

DNS and firewall settings would affect all users if misconfigured.

Full explanation →
48
MCQhard

A security incident has occurred: a user's Mac running macOS Ventura was infected with malware that modified system files. The technician needs to boot the Mac into a mode that loads only essential Apple-signed kernel extensions and prevents third-party software from loading, in order to safely remove the malware. Which startup mode should they use?

A.Single-user mode (Command + S).
B.Verbose mode (Command + V).
C.Safe Mode (Shift key during startup).
D.Target Disk Mode (T key).
AnswerC

Safe Mode is specifically designed to isolate system issues by loading only essential macOS components and disabling all non-Apple kernel extensions, startup items, and login items. This creates a clean, minimal environment where malware, which often relies on these non-essential components, is prevented from loading or executing, making it an ideal state for diagnosis and removal during a security incident. Additionally, it performs a basic check of the startup disk for errors.

Why this answer

Safe Mode (Shift key during startup) is correct because it forces macOS to load only essential kernel extensions that are signed by Apple, disables all third-party startup items and login items, and runs a directory integrity check. This minimal environment prevents the malware from loading its own kernel extensions or other malicious code, allowing the technician to safely remove the infected files without interference.

Exam trap

The 220-1202 exam often tests the distinction between startup modes that change the boot environment (Safe Mode) versus those that only alter the user interface or provide diagnostic output (Verbose, Single-user), leading candidates to mistakenly choose Single-user mode for malware removal when it does not restrict third-party kernel extensions.

How to eliminate wrong answers

Option A is wrong because Single-user mode (Command + S) boots into a command-line interface as root without the GUI, but it does not restrict kernel extension loading—third-party kexts can still be loaded, and the malware may already be active in the kernel space. Option B is wrong because Verbose mode (Command + V) merely displays detailed boot logs on screen; it does not disable third-party software or kernel extensions, so the malware would still load normally. Option D is wrong because Target Disk Mode (T key) turns the Mac into an external disk for file transfer over Thunderbolt or FireWire; it does not provide a secure environment for malware removal and does not prevent the malware from executing on the host system.

Full explanation →
49
MCQmedium

A technician is setting up remote access for a salesperson who frequently works from coffee shops. The company uses a VPN with two-factor authentication (2FA). The salesperson reports that after entering their username and password, they receive a prompt for a code but do not have their token. What should the technician do to resolve this?

A.Disable two-factor authentication for the user's account temporarily.
B.Provide the user with a one-time bypass code from the administrator console.
C.Instruct the user to reset their password and try again.
D.Ask the user to connect from a different network location.
AnswerB

Providing a user with a one-time bypass code from the administrator console is the most secure and appropriate solution when a user cannot access their two-factor authentication token. These codes are specifically designed to grant temporary access, typically for a single login session or a short duration, without permanently disabling the security measure. This method allows the user to regain access while maintaining the integrity of the 2FA system and minimizing the overall security risk.

Why this answer

This scenario tests knowledge of 2FA troubleshooting. The user has a token but does not have it available. The correct action is to provide a temporary bypass code, which is a standard feature of 2FA systems for such situations.

Disabling 2FA would weaken security, and other options are not appropriate.

Full explanation →
50
MCQmedium

During a security audit, a technician discovers that an employee's company-issued iPhone has been jailbroken. The employee claims they only did it to customize the home screen. Which security risk is most directly associated with a jailbroken device in a corporate environment?

A.The device cannot receive iOS updates.
B.It voids the warranty.
C.It bypasses app sandbox restrictions, potentially exposing corporate data.
D.The device will perform slower.
AnswerC

App sandboxing is a fundamental iOS security feature that isolates each application's data and processes from others, preventing unauthorized access or interference. Jailbreaking disables or bypasses these critical sandbox restrictions, allowing malicious or poorly coded applications to access sensitive corporate data stored by other legitimate apps, such as email clients or document management systems. This direct compromise of data isolation creates a severe risk of data leakage and unauthorized access to confidential information.

Why this answer

Jailbreaking removes the iOS sandbox restrictions that normally isolate each app's data and prevent unauthorized access to the file system. Without these restrictions, a malicious or compromised app on the jailbroken device can read, copy, or exfiltrate corporate data stored by other apps (e.g., email, VPN certificates, MDM profiles), directly violating data confidentiality in a corporate environment.

Exam trap

The trap here is that candidates focus on the employee's stated reason (customization) and mistakenly choose a non-security answer like 'voids warranty' or 'slower performance,' overlooking the fundamental security principle that jailbreaking breaks app isolation and exposes corporate data.

How to eliminate wrong answers

Option A is wrong because jailbroken devices can still receive iOS updates, though they often break the jailbreak; the primary security risk is not the inability to update but the bypass of sandbox restrictions. Option B is wrong because voiding the warranty is a legal/contractual issue, not a direct security risk to corporate data. Option D is wrong because performance degradation is not a guaranteed or primary security concern; the core risk is the loss of app isolation and data protection.

Full explanation →
51
MCQmedium

A user reports that their MacBook Pro running macOS Big Sur will not boot past the Apple logo. You suspect a corrupted system file. You need to boot into a special mode to run Disk Utility's First Aid on the startup volume. Which key combination should you hold during startup?

A.Hold the Option (⌥) key.
B.Hold Command (⌘) + R.
C.Hold the Shift key.
D.Hold Command (⌘) + Option (⌥) + P + R.
AnswerB

Holding Command (⌘) + R during startup boots the MacBook Pro into macOS Recovery mode, which loads a minimal macOS environment from a dedicated recovery partition. This environment provides essential utilities, including Disk Utility, which is crucial for diagnosing and repairing file system errors or disk corruption using its First Aid feature. This is the appropriate first step for troubleshooting a system that hangs at the Apple logo due to potential disk issues.

