Courseiva

CompTIA A+ Core 2 220-1202 (220-1202) — Questions 76–150

495 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 7

Page 3
76
MCQmedium

A technician is helping a remote user configure a VPN connection. The user is not very technical and is getting frustrated. The technician uses jargon like 'authentication protocol' and 'tunnel endpoint'. Which of the following is the BEST way to improve communication?

A.Continue using technical terms to educate the user.
B.Ask the user to share their screen so the technician can do it remotely.
C.Use simple analogies like 'a secure tunnel for your data' and guide them step by step.
D.Send the user a written guide and end the call.
AnswerC

Employing simple analogies, such as describing a VPN as 'a secure tunnel for your data,' effectively demystifies complex technical concepts for non-technical users. This approach, combined with clear, step-by-step instructions, empowers the user to actively participate in the configuration process, reducing anxiety and increasing the likelihood of successful completion. It fosters understanding and builds confidence, aligning with best practices for remote technical support.

Why this answer

It replaces confusing jargon with a simple analogy ('secure tunnel') and provides step-by-step guidance, which directly addresses the user's frustration and lack of technical knowledge. This approach aligns with the CompTIA A+ objective of adapting communication style to the audience, ensuring the user understands the VPN concept without needing to know terms like 'authentication protocol' or 'tunnel endpoint'.

Exam trap

CompTIA often tests the trap that candidates think educating the user with technical terms (Option A) is helpful, but the correct approach is to simplify language and use analogies to match the user's skill level, as per CompTIA's emphasis on customer service and effective communication.

How to eliminate wrong answers

Option A is wrong because continuing to use technical terms like 'authentication protocol' and 'tunnel endpoint' will likely increase the user's frustration and confusion, as they are not technical and need simplified explanations, not education on jargon. Option B is wrong because asking the user to share their screen assumes they can navigate the sharing process, which may be as confusing as the VPN setup itself; it also shifts the burden to the user without improving their understanding. Option D is wrong because sending a written guide and ending the call abandons the user, leaving them to struggle alone with technical documentation, which contradicts the goal of providing effective remote support.

Full explanation →
77
MCQmedium

A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?

A.Set the execution policy to Restricted
B.Set the execution policy to AllSigned
C.Set the execution policy to RemoteSigned
D.Disable PowerShell using Group Policy
AnswerB

The `AllSigned` execution policy mandates that all PowerShell scripts, whether created locally or downloaded from the internet, must be digitally signed by a trusted publisher before they can execute. This effectively blocks the unauthorized unsigned script, preventing its execution, while simultaneously permitting legitimate, signed administrative scripts to run. This policy strikes an optimal balance between security and operational functionality by ensuring script integrity and authenticity.

Why this answer

Setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

Exam trap

The trap here is that candidates often confuse RemoteSigned with AllSigned, assuming that blocking internet-sourced scripts is sufficient, but they overlook that locally created unsigned scripts (e.g., written by an attacker after gaining access) remain a threat.

How to eliminate wrong answers

Option A is wrong because setting the execution policy to Restricted prevents all PowerShell scripts from running, which is overly restrictive and would block legitimate administrative scripts, not just unsigned ones. Option C is wrong because RemoteSigned only requires scripts downloaded from the internet to be signed; locally created scripts can run unsigned, leaving a gap for attackers to execute locally crafted malicious scripts. Option D is wrong because disabling PowerShell entirely via Group Policy is a heavy-handed approach that breaks legitimate administrative tasks and automation, whereas the requirement is specifically to control script execution, not remove the tool.

Full explanation →
78
MCQmedium

A user's Windows 10 PC is infected with ransomware that has encrypted their Documents folder. You need to restore the files from a previous version that was saved by File History. Where do you access the 'Previous Versions' feature to restore these files?

A.File Explorer > Properties > Previous Versions tab
B.Control Panel > File History > Restore personal files
C.Settings > Update & Security > Backup
D.Computer Management > Storage > Disk Management
AnswerA

Accessing the 'Previous Versions' tab via File Explorer properties for a specific file or folder directly leverages the Volume Shadow Copy Service (VSS) or File History backups. This interface allows users to browse and restore older, unencrypted iterations of files, making it the primary method for recovering data from ransomware without paying the ransom. It provides granular control to select and restore individual files or entire folders to a state prior to encryption.

Why this answer

The 'Previous Versions' tab is accessible via File Explorer by right-clicking a file or folder, selecting Properties, and then clicking the Previous Versions tab. This tab lists shadow copies or File History backups of the selected item, allowing you to restore an earlier version. In this scenario, since File History was enabled, the previous versions of the Documents folder will appear here for restoration.

Exam trap

The trap here is that candidates confuse the File History restore interface (accessed via Control Panel) with the 'Previous Versions' tab in File Explorer, but the question explicitly asks for the location of the 'Previous Versions' feature, which is found in the file or folder's Properties dialog.

How to eliminate wrong answers

Option B is wrong because Control Panel > File History > Restore personal files opens the File History restore interface, which is used to browse and restore files from File History backups, but it does not directly access the 'Previous Versions' tab; the question specifically asks where to access the 'Previous Versions' feature, not the File History restore wizard. Option C is wrong because Settings > Update & Security > Backup is the modern UI for configuring backup settings, including File History, but it does not provide a direct 'Previous Versions' tab for restoring individual files; it only offers options to add a drive or more options. Option D is wrong because Computer Management > Storage > Disk Management is used for managing disk partitions, volumes, and drives, and has no relation to file versioning or restoration from File History.

Full explanation →
79
MCQmedium

A technician is decommissioning a server that contained encrypted patient health records. The organization's policy requires data to be destroyed beyond recovery, but the server must be returned to the leasing company. Which method should the technician use?

A.Perform a full format of all drives.
B.Use a degausser on the entire server chassis.
C.Remove the hard drives and physically shred them, then return the server without drives.
D.Run a disk cleanup and delete all files.
AnswerC

Physical destruction, such as shredding or pulverizing hard drives, is the most secure and irreversible method for data sanitization, especially for encrypted data. This method ensures that the platters containing the data are completely destroyed, making any data recovery impossible, even with advanced forensic techniques. Removing the drives and then returning the server chassis without them also directly addresses the common scenario of leased equipment where the data-bearing components must be retained or destroyed by the organization, while the hardware itself is returned to the lessor.

Why this answer

Physically shredding the hard drives ensures the encrypted patient health records are destroyed beyond any possible recovery, which satisfies the organization's policy. Returning the server without drives complies with the leasing company's requirement to return the server chassis, as the drives are typically owned by the organization or can be removed per lease terms. This method is the only one that guarantees data destruction at the physical media level, bypassing any residual data on the encrypted drives.

Exam trap

The trap here is that candidates may choose degaussing (Option B) because it effectively destroys magnetic data, but they overlook the requirement to return the server to the leasing company, which degaussing would render inoperable by damaging non-storage electronics.

How to eliminate wrong answers

Option A is wrong because a full format of all drives only overwrites file system metadata and may not securely erase all sectors, especially on SSDs where wear-leveling can leave residual data; encrypted data could still be recoverable with forensic tools. Option B is wrong because using a degausser on the entire server chassis would destroy the magnetic media on HDDs but would also damage or destroy other electronic components (e.g., motherboard, RAM, power supply), making the server non-functional and violating the lease return requirement. Option D is wrong because disk cleanup and deleting files only removes file system pointers, leaving the actual data intact on the storage media, which can be easily recovered with undelete utilities or forensic software.

Full explanation →
80
MCQhard

A technician is helping a user who accidentally installed a potentially unwanted program (PUP) that changed their browser homepage and search engine. The user is embarrassed and asks the technician not to tell their manager. What is the most ethical response?

A.Agree not to tell the manager and remove the PUP quietly.
B.Explain that you will remove the PUP but must document the incident per company policy, though you will not share unnecessary details.
C.Tell the user that this is a serious security breach and you have to report it immediately.
D.Ignore the request and report the user to HR for violating IT policy.
AnswerB

This approach demonstrates both empathy for the user's honest mistake and adherence to professional IT protocols. Documenting the incident, even for a Potentially Unwanted Program (PUP), is crucial for tracking potential vulnerabilities, identifying training needs, and maintaining an accurate security log, which is often a compliance requirement. Reassuring the user that unnecessary details will not be shared helps maintain trust while fulfilling technical and policy obligations.

Why this answer

It balances the user's privacy concern with the technician's professional obligation to follow company policy. Documenting the incident (e.g., in a help desk ticket) is standard procedure for tracking PUP infections, which may indicate broader security issues like drive-by downloads or social engineering. The technician can remove the PUP using tools like Malwarebytes or AdwCleaner while omitting the user's name from unnecessary reports, preserving trust without violating policy.

Exam trap

CompTIA often tests the distinction between a 'security incident' (e.g., malware with C2 traffic) and a 'policy violation' (e.g., PUP installation), tempting candidates to overreact with option C or underreact with option A.

How to eliminate wrong answers

Option A is wrong because agreeing to hide the incident violates most corporate IT security policies, which require documentation of any unauthorized software changes to maintain an audit trail and prevent future breaches. Option C is wrong because a PUP changing browser settings is not a 'serious security breach' (e.g., no data exfiltration or privilege escalation); over-reporting it could cause unnecessary panic and damage the user-manager relationship. Option D is wrong because ignoring the user's request and immediately reporting to HR bypasses the proper escalation path (IT should handle the technical fix and documentation first) and is disproportionate for a non-malicious PUP installation.

Full explanation →
81
MCQeasy

A user reports that their browser frequently redirects to a different search engine, and a new toolbar has appeared. After checking the browser settings, you find the homepage has been changed and there are unknown extensions enabled. What is the most likely cause of this issue?

A.A corrupted browser cache
B.A browser hijacker installed via a malicious extension
C.An outdated browser version
D.A misconfigured proxy server
AnswerB

A browser hijacker is a specific type of malware designed to alter a web browser's settings without the user's permission. These hijackers frequently install themselves as malicious extensions, which then modify the default homepage, search engine, and crucially, inject code that forces frequent redirects to unwanted advertising, phishing sites, or other malicious domains, directly causing the reported symptom.

Why this answer

This scenario describes classic symptoms of a browser hijacker, a type of malware that modifies browser settings without user consent. The correct answer is to remove the malicious extensions and reset the browser settings. This reinforces the importance of managing browser extensions and understanding common malware behaviors.

Full explanation →
82
MCQmedium

A company is implementing a remote access solution for employees using personal smartphones. They need to ensure that corporate email and documents are accessible but that no corporate data remains on the device if it is lost or wiped. Which technology should they use?

A.Virtual Private Network (VPN) with split tunneling.
B.Remote Desktop Protocol (RDP) to a virtual desktop.
C.Mobile Device Management (MDM) with a containerized work profile.
D.Third-party remote access software like LogMeIn.
AnswerC

Mobile Device Management (MDM) is the ideal solution as it allows IT to centrally manage, secure, and monitor mobile devices used for corporate access. A containerized work profile creates a separate, encrypted partition on the device for corporate applications and data, isolating it from personal content. This enables IT to enforce specific security policies, manage corporate applications, and perform a selective wipe of only the corporate data in the event of loss or employee departure, without affecting personal information.

Why this answer

Mobile Device Management (MDM) with a containerized work profile creates a separate, encrypted sandbox on the smartphone that stores corporate email and documents. This container can be remotely wiped by the administrator without affecting the user's personal data, ensuring no corporate data remains on a lost or wiped device.

Exam trap

CompTIA often tests the distinction between remote access technologies that only provide connectivity (VPN, RDP) versus those that enforce data separation and selective wipe (MDM containerization), leading candidates to mistakenly choose VPN or RDP for data protection requirements.

How to eliminate wrong answers

Option A is wrong because a VPN with split tunneling only encrypts traffic to the corporate network but does not prevent corporate data from being stored locally on the device; it offers no containerization or selective wipe capability. Option B is wrong because RDP to a virtual desktop streams the desktop interface but still allows data to be downloaded or copied to the local device unless strict clipboard and drive redirection policies are enforced, and it does not inherently provide a containerized work profile for mobile devices. Option D is wrong because third-party remote access software like LogMeIn provides remote control of a PC but does not isolate corporate data in a sandbox on the smartphone; data can be transferred to the device and remains there after the session ends.

Full explanation →
83
MCQhard

A security incident occurred where an unauthorized user accessed a workstation. You need to review the event logs to determine when the breach happened. Which Control Panel applet would you use to launch the Event Viewer?

A.System
B.Security and Maintenance
C.Administrative Tools
D.Device Manager
AnswerC

The 'Administrative Tools' folder is the designated location within Windows for a collection of advanced system utilities and management consoles, specifically designed for administrators and power users. This comprehensive suite includes essential tools like Event Viewer, Performance Monitor, Services, and Computer Management, which are critical for diagnosing system issues, monitoring performance, and investigating security incidents. Accessing Event Viewer through Administrative Tools provides the necessary interface to review detailed security logs for unauthorized access.

Why this answer

Administrative Tools is the Control Panel applet that provides access to advanced system tools, including Event Viewer. To investigate a security breach, you would open Administrative Tools and then launch Event Viewer to review security logs for unauthorized access events. This is the correct path because Event Viewer is not directly listed in the main Control Panel categories; it is nested within Administrative Tools.

Exam trap

CompTIA often tests the distinction between the Security and Maintenance applet (which shows security status but not logs) and Administrative Tools (which contains Event Viewer), leading candidates to mistakenly choose Security and Maintenance because of the word 'Security' in the name.

How to eliminate wrong answers

Option A is wrong because System applet displays basic system information, hardware properties, and performance settings, but does not include a direct link to Event Viewer. Option B is wrong because Security and Maintenance provides system health reports and security status summaries, but it does not host Event Viewer; it may link to troubleshooting tools but not the event log viewer itself. Option D is wrong because Device Manager is used to manage hardware devices and drivers, not to review system or security event logs.

Full explanation →
84
MCQmedium

A customer calls the help desk stating that their computer displays 'Bootmgr is missing' and will not start Windows. You suspect the Boot Configuration Data (BCD) is corrupted. Which command-line tool should you use from the Windows Recovery Environment to repair the BCD?