Why this answer

Holding Command (⌘) + R during startup boots macOS into the built-in macOS Recovery system, which includes Disk Utility. From there, you can run First Aid on the startup volume to repair a corrupted system file. This is the standard recovery mode for Intel-based Macs running macOS Big Sur.

Exam trap

The CompTIA A+ exam often tests the distinction between recovery modes (Command+R) and other startup key combinations (like Option for Startup Manager or Shift for Safe Mode), expecting candidates to confuse the purpose of each key combination.

How to eliminate wrong answers

Option A is wrong because holding the Option (⌥) key boots into the Startup Manager, which lets you select a different startup disk, not a recovery environment. Option C is wrong because holding the Shift key boots into Safe Mode, which disables non-essential kernel extensions and login items but does not provide Disk Utility or First Aid for repairing system files. Option D is wrong because holding Command (⌘) + Option (⌥) + P + R resets the NVRAM/PRAM (non-volatile random-access memory/parameter RAM), which clears certain hardware settings but does not load a recovery environment or allow disk repair.

Full explanation →
52
MCQmedium

A user reports that their computer is displaying a message claiming their files are encrypted and they must pay 0.5 Bitcoin to a specific address to regain access. The user cannot open any documents or photos. What is the first step the technician should take to respond to this incident?

A.Pay the ransom to recover the files immediately.
B.Disconnect the computer from the network.
C.Run a full antivirus scan to remove the malware.
D.Reboot the computer into Safe Mode.
AnswerB

Immediately disconnecting the infected computer from all network connections, including both wired Ethernet and Wi-Fi, is the most critical initial step in ransomware containment. This action prevents the malware from propagating to other network shares, connected devices, or servers, thereby limiting the scope of the attack. It also stops any potential data exfiltration attempts, safeguarding additional organizational assets and preventing further compromise.

Why this answer

The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Attempting to decrypt without tools or paying the ransom are not recommended initial actions.

Full explanation →
53
MCQmedium

A non-profit organization is upgrading its computers and wants to donate the old ones to a local school. The HDDs contain donor information that must be kept confidential. The organization wants the drives to be reusable. Which method should be used?

A.Use a degausser to erase the drives.
B.Physically drill holes through the drive platters.
C.Perform a full overwrite with zeros using disk-wiping software.
D.Delete all files and empty the recycle bin.
AnswerC

Performing a full overwrite with zeros using specialized disk-wiping software systematically writes a pattern of zeros across every sector of the hard drive. This process effectively obliterates any previous data remnants, making them unrecoverable by standard or even advanced forensic methods. Crucially, this method ensures complete data sanitization while leaving the drive fully functional and ready for reformatting and reuse by the recipient organization.

Why this answer

Performing a full overwrite with zeros using disk-wiping software ensures that all data on the HDDs is irrecoverably destroyed while leaving the drives functional for reuse. This method meets the organization's need for confidentiality (donor information) and reusability, as it overwrites every sector of the drive, including hidden areas like the HPA and DCO, with a known pattern (e.g., zeros or random data), making data recovery infeasible with standard tools.

Exam trap

A+ often tests the misconception that deleting files or using a degausser is sufficient for data confidentiality while maintaining reusability, but degaussing destroys the drive's functionality and deleting files leaves recoverable data, so candidates must recognize that only a full overwrite balances security and reuse.

How to eliminate wrong answers

Option A is wrong because using a degausser exposes the drives to a strong magnetic field that destroys the servo tracks and low-level formatting, rendering the HDDs completely unusable and non-reusable, which contradicts the requirement for reusability. Option B is wrong because physically drilling holes through the drive platters destroys the platters and makes the drives non-functional, preventing reuse; this method is appropriate only for physical destruction, not for drives that need to be repurposed. Option D is wrong because deleting files and emptying the recycle bin only removes file system pointers, leaving the actual data intact on the platters; the data can be easily recovered using file recovery software, failing to ensure confidentiality.

Full explanation →
54
MCQhard

A company uses a web application for internal communication. A security audit reveals that the application is vulnerable to cross-site scripting (XSS). Which browser security feature can help mitigate the risk for users while the application is being patched?

A.Enable pop-up blocker
B.Configure the browser to use a proxy server
C.Implement Content Security Policy (CSP) headers on the web server
D.Disable JavaScript in the browser
AnswerC

Content Security Policy (CSP) is a powerful security mechanism implemented via HTTP response headers that allows the web server to explicitly define which sources of content (scripts, stylesheets, images, etc.) are permitted to load and execute on a given web page. By establishing a strict CSP, the browser will block any scripts originating from unauthorized domains or any inline scripts not explicitly allowed, effectively preventing the execution of maliciously injected scripts and significantly mitigating Cross-Site Scripting (XSS) vulnerabilities.

Why this answer

Content Security Policy (CSP) is a browser security mechanism that allows a web server to specify which sources of content (scripts, styles, images, etc.) are trusted. By implementing CSP headers (e.g., Content-Security-Policy: script-src 'self'), the server instructs the browser to block inline scripts and other potentially malicious content, effectively mitigating XSS attacks even before the application code is patched. CSP operates as a defense-in-depth layer that the browser enforces, reducing the attack surface for users.

Exam trap

Many candidates for the CompTIA A+ exam mistakenly think disabling JavaScript is a viable XSS mitigation, but the trap is that this breaks application functionality and is not a selective security control, whereas CSP provides granular control over script execution without disabling all JavaScript.

How to eliminate wrong answers

Option A is wrong because a pop-up blocker only prevents unwanted pop-up windows; it does not inspect or block malicious scripts injected into the page, so it cannot mitigate XSS. Option B is wrong because configuring a proxy server changes how HTTP requests are routed but does not alter the browser's execution of scripts or enforce content restrictions; a proxy cannot prevent the browser from running injected JavaScript. Option D is wrong because disabling JavaScript entirely would break the web application's core functionality (since it is a web application for internal communication, likely relying on JavaScript), and it is not a practical or selective mitigation; CSP allows JavaScript to run from trusted sources while blocking malicious scripts, whereas disabling JavaScript is a blunt, non-selective approach.

Full explanation →
55
MCQmedium

A technician is configuring a new workstation for an executive who requested specific software. The executive's assistant says the executive is very busy and wants the setup done quickly without any questions. What is the most professional response?

A.Proceed with the installation as requested to respect the executive's time.
B.Ask the assistant to confirm the exact software list and any version requirements before starting.
C.Install the software that is most commonly used by other executives.
D.Tell the assistant that you cannot proceed without talking to the executive directly.
AnswerB

This is the most professional and technically responsible course of action. By requesting a precise software list, including specific versions and any licensing details, the technician ensures that the workstation is configured exactly to the executive's operational needs. This proactive verification prevents costly rework, minimizes potential compatibility conflicts, and demonstrates a commitment to accuracy and efficient resource deployment, aligning with best practices for system configuration.

Why this answer

It demonstrates professional due diligence: confirming the exact software list and version requirements prevents misconfigurations that could waste the executive's time later. A technician must verify requirements before installation to avoid compatibility issues or missing critical features, which is a core communication skill in the CompTIA A+ 220-1202 domain.

Exam trap

The trap here is that candidates may assume 'respecting time' means immediate action (Option A), but CompTIA tests that professionalism requires verification to prevent costly errors, not blind compliance.

How to eliminate wrong answers

Option A is wrong because proceeding without verification risks installing incorrect software versions or missing dependencies, leading to rework and wasted time. Option C is wrong because assuming 'most commonly used' software may not meet the executive's specific needs, causing functionality gaps and potential security issues. Option D is wrong because refusing to proceed without direct executive contact is overly rigid and unprofessional; the assistant is a valid point of contact for initial coordination.

Full explanation →
56
MCQhard

A user reports that they can no longer access the internet after installing a new software application. The technician suspects the application modified system settings. Which security feature could have prevented this?

A.Windows Defender Firewall
B.User Account Control (UAC)
C.BitLocker Drive Encryption
D.Windows Defender Antivirus
AnswerB

User Account Control (UAC) is a critical security feature in Windows designed to prevent unauthorized changes to the operating system. It prompts users for explicit administrative approval before any application or user attempts to make significant system-wide modifications, such as installing software, changing system settings, or altering critical files. This mechanism ensures that even administrators run with standard user privileges by default, requiring elevation for high-impact actions.

Why this answer

User Account Control (UAC) is the correct answer because it is specifically designed to prevent unauthorized changes to system settings by prompting for administrator approval before allowing software to make modifications that affect system-wide configurations, such as network or security settings. When a new application attempts to modify system settings (e.g., proxy, DNS, or firewall rules) without explicit consent, UAC can block or require elevation, thus preventing the reported internet access issue. This aligns with the scenario where the technician suspects the application altered system settings, as UAC directly controls privilege escalation for such actions.

Exam trap

CompTIA A+ exams often test the misconception that a firewall (Option A) can prevent unauthorized system modifications, but the trap here is that firewalls only control network traffic, not local system setting changes, which is a distinct security function handled by UAC.

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall is a host-based packet filter that controls inbound and outbound network traffic based on rules, but it does not prevent software from modifying system settings like proxy or DNS configurations; it only blocks or allows network connections. Option C is wrong because BitLocker Drive Encryption is a full-disk encryption feature that protects data at rest by encrypting the entire drive, but it has no mechanism to prevent software from altering system settings or network configurations. Option D is wrong because Windows Defender Antivirus is a malware detection and removal tool that scans for known malicious signatures and behaviors, but it does not inherently block legitimate software from changing system settings unless the change is identified as malicious by heuristic analysis, which is not guaranteed for non-malicious applications.

Full explanation →
57
MCQmedium

A client wants to upgrade their entire office of 50 computers and asks for advice on environmentally friendly disposal of the old units. Which approach best aligns with environmental best practices?

A.Donate the computers to a local school without wiping data.
B.Sell the computers to a scrap metal dealer.
C.Contract a certified e-waste recycling company to handle the disposal.
D.Have employees take the computers home for personal use.
AnswerC

Contracting a certified e-waste recycling company ensures adherence to stringent industry standards, such as R2 or e-Stewards, for secure data destruction and environmentally responsible material recovery. These companies employ specialized processes to dismantle equipment, safely extract hazardous components, and recycle valuable materials, minimizing environmental pollution and ensuring compliance with data privacy laws. This approach provides a verifiable chain of custody for all assets.

Why this answer

Certified e-waste recycling companies follow strict environmental regulations (e.g., the Basel Convention and local e-waste laws) to ensure hazardous materials like lead, mercury, and cadmium are safely extracted and disposed of, while also securely destroying data through methods such as degaussing or physical shredding. This approach minimizes environmental harm and aligns with the EPA's recommended practices for responsible electronics recycling.

Exam trap

CompTIA often tests the misconception that donation or reuse is always the greenest option, but the trap here is that environmental best practices require both secure data destruction and proper hazardous material handling, which only a certified e-waste recycler guarantees.

How to eliminate wrong answers

Option A is wrong because donating computers without wiping data violates data privacy best practices and could expose sensitive company information, even if the intent is reuse. Option B is wrong because selling computers to a scrap metal dealer typically bypasses proper hazardous material handling, leading to toxic components like CRT glass or lithium batteries ending up in landfills or being processed unsafely. Option D is wrong because allowing employees to take computers home for personal use does not guarantee environmentally sound disposal and often results in devices being discarded improperly later, without any certified recycling process.

Full explanation →
58
MCQeasy

A user reports that their Windows 10 PC is running slowly after they installed a new program. You need to identify which service or startup program is consuming the most CPU resources to troubleshoot the issue. Which administrative tool should you use?