A.chkdsk /r
B.bootrec /rebuildbcd
C.sfc /scannow
D.diskpart
AnswerB

The `bootrec /rebuildbcd` command is the appropriate solution for repairing boot configuration issues, as it specifically scans all hard drives for compatible Windows installations and then adds them to the Boot Configuration Data (BCD) store. This process effectively reconstructs a corrupted or missing BCD, resolving common boot errors such as 'Bootmgr is missing' or when the system fails to locate the operating system. It ensures the boot loader has the correct entries to successfully start Windows.

Why this answer

`bootrec /rebuildbcd`, which scans for Windows installations and rebuilds the BCD store. This is a standard repair for boot manager issues. Other commands are for disk checking, system file repair, or partition management.

Full explanation →
85
MCQeasy

A user reports that their workstation is running slowly and they see a pop-up claiming their files are encrypted and a ransom must be paid. They cannot open any documents. What type of malware is most likely responsible?

A.Spyware
B.Ransomware
C.Trojan horse
D.Rootkit
AnswerB

Ransomware is a type of malicious software that encrypts a victim's files, rendering them inaccessible, and then demands a ransom payment, typically in cryptocurrency, for the decryption key. The initial encryption process can significantly slow down a workstation, and the subsequent display of a ransom note directly matches the described symptoms of a system running slowly and demanding payment. This attack directly targets data availability and extorts payment.

Why this answer

Ransomware encrypts files and demands payment for decryption. This scenario describes classic ransomware behavior, where the user is locked out of their data and a ransom note is displayed.

Full explanation →
86
MCQmedium

A company is deploying new laptops to remote workers. They need to ensure that if a laptop is stolen, the data on it cannot be accessed. Which two physical security controls should be configured before shipment?

A.Cable lock and privacy filter.
B.Full-disk encryption and a BIOS/UEFI password.
C.Smart card reader and biometric scanner.
D.Asset tracking tag and a Kensington lock slot.
AnswerB

Full-disk encryption (FDE) renders all data on the laptop's storage unreadable without the correct decryption key, effectively protecting sensitive information even if the physical device is lost or stolen and the drive is removed. A BIOS/UEFI password prevents unauthorized users from booting the system from external media, disabling security features, or altering critical boot settings, thereby reinforcing the FDE by preventing bypass attempts. This combination directly addresses both data confidentiality and system integrity for remote workers.

Why this answer

Full-disk encryption protects data at rest, and a BIOS/UEFI password prevents unauthorized booting or tampering with boot settings. This question tests the combination of controls needed for remote device security.

Full explanation →
87
MCQhard

A technician is troubleshooting an Android device that has a corporate email account configured. The user can send emails but cannot receive any. The email server uses IMAP. The technician has verified the username and password are correct. What should the technician check next?

A.Check if the device's date and time are correct.
B.Check the incoming mail server settings (IMAP).
C.Check if the email account has exceeded its storage quota.
D.Check if the device is in power-saving mode.
AnswerB

Since the technician has confirmed that sending emails (SMTP) functions correctly, the problem is isolated to the incoming mail service. This strongly suggests an issue with the device's configuration for the incoming mail server, typically IMAP (Internet Message Access Protocol). Common misconfigurations include an incorrect server hostname, an incorrect port number (e.g., 993 for IMAPS, 143 for IMAP), or incorrect security type (SSL/TLS).

Why this answer

Since the user can send emails but not receive them, the issue is isolated to the incoming mail path. IMAP uses port 143 (or 993 for SSL/TLS) to retrieve messages, and the incoming server settings (server address, port, security type) must match the corporate email configuration. Incorrect IMAP settings would prevent the device from connecting to the server to download new emails, while SMTP (outgoing) settings remain unaffected, explaining the send-only symptom.

Exam trap

CompTIA often tests the distinction between incoming and outgoing mail protocols (IMAP vs. SMTP) to see if candidates understand that a send-only failure points to the incoming server settings, not authentication or device-level issues.

How to eliminate wrong answers

Option A is wrong because incorrect date and time typically cause SSL/TLS certificate validation failures, which would affect both sending and receiving if the device cannot establish a secure connection; it would not selectively block only incoming mail. Option C is wrong because exceeding the storage quota would prevent the server from accepting new incoming messages, but the client would still be able to connect and see the mailbox (possibly with an error), and the user would also likely be unable to send if the quota is full on the server side. Option D is wrong because power-saving mode may delay background sync or reduce network activity, but it would not permanently prevent receiving emails; the user could still manually refresh or receive emails when the device exits power-saving mode, and sending would also be affected if network access is restricted.

Full explanation →
88
MCQeasy

A small business wants to ensure that only authorized personnel can access the server room. The budget is limited, and they need a simple, cost-effective solution. Which logical security control should they implement first?

A.Install a biometric fingerprint scanner on the door.
B.Require a smart card or key fob to unlock the door.
C.Implement a strong password policy for all user accounts.
D.Hire a security guard to check IDs at the entrance.
AnswerB

Smart cards and key fobs provide a logical access control mechanism by requiring a physical token for authentication to an electronic door system. These devices are relatively inexpensive to implement and manage, offering a scalable solution for a small business to ensure only authorized personnel can physically access a restricted area. Their access privileges can be centrally managed and quickly revoked or modified, enhancing both security and operational efficiency.

Why this answer

A smart card or key fob provides a simple, cost-effective logical access control for the server room door. It authenticates users via a physical token and a PIN or proximity reader, which is far cheaper than biometric systems and more reliable than a password policy that doesn't control physical entry. This directly restricts physical access to authorized personnel without ongoing costs like a security guard.

Exam trap

CompTIA often tests the distinction between logical and physical security controls, and the trap here is that candidates confuse a strong password policy (a logical control for user accounts) with a physical access control mechanism for a server room door.

How to eliminate wrong answers

Option A is wrong because biometric fingerprint scanners are significantly more expensive to purchase, install, and maintain, and they often require ongoing calibration and user enrollment, making them unsuitable for a limited budget. Option C is wrong because a strong password policy controls logical access to user accounts and network resources, not physical entry to a server room; it does not prevent an unauthorized person from walking through the door. Option D is wrong because hiring a security guard is a recurring, high-cost solution that exceeds the limited budget and is not a logical security control—it is a physical security measure.

Full explanation →
89
MCQmedium

You are configuring a new Windows 10 workstation for a remote employee who will connect to the corporate VPN. The user should not be able to install software or change system settings. Which tool should you use to enforce these restrictions?

A.User Account Control (UAC) settings
B.Local Group Policy Editor
C.Device Manager
D.Registry Editor
AnswerB

The Local Group Policy Editor (gpedit.msc) is a powerful administrative tool available in Windows Pro and Enterprise editions, enabling administrators to configure security settings, software installation policies, and user environment settings for the local computer or specific users/groups. It provides granular control, including the ability to restrict access to the Control Panel and prevent users from installing software. These policies are persistent and apply across user sessions and reboots, making it an effective method for workstation hardening and enforcing compliance.

Why this answer

Local Group Policy Editor (gpedit.msc) allows you to configure security and restriction policies on a standalone computer. You can disable the ability to install software by setting the 'Disable Windows Installer' policy and restrict access to Control Panel settings. This is the appropriate tool for a non-domain joined machine.

Full explanation →
90
MCQhard

A technician is configuring a kiosk mode on a company-owned Android tablet for customer use. After enabling the dedicated device management app, the tablet still allows users to exit the kiosk app by pressing the home button. Which setting did the technician MOST likely overlook?

A.The tablet's screen timeout setting.
B.The 'Lock task mode' or 'Pin app' feature.
C.The tablet's Wi-Fi configuration.
D.The device's date and time settings.
AnswerB

The 'Lock task mode' on Android, often referred to as 'App Pinning' or 'Screen Pinning,' is the fundamental feature used to configure a device for kiosk mode. This functionality prevents users from exiting a designated application, disabling navigation buttons like Home, Back, and Recent Apps, and restricting access to notifications or quick settings. It effectively locks the device into a single application, ensuring the intended kiosk experience without unauthorized access to other device features.

Why this answer

The technician enabled the dedicated device management app but did not activate Android's 'Lock task mode' (or 'Pin app' feature). This mode is required to pin the kiosk app to the foreground and block system navigation keys (Home, Recent Apps), preventing users from exiting the app. Without it, the Home button remains functional, allowing escape from the kiosk environment.

Exam trap

CompTIA often tests the distinction between enabling a dedicated device management app and actually locking the device into kiosk mode, leading candidates to overlook the mandatory 'Lock task mode' or 'Pin app' configuration step.

How to eliminate wrong answers

Option A is wrong because screen timeout settings control display sleep duration, not the ability to exit a kiosk app via the Home button. Option C is wrong because Wi-Fi configuration affects network connectivity, not the enforcement of app pinning or navigation blocking. Option D is wrong because date and time settings are unrelated to kiosk mode behavior; they do not prevent the Home button from exiting the app.

Full explanation →
91
MCQhard

A company policy requires that all web traffic from employee computers be filtered to block known malicious sites. You need to implement this without installing client software on each machine. Which approach should you use?

A.Configure each browser's proxy settings to use a filtering proxy server.
B.Enable Windows Defender SmartScreen on each computer via Group Policy.
C.Implement a DNS-based content filtering service on the network's DNS server.
D.Install a third-party browser extension on all browsers to block malicious sites.
AnswerC

A DNS-based content filtering service intercepts and evaluates all DNS queries originating from devices on the network at the DNS server level. If a query attempts to resolve a domain categorized as malicious or undesirable, the DNS server can block the resolution or redirect it to a safe page, effectively preventing access to the site. This method operates transparently at the network infrastructure layer, requiring no client-side software installation or configuration on individual user devices to enforce its policies across all web traffic.

Why this answer

DNS-based content filtering operates at the network level, blocking resolution of domains known to host malicious content. This approach requires no client software, as all DNS queries from employee computers are intercepted and filtered by the network's DNS server, enforcing the policy transparently.

Exam trap

The 220-1202 exam often tests the distinction between client-side and network-level security controls, and the trap here is assuming that proxy settings or browser extensions are acceptable when the question explicitly prohibits installing client software.

How to eliminate wrong answers

Option A is wrong because configuring each browser's proxy settings manually is not a scalable, clientless solution; it requires per-machine configuration and can be bypassed if users change proxy settings. Option B is wrong because Windows Defender SmartScreen is a client-side feature that must be enabled via Group Policy, which still relies on the Windows operating system on each machine and does not meet the 'without installing client software' requirement. Option D is wrong because installing a third-party browser extension requires client-side installation on each browser, violating the no-client-software constraint.

Full explanation →
92
MCQmedium

A technician is configuring a VPN for a remote user. The user's home router uses NAT, and the technician wants to ensure the VPN traffic is encapsulated and encrypted. Which VPN protocol should the technician choose for the best balance of security and compatibility?

A.PPTP
B.L2TP/IPsec
C.OpenVPN
D.SSTP
AnswerC

OpenVPN is an open-source VPN solution that leverages the OpenSSL library for robust encryption and authentication, supporting a wide range of cryptographic algorithms. It is highly flexible, capable of operating over both UDP and TCP protocols, which allows it to effectively traverse firewalls and Network Address Translation (NAT) devices by encapsulating traffic within standard ports like 443. Its strong security, cross-platform compatibility, and extensive configurability make it an excellent and reliable choice for secure remote access.

Why this answer

OpenVPN is the correct choice because it provides a robust balance of security and compatibility, especially for remote users behind NAT. It uses SSL/TLS for encryption and can operate over a single UDP or TCP port (typically 1194), which easily traverses NAT without requiring additional configuration. Unlike L2TP/IPsec, OpenVPN does not rely on IPsec's NAT-sensitive protocols like ESP, making it more reliable across home routers.

Exam trap

CompTIA often tests the misconception that L2TP/IPsec is always the best for security and compatibility, but the trap here is that IPsec's ESP protocol can fail with NAT unless NAT-T is enabled, making OpenVPN a more practical choice for remote users behind home routers.

How to eliminate wrong answers

Option A is wrong because PPTP uses outdated MPPE encryption (RC4) and has known vulnerabilities, making it insecure for modern use. Option B is wrong because L2TP/IPsec can have issues with NAT traversal due to IPsec's ESP protocol, often requiring NAT-T or additional router configuration, which reduces compatibility with home routers. Option D is wrong because SSTP is primarily designed for Windows environments and uses TCP port 443, which can be blocked or throttled by some firewalls, and it lacks the cross-platform compatibility of OpenVPN.

Full explanation →
93
MCQmedium

A user reports that their web browser's homepage has changed to an unfamiliar search engine, and new toolbars have appeared without their consent. They have not installed any new software recently. Which type of malware is most likely responsible?

A.Trojan horse
B.Worm
C.Browser hijacker
D.Ransomware
AnswerC

A browser hijacker is a type of unwanted software that modifies a web browser's settings without the user's permission. This typically includes changing the default homepage, search engine, or installing unwanted toolbars and extensions. The objective is often to redirect traffic to specific websites, display advertisements, or collect browsing data, significantly impacting the user's browsing experience and privacy.

Why this answer

The symptoms—unwanted homepage changes, unfamiliar search engine, and new toolbars—are classic signs of a browser hijacker. This malware modifies browser settings (e.g., via registry keys or extension policies) without user consent, often bundled with freeware or installed through drive-by downloads. Unlike other malware types, it specifically targets the browser's configuration to redirect traffic and generate ad revenue.

Exam trap

CompTIA often tests the distinction between malware types by focusing on specific symptoms—here, the trap is that candidates confuse a browser hijacker with a Trojan horse because both can be installed without consent, but only the hijacker directly targets browser settings.

How to eliminate wrong answers

Option A is wrong because a Trojan horse masquerades as legitimate software to perform malicious actions (e.g., data theft or backdoor access), but it does not specifically alter browser settings or add toolbars as its primary function. Option B is wrong because a worm self-replicates across networks to spread, often exploiting vulnerabilities, but it does not typically modify browser homepages or install toolbars. Option D is wrong because ransomware encrypts files or locks the system to demand payment, not change browser settings or add toolbars.

Full explanation →
94
MCQhard

A technician is investigating a data breach and discovers that an attacker obtained sensitive files by searching through the company's recycling bins. The bins contained printed reports with customer names and account numbers. What social engineering attack was used?