A.Event Viewer
B.Task Manager
C.Services.msc
D.Performance Monitor
AnswerB

Task Manager is the definitive Windows utility for real-time system monitoring and process management, making it ideal for diagnosing high CPU usage. Specifically, its "Processes" or "Details" tab provides a dynamic, sortable list of all running applications and background processes, clearly displaying their current CPU, memory, disk, and network utilization. This direct visibility allows a technician to quickly identify which specific process is causing excessive CPU usage and impacting overall system performance.

Why this answer

Task Manager provides real-time performance monitoring, including CPU usage per process. This makes it the ideal tool for quickly identifying resource hogs. Other tools like Event Viewer or Services.msc are for different purposes.

Full explanation →
59
MCQeasy

A user reports that their Android phone will not connect to their corporate Wi-Fi network, but other devices connect fine. They have forgotten the network and re-entered the password, but it still fails. What should you check first?

A.Check if the router is using MAC address filtering.
B.Verify the Wi-Fi password is being entered correctly.
C.Reset the phone's network settings to default.
D.Update the phone's operating system to the latest version.
AnswerB

Incorrectly entering the Wi-Fi password is the most frequent cause of connection failures for wireless devices. Wireless networks, especially those secured with WPA2/WPA3-Personal, rely on a pre-shared key (PSK) for authentication. A single typo, incorrect capitalization, or an extra space will result in an authentication failure, preventing the Android phone from associating with the access point and obtaining an IP address. This simple verification should always be the initial troubleshooting step before investigating more complex network or device-specific issues.

Why this answer

The most common cause of a single device failing to connect after forgetting and re-entering the network is a typo or case-sensitive error in the Wi-Fi password. Since other devices connect fine, the issue is isolated to the phone, and verifying the password is the quickest, least intrusive step before escalating to more complex troubleshooting.

Exam trap

CompTIA often tests the candidate's ability to follow a logical troubleshooting methodology (OSI model layer by layer), and the trap here is that many candidates jump to advanced settings like MAC filtering or network resets instead of starting with the most basic, user-error-prone step of verifying the password.

How to eliminate wrong answers

Option A is wrong because MAC address filtering would affect all devices not on the allowlist, not just this one phone; since other devices connect fine, the router is not blocking this phone by MAC. Option C is wrong because resetting network settings is a drastic step that should only be taken after simpler checks like password verification, and it would erase saved Wi-Fi networks, Bluetooth pairings, and VPN configurations unnecessarily. Option D is wrong because an OS update is a time-consuming, system-level change that addresses bugs or security flaws, not a password entry issue; the phone's current OS version is unlikely to prevent connection if the password is correct.

Full explanation →
60
MCQhard

A user's Windows 10 PC is experiencing random freezes and application crashes. You suspect a corrupted system file. You run sfc /scannow but it reports that it cannot repair some files. What is the next best step to repair the system files using a DISM command?

A.Run chkdsk /f
B.Run DISM /Online /Cleanup-Image /RestoreHealth
C.Run System Restore
D.Run Windows Update
AnswerB

The DISM /Online /Cleanup-Image /RestoreHealth command is the correct solution because it scans the Windows component store for corruption and repairs it using healthy files from Windows Update or a specified source. This process ensures the integrity of the system image, which is crucial for the proper functioning of system files and often resolves deep-seated instability like random freezes. Repairing the component store also enables the System File Checker (sfc /scannow) to successfully replace corrupted system files.

Why this answer

The correct next step is to run DISM /Online /Cleanup-Image /RestoreHealth because SFC (System File Checker) relies on a healthy component store (WinSxS) to replace corrupted files. When SFC cannot repair files, it indicates the component store itself may be damaged. DISM repairs the component store by using Windows Update as the source, or a specified repair source, thereby enabling SFC to succeed on a subsequent scan.

Exam trap

The trap here is that candidates often assume SFC is the ultimate repair tool and overlook that DISM must fix the underlying component store first, leading them to choose chkdsk or System Restore as a quick fix.

How to eliminate wrong answers

Option A is wrong because chkdsk /f checks and repairs file system integrity and disk errors, not system file corruption; it addresses issues like bad sectors or MFT corruption, not the Windows component store. Option C is wrong because System Restore reverts system files and registry settings to a previous restore point, but it does not directly repair the component store or replace corrupted system files from a known good source; it may also fail if the restore point itself is corrupted. Option D is wrong because Windows Update installs updates and patches but does not repair existing corrupted system files in the component store; DISM is the tool designed for that purpose.

Full explanation →
61
MCQhard

A user reports that their iPhone's flashlight is not working, and the camera app shows a black screen. Other apps function normally. The device is up-to-date and has been restarted. What is the most likely hardware-related issue?

A.The battery is failing and cannot provide enough power.
B.The camera app is corrupted; reinstall it.
C.The camera module or its flex cable is damaged.
D.The iOS has a bug that affects the camera and flashlight.
AnswerC

On iPhones, the LED flash (flashlight) is physically integrated into the rear camera module assembly or connected via the same delicate flex cable. Therefore, physical damage to the camera module itself, or a compromised connection via its flex cable to the logic board, would simultaneously disable both the camera's imaging capabilities and the LED flash's illumination function. This common point of failure accurately explains the simultaneous loss of both features.

Why this answer

The simultaneous failure of the flashlight and camera strongly points to a shared hardware component failure. Both the camera module and the LED flash are typically integrated on the same flex cable assembly or share a common power management IC. Since other apps function normally and the device has been restarted, a hardware fault in the camera module or its flex cable is the most likely cause.

Exam trap

CompTIA often tests the concept of shared hardware dependencies, where candidates mistakenly attribute a dual-component failure to a software bug or battery issue instead of recognizing the common physical connection.

How to eliminate wrong answers

Option A is wrong because a failing battery would cause system-wide power issues, not isolate the camera and flashlight; the device would likely show a low-battery warning or shut down under load. Option B is wrong because the camera app is a system app that cannot be reinstalled by the user, and a corrupted app would not affect the flashlight, which is controlled by a separate daemon. Option D is wrong because a software bug affecting both camera and flashlight would typically be patched in an up-to-date iOS version, and a restart would not resolve a persistent hardware fault.

Full explanation →
62
MCQmedium

A user calls the help desk saying that every time they click a link in an email, their browser opens a page that says 'Your computer is infected! Call this number.' They are unable to close the page normally. What type of attack is this, and what is the first step you should take?

A.Phishing attack; immediately change the user's email password
B.Browser hijacker; run a full antivirus scan immediately
C.Tech support scam; force close the browser using Task Manager, then run a security scan
D.Drive-by download; disconnect the computer from the network
AnswerC

This option accurately identifies the threat as a tech support scam, which typically involves displaying a persistent, unclosable browser alert designed to panic the user into calling a fraudulent "support" number. The immediate and effective first step is to force close the browser using Task Manager (Ctrl+Shift+Esc on Windows) to stop the active scam page from locking the browser. Subsequently, running a comprehensive security scan is crucial to detect and remove any underlying malware or adware that might have facilitated the scam page's appearance.

Why this answer

This is a tech support scam using a social engineering tactic to frighten the user. The correct first step is to close the browser forcefully using Task Manager, then run a security scan. This tests the ability to distinguish between different attack types and appropriate response procedures.

Full explanation →
63
MCQhard

A technician is troubleshooting a server that repeatedly trips the circuit breaker in the data center. The server is plugged into a power strip that is also serving two other high-power devices. What is the most appropriate safety and troubleshooting step?

A.Replace the power strip with a higher-rated one and reset the breaker.
B.Move one of the other high-power devices to a different circuit and plug the server directly into a wall outlet on its own circuit.
C.Reset the breaker and use a UPS with a higher wattage rating.
D.Install a larger circuit breaker in the panel to handle the load.
AnswerB

Repeated circuit breaker trips indicate an overload on the circuit. By moving one or more high-power devices to a different electrical circuit, the total current draw on the original circuit is significantly reduced, preventing it from exceeding its rated capacity. Plugging the server directly into a wall outlet on its own dedicated circuit ensures it receives stable power without competing with other heavy loads, resolving the overload issue.

Why this answer

The repeated tripping indicates the circuit is overloaded. The safest and most effective step is to redistribute the load by moving one high-power device to a different circuit and plugging the server directly into a dedicated wall outlet. This isolates the server's power draw and prevents overloading the shared circuit, addressing the root cause without bypassing safety limits.

Exam trap

CompTIA often tests the misconception that upgrading the power strip or breaker is a valid fix, when in fact the correct approach is to redistribute the load to separate circuits to stay within safe electrical limits.

How to eliminate wrong answers

Option A is wrong because replacing the power strip with a higher-rated one does not change the circuit's maximum current capacity (typically 15A or 20A in a data center); the breaker will still trip if the total load exceeds that limit. Option C is wrong because resetting the breaker and using a higher-wattage UPS does not solve the overload; the UPS itself draws power from the same circuit and could still cause tripping if the total load exceeds the breaker rating. Option D is wrong because installing a larger circuit breaker without verifying the wiring gauge and outlet ratings is a fire hazard; the wiring may not be rated for higher current, violating electrical code and safety standards.

Full explanation →
64
MCQmedium

A technician is troubleshooting a Windows 10 computer that exhibits strange behavior: system files are missing, and the computer fails to boot normally. A boot-time virus scan detects a virus that infected the Master Boot Record (MBR). Which tool should the technician use to repair the MBR?

A.System Restore
B.Bootrec.exe /FixMbr
C.SFC /Scannow
D.CHKDSK /F
AnswerB

The Bootrec.exe /FixMbr command is specifically used from the Windows Recovery Environment (WinRE) to write a new Master Boot Record to the system partition without overwriting the existing partition table. This action effectively repairs corruption or damage to the MBR, which is crucial for the system to locate and load the operating system. It is particularly effective against boot sector viruses or other MBR-related boot failures, making the drive bootable again.

Why this answer

The Bootrec.exe /FixMbr command writes a new Master Boot Record (MBR) to the system partition, overwriting the infected boot code without affecting the existing partition table. This is the correct tool for repairing a virus-compromised MBR that prevents normal booting on Windows 10.

Exam trap

The trap here is that candidates confuse SFC /Scannow with a boot repair tool, but SFC only works on the installed OS and cannot touch the MBR, which is outside the file system.

How to eliminate wrong answers

Option A is wrong because System Restore restores system files and registry settings from a restore point, but it does not repair the MBR, which resides outside the file system in the first sector of the disk. Option C is wrong because SFC /Scannow scans and repairs protected system files within the Windows installation, but it cannot fix the MBR, which is a low-level boot structure not managed by the Windows File Protection mechanism. Option D is wrong because CHKDSK /F checks the file system integrity and fixes logical errors on the disk volume, but it does not write or repair the MBR boot code.

Full explanation →
65
MCQhard

A user reports that their Windows 10 PC suddenly shows a 'Your IT administrator has limited access' message when trying to change the desktop background. The user has local administrator rights. Which Group Policy or registry setting is most likely misconfigured?

A.The 'Prevent changing desktop background' policy is enabled in Local Group Policy.
B.The user's account is not part of the Administrators group.
C.The desktop background file is corrupted.
D.The Windows license has expired.
AnswerA

This is the correct answer. The 'Prevent changing desktop background' policy, found under User Configuration > Administrative Templates > Control Panel > Personalization in the Local Group Policy Editor (gpedit.msc), specifically restricts users from modifying their desktop background. When enabled, this policy overrides any user permissions, including local administrator rights, and typically displays a message indicating that an administrator has disabled the option, directly matching the reported symptom.