A.Tailgating
B.Shoulder surfing
C.Dumpster diving
D.Phishing
AnswerC

Dumpster diving is a social engineering and physical security vulnerability exploitation technique where an attacker sifts through an organization's or individual's discarded trash to find sensitive information. This can include anything from financial statements, employee records, network diagrams, or even sticky notes with passwords, all of which could be used to facilitate further attacks or breaches. It directly involves the recovery of improperly disposed physical documents or media.

Why this answer

Dumpster diving is the physical act of searching through trash to find sensitive information. This attack relies on the failure to properly dispose of documents. Shredding or secure disposal policies are essential countermeasures.

Full explanation →
95
MCQhard

A user's Windows 10 laptop fails to boot and shows 'INACCESSIBLE_BOOT_DEVICE' blue screen error. The technician suspects a recent driver update for the storage controller. Which recovery environment command can be used to disable the problematic driver from loading?

A.Run 'bcdedit /set {default} safeboot minimal' from the recovery command prompt.
B.Run 'diskpart' and then 'clean' to wipe the disk.
C.Run 'chkdsk /f' to fix file system errors.
D.Run 'bootrec /fixboot' to repair the boot sector.
AnswerA

The 'bcdedit /set {default} safeboot minimal' command modifies the Boot Configuration Data (BCD) store, instructing the Windows Boot Manager to load the operating system in Safe Mode on the next startup. Safe Mode loads only essential drivers and services, effectively bypassing potentially corrupted or incompatible drivers that are preventing a normal boot. This allows a technician to access the system, diagnose the problematic driver, and perform necessary repairs like driver rollback, uninstallation, or system restore.

Why this answer

The 'INACCESSIBLE_BOOT_DEVICE' error often occurs after a faulty storage controller driver update. Booting into Safe Mode with minimal drivers can bypass the problematic driver. The command 'bcdedit /set {default} safeboot minimal' configures the boot loader to start Windows in Safe Mode on the next restart, loading only essential drivers and services, which allows the technician to roll back or uninstall the offending driver.

Exam trap

The trap here is that candidates often confuse 'bcdedit' with 'bootrec' commands, assuming 'bootrec /fixboot' or 'chkdsk' can resolve driver-related boot failures, when in fact only Safe Mode or driver rollback via the recovery environment addresses the root cause.

How to eliminate wrong answers

Option B is wrong because 'diskpart clean' wipes the entire disk partition table, destroying all data and making the system unbootable — it does not disable a driver. Option C is wrong because 'chkdsk /f' repairs file system corruption, not driver-related boot failures; it cannot disable a storage controller driver. Option D is wrong because 'bootrec /fixboot' rewrites the boot sector code, which addresses bootloader corruption but does not prevent a specific driver from loading.

Full explanation →
96
MCQmedium

A system administrator configures a new VPN server for remote employees. The requirement is that all traffic from the remote user's device must be routed through the corporate network to enforce security policies. Which VPN protocol setting should the administrator enable?

A.Enable split tunneling
B.Disable split tunneling
C.Use PPTP instead of L2TP
D.Increase the MTU size
AnswerB

Disabling split tunneling, also known as implementing a full tunnel VPN, forces all network traffic originating from the client device to traverse the secure VPN tunnel to the corporate network before reaching any destination, including the public internet. This ensures that every packet is subjected to the organization's security controls, such as firewalls, intrusion detection systems, and content filters, thereby enforcing comprehensive corporate security policies on all user activity. This configuration is essential when the objective is to secure and monitor all outbound traffic.

Why this answer

Disabling split tunneling ensures that all traffic from the remote user's device is routed through the corporate VPN tunnel, enforcing security policies such as content filtering and intrusion detection. When split tunneling is enabled, only traffic destined for the corporate network goes through the VPN, while internet-bound traffic bypasses it, violating the requirement. This setting is typically configured in the VPN client or server profile (e.g., using the 'DisableSplitTunneling' registry key on Windows or the 'tunnel-all' directive in OpenVPN).

Exam trap

CompTIA often tests the misconception that the choice of VPN protocol (PPTP vs. L2TP) determines traffic routing behavior, when in fact split tunneling is a separate policy setting that must be explicitly enabled or disabled.

How to eliminate wrong answers

Option A is wrong because enabling split tunneling would allow remote users to access the internet directly without traversing the corporate network, which directly contradicts the requirement to route all traffic through the corporate network. Option C is wrong because using PPTP instead of L2TP does not affect traffic routing behavior; PPTP and L2TP are tunneling protocols that encapsulate data, but split tunneling is a separate routing policy that must be configured regardless of the protocol chosen. Option D is wrong because increasing the MTU size addresses packet fragmentation issues, not traffic routing; it can improve performance but does not enforce that all traffic is sent through the VPN tunnel.

Full explanation →
97
MCQeasy

A small business wants to prevent unauthorized individuals from following employees through a secure entrance after badge access is granted. Which physical security control is specifically designed to address this threat?

A.Install a biometric fingerprint scanner
B.Use a proximity card reader
C.Deploy a mantrap
D.Add a security guard
AnswerC

A mantrap, also known as an access control vestibule, consists of two interlocking doors where only one door can be open at a time. An individual enters the first door, which then closes and locks behind them, creating a secure chamber for authentication. Their identity is verified within this chamber, and only then does the second door open, allowing them to proceed. This physical isolation mechanism effectively prevents tailgating or piggybacking by ensuring only one person can pass through the controlled area per authentication cycle.

Why this answer

A mantrap is a physical security control consisting of two interlocking doors with a small vestibule between them. It prevents tailgating by allowing only one person to enter at a time; the first door must close and lock before the second door can open, ensuring that only the authenticated individual passes through.

Exam trap

The trap here is that candidates confuse authentication controls (biometrics, card readers) with access control mechanisms that prevent tailgating, failing to recognize that authentication alone does not enforce single-person entry.

How to eliminate wrong answers

Option A is wrong because a biometric fingerprint scanner authenticates identity but does not prevent an unauthorized person from following an authorized user through the door after access is granted. Option B is wrong because a proximity card reader grants access based on a card but offers no mechanism to stop tailgating once the door is opened. Option D is wrong because a security guard can monitor and intervene, but the question asks for a control specifically designed to address tailgating; a mantrap is a dedicated engineered solution, whereas a guard is a human control that may be inconsistent or bypassed.

Full explanation →
98
MCQmedium

A user reports that their Android phone's Bluetooth keeps disconnecting from their car's hands-free system. The technician has already cleared the Bluetooth cache and re-paired the devices. What should the technician do NEXT?

A.Perform a factory reset on the phone.
B.Update the car's infotainment system firmware.
C.Replace the phone's Bluetooth antenna.
D.Disable Bluetooth power saving mode on the phone.
AnswerB

Updating the car's infotainment system firmware is often the most effective and targeted solution for Bluetooth connectivity issues with specific phone models. Car manufacturers frequently release firmware revisions that include updated Bluetooth profiles, codecs, and drivers to improve compatibility with newer smartphone operating systems and hardware. This addresses potential discrepancies in Bluetooth protocol implementations between the car and the Android phone, which is a common cause of such problems.

Why this answer

After basic troubleshooting (cache clear and re-pair) fails, the next logical step is to check for firmware updates on the car's infotainment system. Bluetooth connectivity issues between a phone and a car are often caused by incompatibilities or bugs in the car's Bluetooth stack, which can be resolved by updating the car's firmware. The technician should prioritize updating the car's system before considering hardware replacement or more drastic phone resets.

Exam trap

The trap here is that candidates may assume the phone is always at fault and jump to a factory reset (Option A) or hardware replacement (Option C), when in reality the car's infotainment firmware is a frequent source of Bluetooth instability that should be addressed first.

How to eliminate wrong answers

Option A is wrong because a factory reset on the phone is a drastic step that should only be taken after exhausting all other software-based troubleshooting; it would delete all user data and is unlikely to fix a Bluetooth issue that persists after cache clearing and re-pairing, especially if the problem is on the car side. Option C is wrong because replacing the phone's Bluetooth antenna is a hardware repair that is premature at this stage; Bluetooth disconnections are rarely caused by a faulty antenna, and the technician has not yet ruled out software or firmware issues on either device. Option D is wrong because disabling Bluetooth power saving mode on the phone is a valid step but should have been considered earlier in the troubleshooting process (e.g., before or alongside cache clearing); it is not the next best step after cache clearing and re-pairing, and the question implies those steps have already been done without success.

Full explanation →
99
MCQeasy

A help desk technician receives a complaint that a shared network printer is no longer accessible after a scheduled firmware update was applied to the print server last night. The change was documented but no rollback plan was included. What should the technician do first?

A.Reboot the print server to clear any temporary errors.
B.Restore the print server to its previous firmware version.
C.Submit a new change request to update the firmware again.
D.Disable the printer in Active Directory and re-add it.
AnswerB

When a recent firmware update is identified as the cause of an outage, rolling back to the previous stable firmware version is the most direct and effective remediation. This action directly reverses the problematic change, restoring the server to its last known working state and resolving the incompatibility. Although a proper rollback plan should have been established prior to the update, performing the rollback now is critical for immediate service restoration.

Why this answer

The scheduled firmware update directly caused the printer to become inaccessible, and without a documented rollback plan, reverting to the previous firmware version is the safest and most immediate way to restore service. This aligns with change management best practices, which prioritize backing out a failed change before troubleshooting further, as the root cause is clearly the firmware update.

Exam trap

The trap here is that candidates often choose to reboot the server (Option A) as a generic troubleshooting step, but the question specifies the change was a firmware update, so the only effective first action is to revert that specific change.

How to eliminate wrong answers

Option A is wrong because rebooting the print server may clear temporary errors but will not revert the firmware version, so if the new firmware is incompatible or buggy, the issue will persist after the reboot. Option C is wrong because submitting a new change request to update the firmware again would repeat the same action that caused the outage, which is illogical and violates change management principles. Option D is wrong because disabling and re-adding the printer in Active Directory addresses only the printer object and driver mapping, not the underlying firmware incompatibility on the print server.

Full explanation →
100
MCQhard

A user reports that their browser crashes every time they visit a particular website. Other websites work fine. The technician tries the same website on another computer and it works normally. What is the most likely cause on the user's computer?

A.The website has been blacklisted by the company's firewall.
B.A browser extension is incompatible with that website.
C.The user's network adapter driver is outdated.
D.The website is using a newer version of TLS that the browser doesn't support.
AnswerB

Browser extensions inject their own code, scripts, or styles into web pages, modifying the browser's behavior or the page's content. An incompatibility arises when an extension's code conflicts with the specific JavaScript, CSS, or HTML structure of a particular website, leading to unexpected errors or memory access violations within the browser process. This conflict can destabilize the browser, causing it to freeze or crash when attempting to render or interact with the problematic site, while other sites remain unaffected.

Why this answer

The issue is isolated to a single website on one computer, and the same website works on another computer. This rules out network-wide or server-side problems. Browser extensions can inject scripts, modify headers, or block resources that a specific website requires, causing crashes.

Disabling extensions or testing in incognito mode (which typically disables extensions) can confirm this.

Exam trap

CompTIA often tests the principle of isolation—candidates mistakenly attribute a single-site issue to network-wide or driver problems, but the key is that the problem follows the user's browser configuration, not the network or hardware.

How to eliminate wrong answers

Option A is wrong because if the website were blacklisted by the company's firewall, it would not load on any computer in the network, not just the user's. Option C is wrong because an outdated network adapter driver would cause connectivity issues across all websites, not a single site. Option D is wrong because TLS version incompatibility would result in a connection error or a 'secure connection failed' message, not a browser crash; additionally, if the browser didn't support the TLS version, the other computer would also fail unless it had a different browser or updated TLS stack.

Full explanation →
101
MCQeasy

A small office wants to dispose of 20 old CRT monitors. The local landfill does not accept e-waste. Which disposal method is both legal and environmentally responsible?

A.Place them in the dumpster behind the office after hours.
B.Contact a certified e-waste recycling company to pick them up.
C.Break them down and put the plastic and metal in separate recycling bins.
D.Sell them to a scrap metal dealer.
AnswerB

Contacting a certified e-waste recycling company is the correct and most responsible method for disposing of old CRT monitors. Certified recyclers (e.g., R2 or e-Stewards certified) possess the specialized equipment, permits, and trained personnel required to safely dismantle electronic waste. They ensure hazardous components, such as leaded glass, are properly separated and neutralized, while valuable materials like copper, plastics, and precious metals are recovered and recycled, minimizing environmental impact and ensuring regulatory compliance.

Why this answer

CRT monitors contain hazardous materials like lead and phosphor, making them e-waste that cannot be disposed of in regular trash. Certified e-waste recycling companies follow environmental regulations to safely dismantle and recycle these components, ensuring legal compliance and responsible handling.

Exam trap

CompTIA often tests the misconception that recycling bins or scrap dealers are acceptable for e-waste, when in fact only certified e-waste recyclers can legally and safely handle hazardous materials like those in CRTs.

How to eliminate wrong answers

Option A is wrong because placing e-waste in a dumpster is illegal in most jurisdictions and environmentally irresponsible due to toxic materials like lead leaching into landfills. Option C is wrong because breaking down CRTs without proper equipment releases hazardous dust and requires specialized handling; general recycling bins do not accept e-waste components. Option D is wrong because scrap metal dealers typically lack certification for handling hazardous e-waste, and selling CRTs for scrap may violate environmental laws if the materials are not processed safely.

Full explanation →
102
MCQmedium

A technician needs to write a batch script that will copy a configuration file from a network share to the local system32 directory only if the file on the share is newer than the local copy. Which command should the technician use to perform this conditional copy?

A.copy /y \\server\share\config.txt C:\Windows\System32\
B.xcopy \\server\share\config.txt C:\Windows\System32\ /d /y
C.robocopy \\server\share C:\Windows\System32 config.txt /mir
D.move /y \\server\share\config.txt C:\Windows\System32\
AnswerB

Xcopy with /d copies only if the source is newer, and /y suppresses prompts.

Why this answer

The `xcopy` command with the `/d` switch copies files only if the source file is newer than the destination file, and `/y` suppresses confirmation prompts. This meets the requirement of a conditional copy based on file timestamp comparison.

Exam trap

CompTIA A+ often tests the distinction between `copy`, `xcopy`, and `robocopy` switches, and the trap here is that candidates may choose `copy /y` thinking it is sufficient, overlooking the need for a timestamp-based conditional check that only `xcopy /d` provides.