Why this answer

The 'Prevent changing desktop background' policy, when enabled in Local Group Policy Editor (gpedit.msc) under User Configuration > Administrative Templates > Control Panel > Personalization, explicitly blocks background changes regardless of local administrator rights. Since the user has local admin rights but still sees the restriction, this policy is the most likely cause, as it overrides user permissions.

Exam trap

CompTIA often tests the misconception that local administrator rights bypass all Group Policy restrictions, but in reality, many administrative templates apply to all users, including administrators, unless specifically configured otherwise.

How to eliminate wrong answers

Option B is wrong because the user already has local administrator rights, so not being part of the Administrators group is contradictory to the scenario. Option C is wrong because a corrupted background file would cause a display issue (e.g., black screen or error), not a specific 'IT administrator has limited access' message. Option D is wrong because an expired Windows license triggers activation warnings (e.g., 'Windows is not activated') and may disable personalization features, but it does not produce the exact 'Your IT administrator has limited access' message, which is specific to Group Policy restrictions.

Full explanation →
66
MCQhard

A technician is reviewing a PowerShell script that was used in a ransomware attack. The script contains a line that downloads and executes a payload from a remote server. The script uses a technique to bypass execution policy. Which scripting technique is most likely used to bypass the execution policy?

A.Using the 'Set-ExecutionPolicy' cmdlet to change the policy to Unrestricted
B.Using the '-ExecutionPolicy Bypass' parameter when launching PowerShell
C.Using the 'powershell.exe -Command' syntax with an encoded command
D.Signing the script with a self-signed certificate
AnswerB

The '-ExecutionPolicy Bypass' parameter is a highly effective and stealthy method because it overrides the system's execution policy for the current PowerShell session only. This means the script can execute without requiring administrative privileges to alter system settings or leaving a permanent change on the system. It's a preferred technique for attackers as it allows immediate script execution without triggering system-wide security alerts or leaving persistent forensic artifacts.

Why this answer

The '-ExecutionPolicy Bypass' parameter when launching PowerShell tells the PowerShell engine to bypass the execution policy for that session only, allowing any script to run without restriction. This is a common technique used by attackers because it does not require administrative privileges or permanent policy changes, making it stealthy and effective for executing malicious payloads.

Exam trap

CompTIA often tests the distinction between permanently changing the execution policy (which requires admin rights and is detectable) versus using a session-level parameter to bypass it (which is stealthy and does not require admin rights), leading candidates to mistakenly choose the 'Set-ExecutionPolicy' option.

How to eliminate wrong answers

Option A is wrong because using the 'Set-ExecutionPolicy' cmdlet to change the policy to Unrestricted requires administrative privileges and leaves a persistent change that can be detected by security tools; it is not a stealthy bypass technique. Option C is wrong because using 'powershell.exe -Command' with an encoded command is a method to obfuscate the command or avoid character restrictions, but it does not bypass the execution policy—if the policy blocks script execution, the encoded command will still be blocked unless the policy is bypassed separately. Option D is wrong because signing the script with a self-signed certificate does not bypass execution policy; it only allows the script to run if the execution policy is set to AllSigned or RemoteSigned and the certificate is trusted, which is not a bypass technique and requires additional configuration.

Full explanation →
67
MCQhard

A technician is troubleshooting a wireless network where users report intermittent connectivity and slow speeds. The network uses WPA2-Enterprise with EAP-TLS and certificate-based authentication. The technician notices that the RADIUS server logs show frequent certificate validation failures. What is the most likely root cause?

A.The access point's firmware is outdated, causing packet loss.
B.The RADIUS server's certificate has expired.
C.Client devices have expired or untrusted certificates.
D.The wireless channel is overlapping with neighboring networks.
AnswerC

When client devices possess expired or untrusted certificates, their authentication attempts against the RADIUS server will intermittently fail. Some authentication protocols, like EAP-TLS, rely on client-side certificates for identity verification. If a client's certificate is no longer valid or not trusted by the authentication server, the connection will be rejected, leading to disconnects and subsequent re-attempts, which aligns with intermittent issues for some users.

Why this answer

The RADIUS server logs show frequent certificate validation failures, which directly points to an issue with the certificates presented by the clients during EAP-TLS authentication. In WPA2-Enterprise with EAP-TLS, both the server and client must present valid certificates; if client certificates are expired or untrusted, the RADIUS server will reject the authentication, causing intermittent connectivity and slow speeds as clients fail to re-authenticate or roam.

Exam trap

The 220-1202 exam often tests the distinction between server-side and client-side certificate issues; the trap here is that candidates may assume the RADIUS server's certificate is the problem (Option B) because it is the central authentication point, but the logs specifically show 'validation failures' which in EAP-TLS typically refer to the client certificate failing validation by the server.

How to eliminate wrong answers

Option A is wrong because outdated access point firmware could cause packet loss or performance issues, but it would not produce certificate validation failures in the RADIUS server logs; certificate errors are specific to the authentication process. Option B is wrong because if the RADIUS server's certificate had expired, clients would fail to validate the server, and the logs would show server certificate errors, not frequent client certificate validation failures; the question states the logs show certificate validation failures, which are client-side. Option D is wrong because overlapping wireless channels cause interference, leading to slow speeds and disconnections, but they do not generate certificate validation failures in RADIUS logs; those logs are authentication-specific.

Full explanation →
68
MCQhard

A security incident occurred where an unauthorized user gained access to a workstation. The security team needs to review detailed logs of all user logon attempts, including successful and failed logins, for the past 48 hours. Which administrative tool and specific log should you access to provide this information?

A.Event Viewer > Windows Logs > System
B.Event Viewer > Windows Logs > Security
C.Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager
D.Computer Management > System Tools > Shared Folders > Sessions
AnswerB

The Security log is the designated repository for audit events on a Windows system, including successful and failed user logon attempts, account management operations, object access, and policy changes. To effectively track an unauthorized user gaining access, administrators would configure audit policies to record these specific security events, making this log crucial for forensic analysis and incident response. This log provides the detailed audit trail necessary to investigate security breaches.