How to eliminate wrong answers

Option A is wrong because `copy /y` always overwrites the destination without any timestamp check, so it does not conditionally copy only when the source is newer. Option C is wrong because `robocopy /mir` mirrors an entire directory tree, including deleting files in the destination that no longer exist in the source, which is excessive and destructive for a single-file copy task. Option D is wrong because `move` relocates the file from the network share to the local system, removing it from the source, which is not a copy operation and does not perform any timestamp-based condition.

Full explanation →
103
MCQmedium

A user reports that after installing a free PDF converter from an advertisement, their browser homepage changed and they see constant pop-ups for antivirus software. A malware scan found PUPs (Potentially Unwanted Programs). What is the best next step to fully remove the unwanted software and restore browser settings?

A.Run System Restore to a point before installation.
B.Use a dedicated adware removal tool and then reset the browser.
C.Manually delete the program from Program Files.
D.Disable the browser's JavaScript and ActiveX.
AnswerB

Using a dedicated adware removal tool is crucial because these utilities are specifically designed to detect and eradicate PUPs, which often evade standard antivirus software due to their 'grayware' nature. These tools employ heuristics and extensive databases to locate deeply embedded components, including browser hijackers, unwanted extensions, and persistent registry entries. Subsequently, resetting the browser ensures all lingering modifications, such as altered homepages, search engines, and pop-up settings, are completely reverted to default, providing a clean slate.

Why this answer

PUPs often embed deeply into browser settings and registry entries that a standard uninstall or System Restore may not fully remove. A dedicated adware removal tool targets these specific traces, and resetting the browser ensures all malicious extensions, search providers, and homepage hijacks are cleared, restoring default security configurations.

Exam trap

CompTIA often tests the misconception that System Restore (Option A) is a comprehensive fix for malware, when in reality it may not remove PUPs that persist in user profile folders or browser data that are excluded from restore points.

How to eliminate wrong answers

Option A is wrong because System Restore may not revert changes made by PUPs that modify user-specific registry hives or browser profile data, and it can leave behind residual files that continue to cause pop-ups. Option C is wrong because manually deleting the program from Program Files does not remove the associated registry entries, scheduled tasks, or browser extensions that maintain the unwanted behavior. Option D is wrong because disabling JavaScript and ActiveX only prevents some script-based pop-ups but does not remove the underlying PUP files, registry modifications, or browser hijack settings.

Full explanation →
104
MCQeasy

A customer reports that their desktop computer is running extremely slowly, and they see frequent pop-up advertisements even when no browser is open. Task Manager shows a process named 'svch0st.exe' consuming 95% CPU. Which type of malware is most likely causing these symptoms?

A.Ransomware
B.Adware
C.Rootkit
D.Spyware
AnswerB

Adware is specifically designed to display unwanted advertisements, often through pop-up windows, banners, or injected content into web pages, directly matching the symptom of pop-up ads. A common tactic for adware to maintain persistence and avoid detection is to create processes that deliberately impersonate legitimate system services or applications. This behavior allows it to run unnoticed in the background, making it difficult for users to identify and remove, aligning perfectly with the described symptoms.

Why this answer

Adware displays unwanted advertisements and often masquerades as legitimate processes. The misspelled 'svch0st.exe' mimics a Windows system process, a common adware tactic. This malware type is best removed using a dedicated anti-malware tool.

Full explanation →
105
MCQmedium

A user reports that after a technician recycled an old computer by simply deleting the user profile, the next user found personal documents in the 'Recycle Bin'. Which step was missed in the data disposal process?

A.The technician should have performed a quick format.
B.The technician should have used a data wiping tool that overwrites the free space.
C.The technician should have removed the hard drive and stored it.
D.The technician should have disabled the Recycle Bin.
AnswerB

The technician should have used a data wiping tool that overwrites the free space to ensure data unrecoverability. Such tools systematically write patterns of data, often multiple passes of zeros or random characters, across all sectors of the storage device, including those previously occupied by deleted files. This process physically obliterates the original data, making it impossible to recover using standard or even advanced forensic techniques, thus achieving proper data sanitization.

Why this answer

Deleting a user profile only removes the user's registry and profile folder, but personal documents remain in the Recycle Bin because the Recycle Bin is a system-protected hidden folder that is not cleared by profile deletion. A data wiping tool that overwrites free space is required to securely erase the contents of the Recycle Bin and any other residual data, ensuring that deleted files cannot be recovered.

Exam trap

CompTIA often tests the misconception that deleting a user profile or emptying the Recycle Bin is sufficient for data disposal, when in fact both actions leave recoverable data on the free space that requires overwriting to be secure.

How to eliminate wrong answers

Option A is wrong because a quick format only clears the file system metadata (e.g., the MFT or FAT table) and does not overwrite the actual data sectors, leaving the Recycle Bin contents intact and recoverable. Option C is wrong because removing and storing the hard drive is a physical security measure for decommissioning, not a data disposal step for a recycled computer that will be reused by another user. Option D is wrong because disabling the Recycle Bin only prevents future files from being stored there; it does not erase existing files already in the Recycle Bin, so the personal documents would remain.

Full explanation →
106
MCQhard

A company's IT policy requires that all disposed hard drives be physically destroyed to prevent data breaches. Which method has the least environmental impact while ensuring data destruction?

A.Use a degausser to erase the drive and then recycle it.
B.Drill holes through the platters and then dispose of the drive in e-waste.
C.Shred the hard drive using an industrial shredder and then recycle the metal fragments.
D.Overwrite the drive with zeros multiple times and then donate it.
AnswerC

Shredding hard drives with an industrial shredder provides the highest level of physical data destruction, reducing the drive into small, unrecognizable fragments. This method ensures that no data can be recovered, satisfying stringent IT security policies for complete sanitization. Subsequently, separating and recycling the resulting metal fragments (e.g., aluminum, steel) minimizes electronic waste, conserves resources, and aligns with environmental best practices, making it a comprehensive and compliant solution.

Why this answer

Industrial shredding physically destroys the platters into small fragments, making data recovery impossible, and the resulting metal fragments can be recycled, minimizing environmental impact. Unlike degaussing or drilling, shredding ensures complete destruction without leaving large e-waste components, and the recycling of ferrous and non-ferrous metals reduces raw material extraction.

Exam trap

CompTIA often tests the misconception that degaussing or overwriting is sufficient for physical destruction policies, but the key distinction is that physical destruction requires the drive to be rendered physically unusable and unrecoverable, not just magnetically or logically erased.

How to eliminate wrong answers

Option A is wrong because degaussing destroys the magnetic domains on the platters, making the drive unusable, but the drive itself remains a bulky e-waste item that must be disposed of; recycling a degaussed drive still requires energy and processing, and degaussing does not physically destroy the drive, so it may not meet a policy requiring physical destruction. Option B is wrong because drilling holes through the platters leaves large portions of the platters intact, and data may still be recoverable from undamaged areas using specialized forensic tools; additionally, disposing of the drive in e-waste without recycling the metal components has a higher environmental impact than shredding and recycling. Option D is wrong because overwriting with zeros multiple times does not physically destroy the drive, and donating it violates the policy requiring physical destruction; even with multiple overwrites, advanced recovery techniques (e.g., magnetic force microscopy) might recover residual data, and the drive is not disposed of as required.

Full explanation →
107
MCQeasy

During a printer toner replacement, a technician accidentally spills toner powder on the carpet. What is the proper cleanup procedure?

A.Use a vacuum cleaner with a standard bag to suck up the toner.
B.Wipe the toner with a damp cloth using hot water.
C.Blot the toner with a cold, damp cloth and then use a HEPA-filter vacuum.
D.Sweep the toner into a dustpan and dispose of it in the trash.
AnswerC

Blotting with a cold, damp cloth is crucial as cold water prevents the thermoplastic toner from melting and bonding to surfaces, while blotting avoids spreading the fine powder. Subsequently, a HEPA-filter vacuum is essential because its high-efficiency particulate air filter captures 99.97% of airborne particles 0.3 microns or larger. This ensures effective removal of the fine toner particles without re-releasing them into the environment, protecting both health and equipment.

Why this answer

Toner powder is extremely fine and can become airborne if mishandled. Blotting with a cold, damp cloth prevents the toner from spreading, and using a HEPA-filter vacuum ensures that microscopic toner particles are trapped without being exhausted back into the environment. Standard vacuum cleaners lack HEPA filtration and can release toner dust into the air, causing respiratory hazards.

Exam trap

CompTIA often tests the misconception that any vacuum or damp cloth is acceptable for toner cleanup, but the trap is that only a HEPA-filter vacuum combined with cold water blotting prevents particle dispersion and permanent staining.

How to eliminate wrong answers

Option A is wrong because using a vacuum cleaner with a standard bag does not trap ultrafine toner particles; the vacuum's exhaust can blow toner dust into the air, creating a health risk and further contamination. Option B is wrong because wiping toner with a damp cloth using hot water can cause the toner to melt or fuse into the carpet fibers, making permanent stains and releasing fumes. Option D is wrong because sweeping toner with a dustpan generates airborne dust, and disposing of it in regular trash is unsafe as toner is a fine particulate that can become airborne in landfills.

Full explanation →
108
MCQeasy

During a printer toner replacement, a technician accidentally spills toner powder on the carpet. What is the correct procedure for cleaning up the spill?

A.Use a standard household vacuum cleaner to quickly remove the toner.
B.Wipe up the toner with a dry paper towel and dispose of it in the trash.
C.Use a toner-rated vacuum or a damp cloth to carefully collect the spill.
D.Pour water on the spill to dissolve the toner, then mop it up.
AnswerC

A toner-rated vacuum is the safest and most effective method because it features a HEPA filter specifically designed to capture the extremely fine toner particles, preventing them from recirculating into the air. Alternatively, a lightly damp cloth can be used to carefully blot and lift the toner, as the moisture helps to bind the particles together and prevents them from becoming airborne, significantly reducing inhalation risks.

Why this answer

Toner powder is a fine, electrically charged plastic dust that can be hazardous if inhaled or if it melts into carpet fibers. Using a toner-rated vacuum with a HEPA filter safely captures the particles without dispersing them, or a damp cloth can be used to gently lift the toner without smearing it deeper into the carpet. This procedure follows manufacturer safety guidelines and prevents damage to standard vacuums, which can ignite or spread the toner.

Exam trap

CompTIA often tests the misconception that water can dissolve toner because it resembles ink, but toner is a dry plastic powder that requires specialized cleanup to avoid static ignition or permanent carpet damage.

How to eliminate wrong answers

Option A is wrong because standard household vacuum cleaners lack HEPA filtration and can cause the fine toner particles to be expelled into the air, creating an inhalation hazard; additionally, the static buildup inside the vacuum can ignite the toner dust. Option B is wrong because wiping toner with a dry paper towel will grind the particles into the carpet fibers, making removal more difficult and potentially damaging the carpet. Option D is wrong because toner is a plastic-based powder that does not dissolve in water; adding water will create a sticky, paste-like mess that is harder to clean and can stain the carpet permanently.

Full explanation →
109
MCQmedium

A technician is investigating a security incident where a user's credentials were stolen. The user says they only logged into their email from a coffee shop Wi-Fi. The technician notices that the browser was not using HTTPS for the login page. What is the most likely attack method used?

A.Cross-site scripting (XSS) attack.
B.Man-in-the-middle attack.
C.DNS spoofing attack.
D.Brute force attack.
AnswerB

A Man-in-the-middle (MITM) attack is precisely what occurs when an attacker intercepts communication between two parties without their knowledge. In a Wi-Fi environment, an attacker can position themselves between a user and a legitimate login page, capturing all unencrypted HTTP traffic. Since HTTP does not encrypt data, any login credentials transmitted over it are exposed in plain text, allowing the attacker to easily steal them.

Why this answer

On an open Wi-Fi network, an attacker can perform a man-in-the-middle attack to intercept unencrypted HTTP traffic. Without HTTPS, the login credentials are sent in plaintext and can be captured easily. This is a common risk on public Wi-Fi.

Full explanation →
110
MCQhard

A company is experiencing a security incident where an attacker gained access to the internal network via a compromised VPN account. The technician must prevent future attacks. Which two-factor authentication method should the technician implement for VPN access?

A.Require a complex password with a minimum length of 20 characters
B.Implement a time-based one-time password (TOTP) via an authenticator app
C.Restrict VPN access to specific IP addresses
D.Enable single sign-on (SSO) with Active Directory
AnswerB

Implementing a time-based one-time password (TOTP) via an authenticator app significantly enhances security by introducing a second, independent authentication factor ('something you have'). This method generates a unique, ephemeral code that changes typically every 30-60 seconds, which must be entered in addition to the user's password. Even if an attacker compromises the user's password, they cannot gain access without also possessing the physical device generating the current TOTP code, making credential reuse extremely difficult.

Why this answer

Two-factor authentication (2FA) adds a second factor beyond the password, such as a one-time code from an authenticator app. This significantly reduces the risk of account compromise even if the password is stolen.

Full explanation →
111
MCQmedium

During a security audit, you find that a user's workstation has a USB device that automatically logs in to a cloud storage account when inserted. What security best practice is being violated?

A.Password complexity requirements
B.Account lockout policies
C.Disabling auto-run
D.Enforcing screen locks
AnswerC

Disabling auto-run (or auto-play) prevents removable media, such as USB drives, from automatically executing pre-configured actions or launching programs when connected to a system. This critical security control stops malicious scripts or executables embedded on a USB device from running without user intervention, effectively mitigating the risk of automatic logins or malware infection initiated by simply plugging in a compromised drive. It directly addresses the automatic execution behavior.

Why this answer

USB auto-run devices can bypass authentication and pose a security risk. Disabling auto-run prevents unauthorized access and malware from executing automatically, which is a key security practice.

Full explanation →
112
MCQeasy

A receptionist holds the door for a person carrying a large box, assuming they work in the building. Later, that person is seen plugging a USB drive into a workstation in the finance department. Which social engineering technique was most likely used to gain initial access?

A.Phishing
B.Pretexting
C.Tailgating
D.Baiting
AnswerC

Tailgating occurs when an unauthorized person follows an authorized person into a restricted area without proper authentication.

Why this answer

Tailgating involves an unauthorized person gaining physical access to a secure area by following an authorized individual. In this scenario, the receptionist held the door for the person carrying a large box, assuming they worked in the building, which allowed the attacker to bypass physical security controls without authentication.

Exam trap

The trap here is that candidates confuse tailgating with pretexting, as both involve deception, but tailgating specifically relies on physical proximity and social norms rather than a fabricated story or identity.

How to eliminate wrong answers

Option A is wrong because phishing is a digital social engineering technique that uses deceptive emails or messages to trick victims into revealing credentials or installing malware, not physical access. Option B is wrong because pretexting involves creating a fabricated scenario or identity to obtain information, such as impersonating IT support, but here the attacker simply followed someone in without a detailed story. Option D is wrong because baiting involves offering something enticing (e.g., a free USB drive) to lure a victim into compromising security, but the attacker in this case used physical proximity, not a lure.

Full explanation →
113
MCQeasy

A technician is deploying a new virtual machine on a Type 1 hypervisor. The VM will run a Linux web server and needs to be isolated from the corporate network except for HTTPS traffic. Which networking configuration should the technician implement?

A.Bridge the VM directly to the physical network adapter
B.Use a virtual switch set to host-only mode and configure port forwarding for HTTPS
C.Attach the VM to a NAT network without any port forwarding
D.Assign the VM an IP from the corporate DHCP scope
AnswerB

Host-only mode creates a private virtual network between the VM and the host machine, completely isolating the VM from the external corporate network. This ensures the VM cannot be directly accessed or discovered by other devices on the corporate network. Configuring port forwarding specifically for HTTPS (port 443) on the host allows only this designated traffic to pass from the host to the isolated VM, precisely meeting the requirement for secure, controlled inbound access while maintaining maximum isolation.

Why this answer

A host-only virtual switch creates an isolated network between the host and the VM, preventing direct access from the corporate network. By configuring port forwarding on the host, the technician can selectively allow only HTTPS traffic (TCP/443) to reach the VM while keeping it otherwise isolated. This meets the requirement of isolation except for HTTPS.

Exam trap

In CompTIA A+ exams, candidates often confuse host-only and NAT networking modes, mistakenly thinking NAT alone provides inbound access, but NAT without port forwarding only allows outbound connections.

How to eliminate wrong answers

Option A is wrong because bridging the VM directly to the physical network adapter would place the VM on the same Layer 2 broadcast domain as the corporate network, providing no isolation. Option C is wrong because a NAT network without port forwarding would allow the VM to initiate outbound connections but would not permit inbound HTTPS traffic from the corporate network, failing the requirement to allow HTTPS. Option D is wrong because assigning the VM an IP from the corporate DHCP scope would give the VM a routable corporate IP address, making it directly accessible from the corporate network and defeating the isolation requirement.

Full explanation →
114
MCQeasy

A technician receives a complaint from a user that their email account was used to send spam. The user insists they did not send the emails. What is the MOST appropriate first step in handling this security incident professionally?

A.Tell the user they must have clicked on a phishing link and it's their fault.
B.Immediately reset the user's password and check the email logs for unauthorized access.
C.Ignore the complaint because spam is common.
D.Ask the user to change their password and not worry about it.
AnswerB

This is the most appropriate immediate response to a potential account compromise. Resetting the password severs any active unauthorized sessions and prevents further malicious activity from the compromised account, thereby securing it. Concurrently, examining email logs provides critical forensic evidence to identify the source, scope, and timeline of the unauthorized access, which is essential for understanding the attack vector and implementing broader preventative measures.

Why this answer

The immediate reset of the user's password stops further unauthorized use of the account, and checking email logs (e.g., SMTP logs, IMAP/POP3 access logs, or Exchange/Office 365 audit logs) allows the technician to identify the source of the spam, such as a compromised credential or a malicious forwarding rule. This follows the CompTIA A+ incident response procedure of containment first, then investigation, while maintaining professional communication with the user.

Exam trap

CompTIA often tests the candidate's ability to prioritize containment over investigation or blame; the trap here is that many candidates jump to blaming the user (Option A) or taking a passive approach (Option D), when the correct first step is to immediately secure the account by resetting the password.

How to eliminate wrong answers

Option A is wrong because blaming the user without evidence violates professional conduct and may overlook other causes like a compromised password or a malicious script on the client machine. Option C is wrong because ignoring a security incident, especially one involving unauthorized email use, violates security policy and could allow further damage or data breach. Option D is wrong because simply asking the user to change their password without verifying logs or resetting the account leaves the incident uncontained and fails to confirm whether the attacker still has access or has set up persistence mechanisms like forwarding rules.

Full explanation →
115
MCQeasy

During a security audit, it is discovered that an old server's hard drives were simply deleted and the server was sold to a recycler. The recycler later reported finding readable files on the drives. Which data disposal standard was violated?

A.NIST SP 800-88
B.PCI DSS
C.HIPAA
D.ISO 27001
AnswerA

NIST SP 800-88 provides comprehensive guidelines for media sanitization, defining methods such as 'Clear,' 'Purge,' and 'Destroy' to ensure data is unrecoverable. A security audit discovering improper data disposal, such as simple file deletion or reformatting, would directly cite a failure to adhere to these specific technical standards. This standard is the authoritative source for secure data destruction practices, making it the most direct and relevant answer for a violation involving inadequate sanitization procedures.

Why this answer

NIST SP 800-88 provides guidelines for media sanitization, including clear, purge, and destroy methods. Simply deleting files only removes directory pointers, leaving data recoverable until overwritten. The recycler's ability to read files indicates that the drives were not sanitized according to NIST SP 800-88 standards, which require overwriting or physical destruction for sensitive data.

Exam trap

CompTIA often tests the distinction between a general security framework (like HIPAA or PCI DSS) and a specific technical disposal standard (NIST SP 800-88), trapping candidates who confuse compliance requirements with the actual sanitization methodology.

How to eliminate wrong answers

Option B (PCI DSS) is wrong because PCI DSS is a security standard for payment card data, not a specific data disposal standard; while it requires secure disposal, it does not define the technical methods like NIST SP 800-88 does. Option C (HIPAA) is wrong because HIPAA governs protected health information (PHI) disposal but does not prescribe the specific sanitization techniques or levels (clear, purge, destroy) that NIST SP 800-88 details. Option D (ISO 27001) is wrong because ISO 27001 is an information security management system (ISMS) standard that requires a disposal policy but does not provide the granular, step-by-step sanitization procedures found in NIST SP 800-88.

Full explanation →
116
MCQmedium

A company's server room has a door with a proximity card reader. Employees report that the door sometimes does not close fully, allowing it to be pushed open without a card. What is the best solution?

A.Replace the proximity card reader with a biometric reader
B.Install a door closer mechanism
C.Add a security camera to monitor the door
D.Increase the frequency of badge audits
AnswerB

Installing a door closer mechanism directly resolves the issue of a door not closing properly. This device, typically hydraulic or spring-loaded, automatically pulls the door shut after it has been opened, ensuring it fully latches into the door frame. This physical control is a preventative measure that maintains the security perimeter of the server room by preventing the door from being inadvertently left ajar, thereby blocking unauthorized physical access.

Why this answer

The core issue is that the door fails to close fully, bypassing the proximity card reader's access control. A door closer mechanism is a mechanical device that automatically pulls the door shut, ensuring it latches and requires card authentication to re-enter. This directly addresses the physical vulnerability without changing the authentication method.

Exam trap

The trap here is that candidates focus on the authentication technology (card reader) rather than the physical barrier integrity, mistakenly thinking a stronger authentication method (biometric) will solve a mechanical latching problem.

How to eliminate wrong answers

Option A is wrong because replacing the reader with a biometric reader does not fix the mechanical problem of the door not closing; it only changes the authentication factor, leaving the bypass vulnerability intact. Option C is wrong because adding a security camera only monitors the door after the fact, it does not prevent unauthorized entry when the door is left ajar. Option D is wrong because increasing badge audit frequency is an administrative control that detects misuse but does not physically secure the door from being pushed open without a card.

Full explanation →
117
MCQeasy

A customer reports that their old laptop, which they sold online, still contains personal files that the new owner accessed. The customer had only performed a 'Reset this PC' with the 'Remove everything' option. What should the technician recommend to prevent this in the future?

A.Perform a factory reset from the recovery partition.
B.Use a third-party data wiping tool that overwrites the drive multiple times.
C.Remove the hard drive and physically destroy it.
D.Change the user password before selling.
AnswerB

A third-party data wiping tool is the most effective method for securely sanitizing a drive while keeping the hardware reusable. These tools overwrite every sector of the storage device with specific patterns, often multiple times, adhering to standards like DoD 5220.22-M or NIST SP 800-88. This multi-pass overwrite process renders previous data unrecoverable by even advanced forensic techniques, ensuring complete data privacy for resale.

Why this answer

The 'Reset this PC' with 'Remove everything' option in Windows performs a quick format or a single-pass overwrite, which leaves data recoverable by file recovery tools. A third-party data wiping tool that overwrites the drive multiple times (e.g., using the DoD 5220.22-M standard) ensures that the data is irrecoverable by overwriting all sectors with patterns, preventing any future access.

Exam trap

The trap here is that candidates assume 'Remove everything' in Windows performs a secure erase, but it only removes file pointers, not the underlying data, making it vulnerable to recovery.

How to eliminate wrong answers

Option A is wrong because a factory reset from the recovery partition typically performs a similar quick format or reinstallation, not a secure wipe, leaving data recoverable. Option C is wrong because physically destroying the hard drive is an extreme measure that is unnecessary for resale; secure wiping is sufficient and allows the drive to be reused. Option D is wrong because changing the user password does not remove or overwrite the existing personal files; the new owner can still access them via a password reset or by booting from external media.

Full explanation →
118
MCQhard

A technician is performing a routine software update on a finance department server. The change management documentation specifies that the update must be applied during a maintenance window from 2:00 AM to 4:00 AM. At 3:30 AM, the update fails with an error. The technician has no rollback plan documented. What should the technician do?

A.Attempt to roll back the update using the server’s built-in recovery options.
B.Leave the server in its current state and escalate the issue to the change manager.
C.Continue troubleshooting until the maintenance window ends, then document the failure.
D.Reboot the server to clear the error and retry the update.
AnswerB

Leaving the server in its current state is crucial as it preserves the system's exact condition and any error logs for forensic analysis, preventing further unintended changes. Escalating to the change manager ensures adherence to ITIL best practices, allowing for proper incident management and coordination with relevant teams, including the Change Advisory Board (CAB) if necessary. This approach facilitates a controlled resolution, minimizes business impact, and ensures the failure is documented for post-implementation review and process improvement.

Why this answer

The technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Exam trap

The trap here is that candidates assume built-in recovery options (Option A) are always safe to use, but the exam tests that without a documented rollback plan, any recovery attempt is an unauthorized change that violates change management procedures.

How to eliminate wrong answers

Option A is wrong because using the server’s built-in recovery options without a documented rollback plan is an unauthorized deviation from the change management process; it could cause irreversible data loss or configuration corruption, and the technician has no approved procedure to validate the recovery steps. Option C is wrong because continuing to troubleshoot past the maintenance window without authorization violates the change window constraints and could extend the outage beyond the approved downtime, increasing risk to the finance department’s operations. Option D is wrong because rebooting the server to clear the error and retrying the update is an unapproved action that may mask the root cause, potentially leading to a partial or inconsistent update state, and it ignores the requirement to escalate when the documented plan fails.

Full explanation →
119
MCQhard

A user's Windows 11 PC displays a 'Critical Process Died' blue screen error after a recent Windows Update. The system boots into a recovery loop. Which advanced startup option should be used to remove the problematic update?

A.Boot into Safe Mode from the recovery environment and uninstall the latest update.
B.Use System Restore to revert to a point before the update.
C.Run the Windows Memory Diagnostic tool to check for RAM issues.
D.Perform a clean installation of Windows 11 using the recovery USB.
AnswerA

This is the most direct and least disruptive solution when a critical process crash occurs immediately after an update, strongly indicating an incompatibility or corruption introduced by the patch. Safe Mode, accessed via the Windows Recovery Environment (WinRE), loads only essential system drivers and services, bypassing the problematic components. This allows the technician to boot the system stably and then use the "Uninstall Updates" feature in Windows Settings or Control Panel to remove the offending patch, resolving the critical process error without data loss.

Why this answer

Booting into Safe Mode from the Windows Recovery Environment (WinRE) allows you to access the desktop with minimal drivers and services, then use Settings > Windows Update > Update History > Uninstall updates to remove the problematic cumulative update. This directly addresses the 'Critical Process Died' bugcheck (0x000000EF), which often results from a corrupted system file or driver conflict introduced by a recent update, and Safe Mode bypasses the crash loop to enable the uninstall.

Exam trap

The trap here is that candidates often choose System Restore (Option B) because it sounds like a general 'undo' tool, but they fail to recognize that uninstalling the specific update is faster, more targeted, and does not require a pre-existing restore point, which may not exist after a forced update.

How to eliminate wrong answers

Option B is wrong because System Restore reverts the entire system state (registry, system files, installed applications) to a previous restore point, which is a broader and slower operation than simply uninstalling the specific update; it may also fail if no restore point exists or if the update itself corrupted the restore point data. Option C is wrong because the Windows Memory Diagnostic tool tests for physical RAM defects (e.g., bad memory cells, timing errors) and is irrelevant to a software-caused stop code like 'Critical Process Died' that stems from a Windows Update. Option D is wrong because performing a clean installation of Windows 11 using a recovery USB is a destructive, last-resort process that wipes all data and applications, whereas the problem can be solved non-destructively by simply removing the offending update.

Full explanation →
120
MCQmedium

Your company is deploying a new application that requires .NET Framework 3.5 on multiple Windows 10 workstations. You need to enable this feature on a single test machine first. Which tool should you use?

A.Programs and Features
B.Windows Features
C.Device Manager
D.Services
AnswerB

The "Turn Windows features on or off" utility, often accessed through Programs and Features, is the correct and dedicated interface for enabling or disabling optional Windows components. These features, such as Hyper-V, Internet Information Services (IIS), or specific versions of the .NET Framework, are pre-installed but not always active by default. This tool allows administrators to integrate these functionalities directly into the operating system, often without requiring separate installation media, to meet application dependencies.