Why this answer

Event Viewer's Windows Logs > Security log records all security-related events, including logon attempts (success and failure). This is the standard location for auditing user activity. Other logs like System or Application do not focus on authentication events.

Full explanation →
69
MCQeasy

A customer complains that their iOS device's screen orientation is stuck in portrait mode and will not rotate to landscape when they turn the phone sideways. What is the most likely cause and solution?

A.Enable Display Zoom in Settings
B.Toggle the Rotation Lock in Control Center
C.Restart the device
D.Adjust the text size in Accessibility
AnswerB

The Rotation Lock feature, accessible via the Control Center on iOS devices, directly controls whether the screen automatically rotates based on the device's physical orientation. When enabled (indicated by a padlock icon), it overrides the accelerometer and gyroscope input, forcing the display into a specific orientation, typically portrait mode. Toggling this setting off releases the lock, allowing the screen to rotate freely according to the device's current physical position, thereby resolving the customer's complaint.

Why this answer

The most likely cause is that the Rotation Lock is enabled, which prevents the iOS device from switching between portrait and landscape orientations. Toggling the Rotation Lock off in Control Center directly resolves this issue, as it is a common user-accessible setting that can be accidentally activated.

Exam trap

The CompTIA A+ exam often tests the distinction between a user-configurable setting (Rotation Lock) and a system-level troubleshooting step (restart), leading candidates to choose the more generic 'Restart the device' option instead of the specific, correct solution.

How to eliminate wrong answers

Option A is wrong because Display Zoom adjusts the overall screen resolution and icon size, not the orientation lock behavior. Option C is wrong because restarting the device is a generic troubleshooting step that does not address the specific setting causing the orientation lock; it would only be effective if the issue were a temporary software glitch, which is less likely than an enabled lock. Option D is wrong because adjusting text size in Accessibility changes font scaling, not the screen rotation functionality.

Full explanation →
70
MCQmedium

A customer reports that their Windows 10 desktop shows a black screen with a movable cursor after logging in. They can press Ctrl+Alt+Del and open Task Manager. Which process should be restarted from Task Manager to restore the desktop and taskbar?

A.Restart the 'Windows Explorer' process in Task Manager.
B.End the 'svchost.exe' process group.
C.Start the 'winlogon.exe' process.
D.Run 'msconfig' from the Run dialog to enable normal startup.
AnswerA

Restarting the 'Windows Explorer' (explorer.exe) process is the correct solution because this process is responsible for rendering the graphical user interface, including the desktop, taskbar, and file management windows. When the desktop appears black but the system is otherwise running, it often indicates that the explorer.exe shell has crashed or become unresponsive. Terminating and then restarting this specific process via Task Manager effectively reloads the entire desktop environment, typically resolving the visual display issue without requiring a full system reboot.

Why this answer

The black screen with a movable cursor after login, combined with the ability to open Task Manager via Ctrl+Alt+Del, indicates that the Windows shell (explorer.exe) has crashed or is not running. Restarting the 'Windows Explorer' process from Task Manager (File > Run new task > 'explorer.exe') reloads the desktop, taskbar, and File Explorer, restoring the graphical user interface. This is the standard recovery step for a missing shell in Windows 10.

Exam trap

The trap here is that candidates confuse the 'Windows Explorer' process with Internet Explorer or assume that 'svchost.exe' is the correct service host to restart, when in fact the shell process (explorer.exe) is the specific component responsible for the desktop and taskbar.

How to eliminate wrong answers

Option B is wrong because ending the 'svchost.exe' process group would terminate critical Windows services (e.g., RPC, DHCP, DNS), potentially causing system instability or a blue screen, not restoring the desktop. Option C is wrong because 'winlogon.exe' is a system process that handles interactive logon and cannot be started manually from Task Manager; it is already running if the user can log in, and restarting it would force a logoff. Option D is wrong because 'msconfig' is a system configuration utility used to change boot options or startup mode, not a tool to restart a crashed shell process; running it from the Run dialog would not fix the immediate black screen issue.

Full explanation →
71
MCQmedium

A technician receives a ticket from a user who says their email is not working. The technician remotely connects and sees that the user's Outlook profile is corrupt. The user is in the middle of an important project. What is the best way to communicate the necessary steps?

A.Explain that the Outlook profile is corrupt and needs to be rebuilt, which may cause a brief interruption.
B.Tell the user that you will fix it and they should not worry about the details.
C.Use technical terms like 'PST file corruption' and 'registry repair' to sound knowledgeable.
D.Rebuild the profile without informing the user to avoid worrying them.
AnswerA

Explaining that the Outlook profile is corrupt and needs to be rebuilt, along with the potential for a brief interruption, is the most professional and effective communication strategy. This approach fosters trust by being transparent about the issue and its resolution, managing the user's expectations regarding downtime. It allows the user to prepare for the interruption, ensuring their workflow is minimally impacted while demonstrating the technician's competence and respect for their time.

Why this answer

It balances transparency with professionalism: the technician clearly explains the issue (corrupt Outlook profile) and the necessary action (rebuild), while proactively managing expectations about a brief interruption. This approach respects the user's need to stay informed during an important project, aligning with ITIL best practices for incident management and user communication.

Exam trap

CompTIA often tests the distinction between technical accuracy and professional communication, trapping candidates who think using technical jargon or acting without consent demonstrates expertise, when in fact the exam emphasizes clear, respectful, and transparent user interaction.

How to eliminate wrong answers

Option B is wrong because it dismisses the user's need for situational awareness; withholding details can erode trust and leave the user unprepared for the interruption. Option C is wrong because using jargon like 'PST file corruption' and 'registry repair' without explanation confuses the user and violates the principle of communicating at the user's technical level. Option D is wrong because rebuilding the profile without informing the user is unethical and unprofessional; it denies the user the opportunity to save work or prepare for downtime, potentially causing data loss or workflow disruption.

Full explanation →
72
MCQmedium

A customer reports that their Windows 11 PC is experiencing intermittent application crashes and you suspect file corruption. You need to run a system file check without using the full Windows interface. Which administrative tool can you launch from the Run dialog to open a command prompt with the necessary permissions?

A.Type 'cmd' in the Run dialog and press Enter
B.Type 'powershell' in the Run dialog and press Enter
C.Type 'cmd' in the Run dialog and press Ctrl+Shift+Enter
D.Type 'msconfig' in the Run dialog and press Enter
AnswerC

Typing 'cmd' in the Run dialog and pressing Ctrl+Shift+Enter is the correct method to launch an elevated command prompt. This key combination specifically triggers the User Account Control (UAC) prompt, requesting administrative consent from the user. An elevated command prompt provides the necessary administrator privileges for the System File Checker (SFC) tool to access and repair protected Windows system files effectively, ensuring a comprehensive scan and restoration process.

Why this answer

Pressing Ctrl+Shift+Enter while typing 'cmd' in the Run dialog launches Command Prompt with administrator privileges, which is required to run the System File Checker (sfc /scannow) to repair file corruption. This bypasses the full Windows interface and provides the necessary elevated permissions.

Exam trap

The 220-1202 exam often tests the distinction between launching a tool with standard permissions versus elevated permissions, and the trap here is that candidates assume typing 'cmd' alone is sufficient, forgetting that administrative tasks like sfc require the Ctrl+Shift+Enter shortcut to run as administrator.

How to eliminate wrong answers

Option A is wrong because typing 'cmd' and pressing Enter opens Command Prompt with standard user permissions, which lacks the administrative rights needed to run sfc /scannow. Option B is wrong because typing 'powershell' and pressing Enter opens PowerShell with standard user permissions, not elevated, and the question specifically asks for a command prompt, not PowerShell. Option D is wrong because 'msconfig' opens the System Configuration utility, which is a graphical tool for boot settings and services, not a command-line interface for running system file checks.

Full explanation →
73
MCQmedium

A customer calls saying that after installing a new printer, their Windows 10 computer now takes much longer to shut down. They have uninstalled the printer software, but the slow shutdown persists. Which tool should you use to identify the cause of the shutdown delay?

A.Task Manager
B.Performance Monitor
C.Event Viewer
D.Disk Cleanup
AnswerC

Event Viewer records system, application, and security logs. During a slow shutdown, the System log often contains warnings or errors from services or drivers that are delaying the process, allowing you to identify the culprit.

Why this answer

Slow shutdowns are often caused by services or drivers that fail to terminate properly. The Event Viewer logs system events, including errors and warnings during shutdown, which can pinpoint the offending component. This is more effective than generic performance monitoring or disk cleanup for this specific issue.

Full explanation →
74
MCQeasy

A client brings in a laptop that was used by an employee who left the company. The manager wants to ensure all data is unrecoverable before recycling the laptop. The laptop has a traditional HDD. Which method should be used?

A.Perform a quick format of the drive.
B.Use a degausser to demagnetize the drive.
C.Run a full overwrite using disk-wiping software.
D.Physically shred the drive with a hard drive shredder.
AnswerC

Running a full overwrite with specialized disk-wiping software systematically writes new data, typically zeros or random patterns, across every sector of the drive. This process ensures that all previous data is completely obliterated and unrecoverable, even with advanced forensic techniques. Crucially, this method allows the drive to be subsequently reformatted and reused, making it an ideal balance between data security and hardware longevity.

Why this answer

Disk-wiping software performs a full overwrite of every sector on the HDD with patterns (e.g., zeros, random data), making the original data unrecoverable even with advanced forensic tools. This method is specifically designed for secure data destruction on functional drives, ensuring compliance with data sanitization standards like NIST SP 800-88.

Exam trap

The A+ exam often tests the misconception that a degausser is the best option for data destruction on HDDs, but candidates forget that degaussing destroys the drive's functionality and is not a secure sanitization method for reuse, whereas disk-wiping software allows the drive to be repurposed while ensuring data is unrecoverable.

How to eliminate wrong answers

Option A is wrong because a quick format only clears the file system metadata (e.g., MFT or FAT) and marks sectors as available, leaving the actual data intact and easily recoverable with tools like Recuva or TestDisk. Option B is wrong because a degausser destroys the magnetic field of the platters, rendering the drive unusable, but it does not guarantee data unrecoverability on modern high-coercivity HDDs and may leave residual data that can be recovered with specialized equipment. Option D is wrong because physically shredding the drive destroys the hardware, making data recovery impossible, but it is an overkill for a functional laptop that the manager may want to reuse or donate; the question asks for a method to ensure data is unrecoverable before recycling, and shredding is a disposal method, not a data sanitization method for reuse.

Full explanation →
75
MCQeasy

A small business is deploying a new time-tracking application to five workstations. The technician needs to ensure the installation is standardized and repeatable. Which documentation should the technician create before starting the deployment?

A.A list of user passwords for the application.
B.A detailed network topology diagram.
C.A step-by-step installation guide with screenshots.
D.A copy of the software license agreement.
AnswerC

A comprehensive step-by-step installation guide, especially when augmented with screenshots, is paramount for ensuring consistent and standardized deployment of a new application across multiple workstations. This document provides clear, unambiguous instructions for technicians, minimizing errors and variations in configuration. It also serves as an invaluable reference for future installations, onboarding new IT staff, and efficient troubleshooting by establishing a known good configuration baseline.

Why this answer

This question focuses on the importance of creating a deployment plan or runbook before performing installations. Standardized documentation ensures consistency and reduces errors across multiple machines.

Full explanation →

Page 1 of 7

Page 2

All pages

1234567

Practice 220-1202 by domain

Target a specific domain to shore up weak areas.

Operating SystemsSecuritySoftware TroubleshootingOperational Procedures
See all domains with question counts →