Why this answer

Windows Features (accessible via 'Turn Windows features on or off' in the Control Panel or Settings) is the correct tool to enable .NET Framework 3.5 on a Windows 10 workstation. This feature includes .NET 2.0 and 3.0, and it can be installed from local sources or Windows Update. Programs and Features is used for uninstalling or changing installed programs, not for enabling Windows roles or features.

Exam trap

The trap here is that candidates confuse 'Programs and Features' (which manages installed applications) with 'Turn Windows features on or off' (which manages Windows components), leading them to select A instead of B.

How to eliminate wrong answers

Option A is wrong because Programs and Features is designed for managing installed applications (e.g., uninstalling, repairing, or changing software), not for enabling Windows OS features like .NET Framework 3.5. Option C is wrong because Device Manager is used to manage hardware devices, drivers, and resources (e.g., updating drivers, disabling devices), not for enabling software features. Option D is wrong because Services (services.msc) manages background Windows services (e.g., starting, stopping, or configuring service startup types), not for installing or enabling Windows features.

Full explanation →
121
MCQeasy

During a routine security audit, a technician discovers that a user's workstation has a program that records keystrokes and periodically sends the data to an external server. The user denies installing any software recently. Which type of malware is this?

A.Trojan horse
B.Worm
C.Keylogger
D.Ransomware
AnswerC

A keylogger is a type of surveillance software or hardware designed to record every keystroke made on a target computer's keyboard. These recorded inputs, which can include sensitive information like usernames, passwords, and credit card numbers, are then typically stored locally or covertly transmitted to a remote attacker's server. This direct and specific functionality of capturing and exfiltrating keystroke data precisely matches the scenario of a security audit discovering a mechanism for recording keystrokes and sending them to a server.

Why this answer

The program described records keystrokes and exfiltrates them to an external server, which is the defining behavior of a keylogger. This type of malware captures user input, such as usernames and passwords, and sends the data to an attacker. The user's denial of installing software suggests the keylogger may have been delivered stealthily, often via a Trojan horse or drive-by download, but the core functionality is keylogging.

Exam trap

The trap here is that candidates may confuse the delivery method (e.g., a Trojan horse) with the malware's primary function, but the question focuses on the observed behavior (keystroke recording and data exfiltration), which directly identifies it as a keylogger, not the method of installation.

How to eliminate wrong answers

Option A is wrong because a Trojan horse is a type of malware that disguises itself as legitimate software to trick users into installing it, but the question specifically describes keystroke recording and data exfiltration, which is the primary function of a keylogger, not the deceptive delivery mechanism of a Trojan. Option B is wrong because a worm is a self-replicating malware that spreads across networks without user interaction, exploiting vulnerabilities to propagate, whereas the described program does not exhibit self-replication or network-spreading behavior. Option D is wrong because ransomware encrypts files or locks the system and demands a ransom for decryption, which is not mentioned; the program here silently records keystrokes and sends data, not extorts the user.

Full explanation →
122
MCQmedium

A technician is troubleshooting a PC that repeatedly shuts down. The user mentions the computer is plugged into a power strip that also has a space heater and a laser printer. What is the most likely cause of the shutdowns?

A.The computer's power supply is failing.
B.The power strip is overloaded and cannot supply stable voltage.
C.The space heater is emitting electrical interference.
D.The laser printer needs a toner replacement.
AnswerB

An overloaded power strip occurs when the cumulative current draw of all connected devices exceeds the strip's maximum rated amperage. This excessive demand can lead to a significant voltage drop, known as a brownout, which causes sensitive electronics like a PC to shut down to protect components. Alternatively, the power strip's internal circuit breaker may trip, cutting power to prevent overheating and potential fire hazards.

Why this answer

The most likely cause is that the power strip is overloaded because it is simultaneously supplying power to a space heater (a high-wattage resistive load), a laser printer (which draws significant current during fuser warm-up), and the PC. This overload causes the power strip's circuit breaker to trip or the voltage to sag below the PC's power supply tolerance, resulting in repeated shutdowns. Option B is correct because the combined current draw exceeds the power strip's rated capacity, leading to unstable voltage delivery.

Exam trap

CompTIA often tests the concept that high-wattage peripherals sharing a power strip can cause voltage sags or breaker trips, leading candidates to incorrectly blame the PC's power supply (Option A) or assume electrical interference (Option C) rather than recognizing the simple overload condition.

How to eliminate wrong answers

Option A is wrong because a failing power supply typically causes random shutdowns or failure to power on, but the user's description of a shared power strip with high-draw devices points to an external power issue, not an internal component failure. Option C is wrong because electrical interference from a space heater would cause data corruption or erratic behavior, not systematic shutdowns; space heaters are resistive loads that do not generate significant EMI that would trip a PC's overcurrent protection. Option D is wrong because a laser printer needing a toner replacement would produce faded prints or a 'toner low' warning, but it has no effect on the PC's power stability or shutdown behavior.

Full explanation →
123
MCQmedium

A small office has several old CRT monitors that need to be replaced. The office manager asks the technician to simply place them in the dumpster. What should the technician do?

A.Comply with the manager's request to avoid conflict.
B.Break the monitors down to salvage the copper, then discard the glass.
C.Contact a licensed e-waste recycler to pick up the monitors for proper disposal.
D.Donate the monitors to a local school.
AnswerC

Contacting a licensed e-waste recycler is the correct and legally compliant method for disposing of old CRT monitors. These specialized facilities are equipped to safely handle and process hazardous materials such as leaded glass, cadmium, and mercury found within CRTs. They ensure that toxic components are properly neutralized or contained, and valuable materials are recovered, adhering strictly to environmental protection agency regulations and preventing ecological harm.

Why this answer

CRT monitors contain leaded glass and other hazardous materials, making them regulated e-waste. The technician must follow local hazardous waste disposal laws and arrange for proper recycling or disposal through a certified e-waste facility.

Full explanation →
124
MCQeasy

During a software installation, a technician receives a pop-up warning that the application requires administrator privileges. The user is logged in with a standard account. What is the most appropriate action for the technician to take?

A.Ask the user to log in with an administrator account and install the software.
B.Right-click the installer and select 'Run as administrator', then enter admin credentials.
C.Temporarily add the user to the Administrators group, install, then remove them.
D.Cancel the installation and escalate to a senior technician.
AnswerB

This is the most appropriate and secure method for installing software that requires elevated privileges. By right-clicking the installer and selecting 'Run as administrator', the User Account Control (UAC) prompt appears, allowing the technician to input their own administrative credentials. This grants the installer the necessary elevated permissions for the installation without permanently changing the user's account type or exposing administrative passwords to the end-user, thereby adhering to the principle of least privilege.

Why this answer

The technician can use the 'Run as administrator' feature to supply administrative credentials for a one-time elevated installation without changing the user's account type. This adheres to the principle of least privilege, maintaining security by not permanently elevating the standard user's rights.

Exam trap

CompTIA often tests the misconception that temporarily adding a user to the Administrators group is acceptable, when in fact the 'Run as administrator' feature is the proper, secure method for one-time elevation without altering account permissions.

How to eliminate wrong answers

Option A is wrong because asking the user to log in with an administrator account violates security best practices by exposing administrative credentials to a standard user and potentially leaving the system in an elevated state. Option C is wrong because temporarily adding the user to the Administrators group introduces unnecessary risk of privilege escalation and may leave residual group membership changes if not properly reverted. Option D is wrong because escalating to a senior technician is an overreaction for a routine task that the technician can resolve directly using 'Run as administrator'.

Full explanation →
125
MCQhard

A company is moving to a new office and needs to dispose of 200 fluorescent light tubes from the old ceiling fixtures. What is the legally required and environmentally responsible disposal method?

A.Break them into small pieces and place them in a sealed bag in the trash.
B.Contact a certified universal waste recycler to pick them up.
C.Place them in the regular recycling bin for glass.
D.Burn them in an industrial incinerator.
AnswerB

Contacting a certified universal waste recycler is the correct procedure because these facilities are specifically licensed and equipped to safely process mercury-containing lamps. They employ specialized techniques to capture mercury, separate glass and metal components, and ensure proper containment and recycling, thereby preventing environmental contamination and ensuring compliance with hazardous waste disposal regulations.

Why this answer

Fluorescent light tubes contain mercury, a hazardous substance, so they are classified as universal waste under the Resource Conservation and Recovery Act (RCRA). Option B is correct because certified universal waste recyclers are legally authorized to handle, transport, and recycle mercury-containing lamps, ensuring environmental compliance and safety.

Exam trap

The trap here is that candidates may assume 'recycling' means placing items in a standard bin, but CompTIA A+ 220-1202 tests the specific legal classification of fluorescent lamps as universal waste requiring a certified handler.

How to eliminate wrong answers

Option A is wrong because breaking fluorescent tubes releases toxic mercury vapor and creates hazardous dust, which is illegal under EPA universal waste rules and poses serious health risks. Option C is wrong because regular glass recycling bins cannot process mercury-containing lamps; the mercury would contaminate the recycling stream and violate hazardous waste disposal regulations. Option D is wrong because industrial incinerators are not designed for universal waste lamps; burning them releases mercury into the atmosphere, which is prohibited by the Clean Air Act and RCRA.

Full explanation →
126
MCQmedium

After a power outage, a Windows 10 computer boots to a black screen with the message 'Bootmgr is missing'. The technician has a Windows installation USB. Which repair command should be used to rebuild the Boot Configuration Data (BCD)?

A.From the recovery command prompt, run 'bootrec /fixmbr'.
B.Run 'bootrec /fixboot'.
C.Run 'bootrec /rebuildbcd'.
D.Run 'sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows'.
AnswerC

The 'bootrec /rebuildbcd' command is the correct solution because it actively scans all disks for compatible Windows installations and then rebuilds the Boot Configuration Data (BCD) store. The BCD store contains crucial boot configuration parameters and entries, including the location of the Windows operating system and its boot options. A 'Bootmgr is missing' error directly points to a corrupted or missing BCD, and this command effectively creates a new, functional BCD, resolving the issue.

Why this answer

The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is corrupted or missing. The 'bootrec /rebuildbcd' command scans all disks for Windows installations and prompts you to add them to a new BCD store, directly rebuilding the BCD. This is the correct repair for a missing or corrupt BCD, which is the specific cause of this error.

Exam trap

The trap here is that candidates confuse the purpose of 'bootrec /fixmbr' and 'bootrec /fixboot' (which repair the boot sector and MBR) with rebuilding the BCD store, leading them to choose a wrong option when the specific error is about a missing or corrupt BCD.

How to eliminate wrong answers

Option A is wrong because 'bootrec /fixmbr' repairs the Master Boot Record (MBR) on the system partition, which handles the initial boot process but does not rebuild the BCD store. Option B is wrong because 'bootrec /fixboot' writes a new boot sector to the system partition, which is used for loading the boot manager but does not address a missing or corrupt BCD. Option D is wrong because 'sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows' checks and repairs system file integrity, not the BCD store, and is used for corrupted Windows system files, not boot configuration data.

Full explanation →
127
MCQmedium

A small business owner reports that all their Microsoft Office documents are now encrypted with a '.crypt' extension and a ransom note demands payment in cryptocurrency. They have a backup from last week stored on an external drive that was disconnected after the backup. What is the best recovery strategy?

A.Pay the ransom to obtain the decryption key.
B.Restore the files from the disconnected external backup after removing the malware.
C.Run a decryptor tool downloaded from a random website.
D.Use System Restore to revert the system to a previous state.
AnswerB

Restoring files from a disconnected external backup is the most reliable and secure method for data recovery after a ransomware attack. Since the backup medium was offline, it remained immune to the encryption performed by the malware, preserving the integrity of the data. After thoroughly cleaning the infected system to ensure all traces of malware are eradicated, the unencrypted data can be safely restored, minimizing downtime and data loss.

Why this answer

Since the backup is offline and not encrypted, restoring from it is the safest and most reliable recovery method. Paying the ransom is discouraged as it funds criminals and may not work. The system should be cleaned of malware before restoration.

Full explanation →
128
MCQeasy

A small office is decommissioning several SSDs from old laptops. The technician needs to ensure data is destroyed securely and the drives can be resold. Which method is most appropriate?

A.Run a multi-pass overwrite with random data.
B.Use the ATA Secure Erase command.
C.Degauss the SSDs to remove magnetic data.
D.Perform a standard delete and empty the recycle bin.
AnswerB

Using the ATA Secure Erase command is the most effective and recommended method for securely decommissioning an SSD. This command is sent directly to the SSD's controller, which then executes an internal, low-level routine to erase all user-addressable NAND flash memory cells to an unprogrammed (empty) state. This process bypasses the file system and wear-leveling logic, ensuring comprehensive data removal and restoring the drive to a factory-like condition, making it safe for reuse or disposal.

Why this answer

The ATA Secure Erase command is the most appropriate method because it is specifically designed for SSDs, issuing a secure erase command at the firmware level that resets all cells to their unprogrammed state, effectively destroying all data in seconds. This method is reliable, fast, and does not wear out the NAND flash cells like multi-pass overwrites would, making it ideal for decommissioning and reselling SSDs.

Exam trap

CompTIA often tests the misconception that degaussing works on all storage media or that multi-pass overwrites are universally secure, when in fact SSDs require a different approach due to their NAND flash architecture and wear-leveling algorithms.

How to eliminate wrong answers

Option A is wrong because multi-pass overwrites are ineffective on SSDs due to wear leveling and the inability to target specific logical blocks; the drive's controller may remap writes to different physical cells, leaving original data intact. Option C is wrong because degaussing uses a strong magnetic field to erase data on magnetic media (HDDs), but SSDs store data electronically in NAND flash cells and are not affected by magnetic fields, so degaussing would not destroy the data and could damage the drive's controller. Option D is wrong because a standard delete and emptying the recycle bin only removes file system pointers, leaving the actual data recoverable with simple software tools, which is not secure destruction.

Full explanation →
129
MCQmedium

A user reports that their Windows 11 laptop suddenly shows a blue screen with an error message every time they try to boot. You need to access advanced troubleshooting options to repair the system. Which key should you press during startup to access the Windows Recovery Environment (WinRE)?

A.F8
B.F11
C.F2
D.F12
AnswerB

The F11 key is widely recognized on many modern Windows 11 systems as the hotkey to directly access the Windows Recovery Environment (WinRE). WinRE provides critical troubleshooting and repair options, such as Startup Repair, System Restore, Go back to the previous version, and the ability to access a command prompt for advanced diagnostics. This environment is essential for resolving boot issues or system instability when Windows fails to start normally, making it the correct choice for recovery.

Why this answer

Pressing F11 during the Windows 11 boot process is the standard key to access the Windows Recovery Environment (WinRE) on most modern systems. WinRE provides advanced troubleshooting tools such as System Restore, Startup Repair, Command Prompt, and Safe Mode, which are essential for repairing a system that fails to boot due to a blue screen error.

Exam trap

The trap here is that candidates often confuse the F8 key (used in legacy Windows) with the modern F11 key for WinRE, or they mistakenly think F2 or F12 are used for recovery instead of firmware or boot menu access.

How to eliminate wrong answers

Option A is wrong because F8 was used in older Windows versions (e.g., Windows 7) to access the Advanced Boot Options menu, but in Windows 11, the F8 key is disabled by default for faster boot times and is not the standard key to access WinRE. Option C is wrong because F2 typically enters the system BIOS or UEFI firmware settings, not the Windows Recovery Environment. Option D is wrong because F12 usually opens the one-time boot menu for selecting a boot device (e.g., USB or DVD), not WinRE.

Full explanation →
130
MCQhard

A company requires that all remote access sessions be recorded for compliance purposes. The current VPN solution does not support session recording. Which of the following additional technologies can be integrated to capture and store remote desktop sessions?

A.Implement a Remote Desktop Gateway with session recording software
B.Use SSH tunneling for all remote access
C.Configure the VPN to use PPTP instead of L2TP
D.Deploy a VNC server on each remote workstation
AnswerA

Implementing a Remote Desktop Gateway provides a secure, single point of entry for remote users to access internal network resources, such as RDP-enabled desktops and applications, without directly exposing those resources to the internet. This gateway can be integrated with third-party session recording software, which captures all user activity during their remote desktop sessions, ensuring comprehensive audit trails and compliance with company policies or regulatory requirements.

Why this answer

A Remote Desktop Gateway (RD Gateway) can be configured to broker and log RDP sessions, and when combined with a session recording solution, it can capture all activity. VPN alone does not provide session recording, and other methods like VNC or SSH typically lack built-in recording features.

Full explanation →
131
MCQeasy

A graphic designer needs to create a bootable macOS installer on an external SSD to deploy macOS Sonoma to multiple iMacs in the office. They have the 'Install macOS Sonoma.app' file. Which built-in macOS tool should they use to create the bootable drive?

A.Disk Utility to restore the .app file to the SSD.
B.System Information to verify the SSD is bootable.
C.Terminal with the 'createinstallmedia' command.
D.Migration Assistant to copy the app to the SSD.
AnswerC

The Terminal, combined with Apple's `createinstallmedia` command, is the official and most reliable method for creating a bootable macOS installer. This command-line utility, located within the macOS installer application bundle, automates the complex process of extracting the necessary boot files, copying the installation packages, and properly configuring a target USB drive or external volume to be bootable. It ensures the resulting media can be used to install macOS on compatible systems, making it the correct tool for this specific task.

Why this answer

The correct tool is Terminal with the 'createinstallmedia' command because it is the built-in macOS utility specifically designed to create a bootable installer from the 'Install macOS Sonoma.app' file. This command writes the necessary boot files and installer data to the target volume, ensuring the external SSD can boot and install macOS on multiple iMacs.

Exam trap

The trap here is that candidates may think Disk Utility can create a bootable installer by simply restoring the .app file, but Disk Utility cannot interpret an application bundle as a bootable source; only the 'createinstallmedia' command properly writes the installer's bootable structure.

How to eliminate wrong answers

Option A is wrong because Disk Utility cannot restore a .app file to create a bootable installer; it is used for formatting, partitioning, and restoring disk images, not for creating bootable macOS installers. Option B is wrong because System Information only reports hardware and software details, such as whether a drive is connected or its partition scheme, but it cannot create a bootable installer. Option D is wrong because Migration Assistant is designed to transfer user data, applications, and settings from one Mac to another, not to create bootable installer media.

Full explanation →
132
MCQmedium

A technician is configuring a new server and follows a documented standard operating procedure (SOP). After completion, the technician realizes the SOP is outdated and omits a critical security setting. What should the technician do?

A.Apply the missing setting and update the SOP to include it.
B.Ignore the missing setting since the SOP was followed.
C.Submit a change request to update the SOP without applying the setting.
D.Revert the server configuration and wait for an updated SOP.
AnswerA

Applying the missing setting corrects the security issue, and updating the SOP ensures the documentation is accurate for future use.

Why this answer

The technician discovered a security gap in the SOP that could leave the server vulnerable. The proper action is to immediately apply the missing critical security setting to protect the server, then update the SOP to reflect the correct procedure. This aligns with change management best practices where security findings take precedence over outdated documentation, and the SOP must be corrected to prevent future misconfigurations.

Exam trap

The trap here is that candidates may think following the SOP exactly is always correct, but CompTIA A+ tests the principle that security and risk mitigation override strict adherence to outdated documentation when a known vulnerability is identified.

How to eliminate wrong answers

Option B is wrong because ignoring a known security omission violates the principle of due diligence and could expose the server to exploitation; following an outdated SOP does not excuse the technician from applying necessary security controls. Option C is wrong because submitting a change request to update the SOP without applying the setting leaves the server in an insecure state during the approval process, which is unacceptable for critical security configurations. Option D is wrong because reverting the server and waiting for an updated SOP introduces unnecessary downtime and delays, while the technician already knows the correct setting and can apply it immediately to secure the server.

Full explanation →
133
MCQeasy

A user is traveling and needs to access a file on their office computer. They have a dynamic IP address at the hotel. Which remote access technology should the technician recommend for a secure connection?

A.Configure a direct RDP connection using the user's home IP address.
B.Set up a Virtual Private Network (VPN) client on the user's laptop to connect to the office network.
C.Use a remote desktop gateway that requires a static IP on the user's end.
D.Email the file to the user as an attachment.
AnswerB

Setting up a Virtual Private Network (VPN) client on the user's laptop is the most secure and flexible solution for remote access. A VPN establishes an encrypted tunnel over any internet connection, allowing the user's laptop to securely become a virtual part of the office network, regardless of the user's current IP address. This provides encrypted access to all authorized internal network resources, such as shared drives, applications, and other services, as if the user were physically in the office.

Why this answer

A VPN client creates an encrypted tunnel between the user's laptop and the office network, allowing secure access to files regardless of the user's dynamic IP address. VPNs authenticate the user and encrypt all traffic, protecting data over untrusted networks like hotel Wi-Fi.

Exam trap

CompTIA often tests the misconception that remote access requires a static IP or that direct RDP is acceptable, but the key is that a VPN handles dynamic IPs and provides encryption, which is essential for secure remote access over public networks.

How to eliminate wrong answers

Option A is wrong because a direct RDP connection using the user's home IP address is irrelevant—the user is at a hotel with a dynamic IP, not at home, and RDP directly exposed to the internet is insecure and not recommended. Option C is wrong because a remote desktop gateway does not require a static IP on the user's end; it typically uses a gateway server that accepts connections from any IP, but the statement incorrectly implies a static IP is mandatory. Option D is wrong because emailing the file as an attachment is not a remote access technology and poses security risks (e.g., interception, lack of encryption in transit) and does not provide ongoing access to the office computer.

Full explanation →
134
MCQeasy

A user working from home reports that they can no longer connect to the company's internal file server using Remote Desktop. They confirm their internet connection is working. Which remote access technology should the technician verify is still active on the user's VPN client?

A.SSH tunnel
B.Remote Desktop Gateway
C.VPN connection
D.VNC server
AnswerC

A Virtual Private Network (VPN) connection establishes a secure, encrypted tunnel between a remote user's device and the corporate network, effectively extending the internal LAN to the user's location. This connection is essential for routing traffic to internal IP addresses and accessing resources like RDP servers that are protected behind the corporate firewall. Therefore, verifying the operational status of the VPN client is the crucial first step to ensure the user has network connectivity to internal resources.

Why this answer

The user's internet connection is working, but they cannot reach the internal file server via Remote Desktop. This indicates the VPN tunnel, which provides encrypted access to the internal network, has likely dropped or is misconfigured. Without an active VPN connection, the user's client cannot route traffic to the private IP range of the file server, even though general internet access is available.

Exam trap

CompTIA often tests the misconception that Remote Desktop Gateway (RD Gateway) is a VPN client technology, when in fact it is a separate role that proxies RDP connections over HTTPS and does not provide full network-layer access like a VPN tunnel does.

How to eliminate wrong answers

Option A is wrong because an SSH tunnel is a port-forwarding mechanism typically used for secure shell access or specific TCP port forwarding, not for establishing a full network-layer connection to an internal corporate network; it would not be the primary technology verified on a VPN client. Option B is wrong because Remote Desktop Gateway (RD Gateway) is a role service that allows RDP connections over HTTPS from the internet, but it is not a VPN client technology; the question specifically asks about verifying a technology on the user's VPN client. Option D is wrong because a VNC server is a remote desktop sharing protocol that operates over a direct network connection or VPN, but it is not a VPN client technology itself; verifying a VNC server would not restore network-layer access to the internal file server.

Full explanation →
135
MCQhard

A technician is troubleshooting a network switch that has stopped working. Upon arrival, the technician notices a strong smell of burnt plastic and sees that the power cable is melted near the connector. What is the most appropriate safety action?

A.Unplug the power cable from the switch.
B.Turn off the circuit breaker supplying the outlet.
C.Replace the power cable with a new one.
D.Spray the cable with a Class C fire extinguisher.
AnswerB

Turning off the circuit breaker supplying the outlet is the safest and most effective method to de-energize the circuit in this scenario. This action completely isolates the power source from the outlet and the connected switch without requiring the technician to touch the damaged cable or the potentially compromised device. This adheres to fundamental electrical safety protocols, eliminating the immediate risk of electric shock or further damage while allowing for safe inspection.

Why this answer

The strong smell of burnt plastic and melted power cable indicate an electrical fault that could cause a fire or electric shock. Turning off the circuit breaker (Option B) is the most appropriate safety action because it disconnects power at the source, eliminating the risk of arcing or electrocution before any physical contact is made with the damaged equipment.

Exam trap

CompTIA often tests the misconception that unplugging the cable (Option A) is the fastest safe action, but the trap is that touching a melted or damaged connector while the circuit is live can cause electrocution or arc flash, making breaker isolation the correct first step.

How to eliminate wrong answers

Option A is wrong because unplugging the cable from the switch could expose the technician to arcing, electric shock, or burns if the connector is already damaged or shorted. Option C is wrong because replacing the cable without first de-energizing the circuit could cause a short circuit or fire if the outlet or switch power supply is still live. Option D is wrong because a Class C fire extinguisher is designed for electrical fires, but spraying a melted cable that is still energized may not address the underlying electrical hazard and could delay proper de-energization.

Full explanation →
136
MCQmedium

A technician is troubleshooting an Android tablet that cannot connect to a corporate Wi-Fi network. Other devices connect fine. The tablet shows 'Saved, secured' but no IP address. What is the most likely cause?

A.The Wi-Fi adapter is faulty.
B.The tablet has a static IP address configured that conflicts with the network.
C.The corporate network requires a VPN profile that is missing.
D.The tablet's MAC address is blocked by the router.
AnswerB

If a tablet is manually configured with a static IP address that conflicts with the network's DHCP range, is already in use by another device, or is on a different subnet than the gateway, it will fail to establish proper network communication. The "Saved, secured" status confirms successful authentication with the access point (Layer 2), but the incorrect static IP prevents the device from communicating at the network layer (Layer 3). This scenario perfectly explains why a device is connected but cannot access network resources or the internet.

Why this answer

The tablet shows 'Saved, secured' but has no IP address, indicating it successfully associated and authenticated with the Wi-Fi network but failed to obtain an IP address via DHCP. A static IP configuration that conflicts with the network's DHCP scope or subnet prevents the device from receiving a valid lease, causing the IP assignment failure while other devices using DHCP connect normally.

Exam trap

CompTIA often tests the distinction between Layer 2 (association/authentication) and Layer 3 (IP assignment) failures, and the trap here is that candidates assume 'Saved, secured' means full connectivity, overlooking that a static IP can cause a Layer 3 issue without any Layer 2 errors.

How to eliminate wrong answers

Option A is wrong because a faulty Wi-Fi adapter would typically prevent association or show 'Saved, secured' at all, and the tablet would likely not see the network or would fail during authentication. Option C is wrong because a missing VPN profile would not prevent IP address assignment; VPNs operate at a higher layer after a network connection is established, and the tablet would still get an IP address from DHCP. Option D is wrong because a MAC address block by the router would prevent association or authentication, resulting in a 'Saved' or 'Authentication error' status, not 'Saved, secured' with no IP address.

Full explanation →
137
MCQmedium

A technician is helping a customer configure a new laptop. The customer mentions they received a pop-up on their old computer warning of a virus and a phone number to call for support. The customer called the number and gave remote access to a 'technician' who then installed several programs. What social engineering attack occurred?

A.Shoulder surfing
B.Phishing
C.Tech support scam
D.Dumpster diving
AnswerC

A tech support scam is a form of social engineering where fraudsters impersonate legitimate technical support personnel or companies. They typically use unsolicited pop-up alerts, often displaying alarming security warnings or error messages, to panic users into calling a fake support number. Once contact is established, the scammers then manipulate the victim into granting remote access to their computer or paying for unnecessary "fixes," directly matching the described scenario of a pop-up prompting a phone call.

Why this answer

This is a classic tech support scam, a form of social engineering where attackers use fake virus warnings to gain remote access. The pop-up is designed to scare the user into calling a fraudulent support number. Once access is granted, the attacker can install malware or steal data.

Full explanation →
138
MCQmedium

A company requires that all sensitive data be encrypted when stored on laptops. Which technology should be implemented to ensure data is protected even if a laptop is stolen?

A.File-level encryption using EFS
B.BitLocker Drive Encryption
C.TPM chip only
D.Secure Boot
AnswerB

BitLocker provides full disk encryption, protecting all data on the drive, which is ideal for stolen laptops.

Why this answer

BitLocker Drive Encryption provides full-volume encryption that protects all data on the system drive, including the operating system, applications, and user files. Even if a laptop is stolen and the hard drive is removed, the data remains inaccessible without the correct recovery key or authentication credentials, ensuring compliance with data protection requirements.

Exam trap

The trap here is that candidates often confuse file-level encryption (EFS) with full-disk encryption, mistakenly believing that encrypting individual files provides sufficient protection for an entire stolen laptop, when in fact EFS leaves system files, temporary files, and the pagefile unencrypted and vulnerable.

How to eliminate wrong answers

Option A is wrong because file-level encryption using EFS (Encrypting File System) only encrypts individual files or folders and relies on the user's profile and certificate, which can be bypassed if an attacker gains administrative access or extracts the decryption keys from the operating system. Option C is wrong because a TPM chip alone does not encrypt data; it is a hardware component that stores cryptographic keys and can be used with BitLocker to enhance security, but without full-disk encryption software, the data on the drive remains unencrypted and readable. Option D is wrong because Secure Boot is a UEFI feature that verifies the integrity of the boot process to prevent unauthorized operating systems or malware from loading, but it does not encrypt any data on the storage device.

Full explanation →
139
MCQmedium

A technician is decommissioning a server that contained highly sensitive financial data. The server has multiple HDDs in a RAID array. The company policy requires data destruction to be certified. Which approach is most efficient and secure?

A.Perform a single overwrite on the RAID logical volume.
B.Remove each drive and wipe them individually using a secure erase tool.
C.Degauss the entire server chassis.
D.Reformat the RAID array and reinstall the OS.
AnswerB

Removing each drive and wiping them individually using a secure erase tool is the most effective method for decommissioning a server with highly sensitive data. This approach bypasses the RAID controller's abstraction layer, allowing direct access to every physical sector on each storage device. A secure erase tool, often implementing standards like NIST SP 800-88, ensures that all data, including hidden sectors and controller-managed areas, is irreversibly overwritten, guaranteeing complete data sanitization.

Why this answer

Secure erase tools (e.g., ATA Secure Erase) perform a cryptographic or full overwrite at the drive firmware level, ensuring each HDD is individually sanitized and can be certified. In a RAID array, the controller may cache or stripe data, so wiping the logical volume (Option A) or reformatting (Option D) does not guarantee all physical sectors on every drive are overwritten, leaving residual data recoverable. Degaussing (Option C) destroys the drives' magnetic media but is impractical for a full chassis and may not provide certified destruction for mixed media.

Exam trap

CompTIA often tests the misconception that wiping a RAID logical volume is equivalent to wiping each physical drive, but the trap is that RAID controllers abstract the physical layout, so logical operations may miss hidden or spare sectors on individual HDDs.

How to eliminate wrong answers

Option A is wrong because a single overwrite on the RAID logical volume only targets the logical block addresses presented by the RAID controller, not the physical sectors on each drive; RAID striping and spare sectors can leave data intact on individual HDDs. Option C is wrong because degaussing the entire server chassis is not feasible—degaussers require close proximity to each drive's platters, and the chassis itself may contain non-magnetic components (e.g., SSDs) that are not affected, plus it does not provide a verifiable certificate for each drive. Option D is wrong because reformatting the RAID array and reinstalling the OS only overwrites file system metadata and a small portion of the data area, leaving the vast majority of financial data recoverable with forensic tools.

Full explanation →
140
MCQmedium

A user calls the help desk because their Windows 10 PC is not showing any sound icon in the system tray, and audio is not working. You suspect the audio service is disabled. Which Control Panel applet would you use to check and restart the Windows Audio service?

A.Sound
B.Device Manager
C.Administrative Tools
D.System
AnswerC

Administrative Tools is a folder within the Control Panel (and also accessible via the Start Menu in some Windows versions) that consolidates shortcuts to various system management utilities. Crucially, it provides a direct shortcut to the "Services" console (services.msc), which is the primary graphical interface for viewing, starting, stopping, configuring startup types, and managing dependencies for all Windows services. This makes it the correct path for service management.

Why this answer

The Windows Audio service is a background service that must be running for audio to function. The Administrative Tools applet provides access to the Services console (services.msc), where you can check the status of the Windows Audio service and restart it if it is disabled or stopped. This is the correct tool because the Sound applet only configures playback devices and volume, not service states.

Exam trap

CompTIA often tests the misconception that the Sound applet or Device Manager can manage services, but only Administrative Tools (or directly running services.msc) allows you to check and restart the Windows Audio service.

How to eliminate wrong answers

Option A is wrong because the Sound applet is used to manage playback devices, recording devices, and system sounds, but it does not provide any interface to view or control Windows services. Option B is wrong because Device Manager is used to manage hardware drivers and devices, not to start or stop system services like Windows Audio. Option D is wrong because the System applet displays basic system information, such as OS version and hardware specs, and does not include service management capabilities.

Full explanation →
141
MCQeasy

A software deployment script fails because it cannot write to the /opt/app directory. The directory currently has permissions drwxr-xr-x and is owned by root. The script runs as a non-root user. Which command would allow the script to write files without compromising security more than necessary?

A.chmod o+w /opt/app
B.chmod 777 /opt/app
C.chown user:user /opt/app
D.chmod g+w /opt/app
AnswerA

The `chmod o+w /opt/app` command correctly adds write permission specifically for 'others' (users who are neither the owner nor in the owning group of the directory). If the deployment script runs as a non-root user that falls into this 'others' category, this command provides the necessary write access for the script to succeed. This approach adheres to the principle of least privilege by granting only the required permission without affecting owner or group access, thus maintaining a more secure system configuration.

Why this answer

Chmod o+w /opt/app adds write permission for 'others' (the non-root user), which is the minimal change needed. The script runs as a non-root user, so this grants write access without affecting group permissions.

Full explanation →
142
MCQmedium

A technician is configuring a new workstation for a user who is blind and uses a screen reader. The user requests that all software be installed with accessibility features enabled. During the setup, the technician encounters an error that requires a command-line fix. What is the most professional approach?

A.Perform the command-line fix silently and inform the user later that everything is working.
B.Explain that a command-line step is needed, ask if they are comfortable with that, and offer to complete it while describing the process.
C.Ask the user to watch the screen and guide you through the command-line steps.
D.Skip the accessibility features to avoid the error, since the screen reader works anyway.
AnswerB

This option demonstrates exemplary professional conduct by prioritizing user communication, consent, and accessibility. Explaining the necessary command-line step and offering to complete it while describing the process ensures the user is fully informed and comfortable with the procedure. This approach respects the user's autonomy and provides transparency, which is crucial for building trust and delivering inclusive technical support, especially when configuring accessibility features.

Why this answer

It respects the user's disability by seeking their consent and providing an accessible description of the command-line process, aligning with both professional communication and the requirement to maintain accessibility. The technician demonstrates empathy and collaboration, ensuring the user remains informed and in control of their workstation setup.

Exam trap

The trap here is that candidates may assume technical proficiency overrides user consent, or they may fail to adapt communication methods for users with disabilities, leading them to choose option A or C instead of the collaborative approach in B.

How to eliminate wrong answers

Option A is wrong because performing the fix silently violates professional ethics by withholding information from the user, especially one who relies on assistive technology and may need to understand the change for future troubleshooting. Option C is wrong because asking a blind user to watch the screen is insensitive and impractical, as screen readers provide auditory output, not visual guidance; this option shows a lack of understanding of accessibility needs. Option D is wrong because skipping accessibility features to avoid an error undermines the user's explicit request and could leave the system non-compliant with accessibility standards, potentially causing issues with the screen reader's functionality.

Full explanation →
143
MCQmedium

A user calls the help desk because their Windows 10 laptop will not connect to any Wi-Fi network. The Wi-Fi adapter is enabled in Device Manager and shows no errors, but the network list is empty. Other devices connect fine. Which command should be run first to reset the network stack?

A.Run 'ipconfig /release' followed by 'ipconfig /renew'.
B.Run 'netsh winsock reset' from an elevated Command Prompt.
C.Run 'sfc /scannow' to check system files.
D.Run 'net start wlansvc' to start the WLAN AutoConfig service.
AnswerB

The 'netsh winsock reset' command is the appropriate solution because it rebuilds the Winsock catalog, which is a critical component of the Windows network stack. Winsock provides a standard interface for Windows applications to interact with network protocols, and corruption within this catalog can prevent the system from properly detecting and displaying available networks. By resetting Winsock, the command effectively restores the network communication interface to its default, functional state, allowing networks to be visible again.

Why this answer

The 'netsh winsock reset' command is the correct first step because it resets the Winsock catalog, which manages network I/O and API calls. When the Wi-Fi adapter shows no errors but the network list is empty, the issue is often a corrupted Winsock configuration rather than a driver or service failure. This command restores the Winsock stack to a clean state without requiring a reboot, making it the most direct fix for this specific symptom.

Exam trap

CompTIA often tests the distinction between resetting the network stack (Winsock) versus restarting a service or refreshing an IP lease, and the trap here is that candidates mistakenly choose 'ipconfig /renew' because they think the issue is DHCP-related, when the empty network list indicates a lower-level Winsock corruption.

How to eliminate wrong answers

Option A is wrong because 'ipconfig /release' and 'ipconfig /renew' only refresh DHCP leases and IP addresses; they do not reset the network stack or fix a corrupted Winsock catalog, and they require an active connection to a network, which the user lacks. Option C is wrong because 'sfc /scannow' checks and repairs system file integrity, not the network stack; while a corrupted system file could theoretically cause network issues, it is not the first-line diagnostic for an empty Wi-Fi list with a functional adapter. Option D is wrong because 'net start wlansvc' starts the WLAN AutoConfig service, but the scenario states the adapter is enabled and shows no errors, implying the service is already running; forcing a start would either fail or be redundant, and it does not address Winsock corruption.

Full explanation →
144
MCQhard

A technician is troubleshooting an Android device that is unable to connect to a corporate Wi-Fi network using WPA2-Enterprise with a username and password. The device connects successfully to other open Wi-Fi networks. Which Android setting should the technician check first to resolve the authentication failure?

A.Verify that the device's IP address is set to DHCP.
B.Check if a CA certificate is installed and selected in the Wi-Fi network's advanced settings.
C.Disable the proxy settings for that Wi-Fi network.
D.Configure a static MAC address on the device.
AnswerB

In WPA2-Enterprise (802.1X) networks, a Certificate Authority (CA) certificate is essential for the client device to verify the authenticity of the RADIUS authentication server. This server validation prevents man-in-the-middle attacks by ensuring the client is communicating with a legitimate network component. If the required CA certificate is not installed on the Android device or is not correctly selected within the Wi-Fi network's advanced EAP settings, the authentication process will fail, preventing network access.

Why this answer

WPA2-Enterprise with username/password authentication typically requires a CA certificate to validate the RADIUS server's identity. Without a trusted CA certificate installed and selected in the Wi-Fi network's advanced security settings, the Android device will reject the connection attempt, even though the credentials are correct. This is the most common cause of authentication failure in enterprise Wi-Fi environments.

Exam trap

A common trap is that candidates think credential issues (wrong username/password) are the primary cause of WPA2-Enterprise failures, but the real issue is that Android requires explicit CA certificate selection for enterprise networks, unlike some other OSes that may use system certificates automatically.

How to eliminate wrong answers

Option A is wrong because DHCP vs. static IP addressing affects IP layer connectivity, not 802.1X/EAP authentication; the device can successfully obtain an IP address after authentication completes. Option C is wrong because proxy settings control application-layer traffic routing, not the underlying WPA2-Enterprise authentication handshake. Option D is wrong because configuring a static MAC address is unrelated to 802.1X certificate validation; MAC addresses are used for device identification, not for EAP-TLS or PEAP authentication.

Full explanation →
145
MCQmedium

During a routine security audit, you find that several workstations have the same local administrator password. The company policy requires unique passwords for each machine. Which tool or method should you use to enforce unique local administrator passwords across the domain?

A.Use Group Policy to set a standard local admin password.
B.Enable BitLocker on each workstation.
C.Deploy Microsoft LAPS (Local Administrator Password Solution).
D.Disable the local administrator account on all workstations.
AnswerC

Microsoft LAPS is specifically designed to address the challenge of managing local administrator account passwords across an organization. It automatically generates a unique, complex password for the local administrator account on each domain-joined computer, stores it securely in Active Directory, and can enforce password rotation policies. This solution ensures that each workstation has a distinct local admin password, significantly enhancing security and simplifying management.

Why this answer

Microsoft LAPS (Local Administrator Password Solution) is the correct tool because it automatically manages local administrator passwords on domain-joined computers, storing them in Active Directory and rotating them to unique values per machine. This directly enforces the policy of unique local admin passwords without manual intervention, using the `AdmPwd` extension and Group Policy to configure password complexity and rotation intervals.

Exam trap

CompTIA often tests the misconception that Group Policy can enforce unique passwords, but candidates must remember that Group Policy applies the same setting to all objects in its scope, making it unsuitable for uniqueness; LAPS is the specific Microsoft solution designed for this exact requirement.

How to eliminate wrong answers

Option A is wrong because using Group Policy to set a standard local admin password would enforce the same password on all workstations, directly violating the requirement for unique passwords per machine. Option B is wrong because BitLocker is a full-disk encryption technology that protects data at rest, not a mechanism for managing or rotating local administrator passwords. Option D is wrong because disabling the local administrator account is a security hardening measure but does not address the requirement for unique passwords; it avoids the password uniqueness issue rather than solving it, and some applications or scenarios may require the local admin account to remain enabled.

Full explanation →
146
MCQeasy

After installing a new printer driver, a user's Windows 11 computer crashes with a blue screen error every time they try to print. The computer works fine otherwise. Which boot option should be used to restore functionality without affecting user data?

A.Boot into Safe Mode and uninstall the printer driver.
B.Use Last Known Good Configuration to revert driver changes.
C.Run System Restore from the recovery environment.
D.Perform a clean installation of Windows 11.
AnswerA

Booting into Safe Mode is the most appropriate and least disruptive solution. Safe Mode loads Windows with a minimal set of drivers and services, specifically excluding non-essential components like the newly installed printer driver. This allows the operating system to start without encountering the crash caused by the faulty driver, enabling the technician to access Device Manager and safely uninstall the problematic software.

Why this answer

The problem is caused by a faulty driver, and the safest way to recover is to boot into Safe Mode, which loads only essential drivers. From Safe Mode, the technician can uninstall the problematic printer driver. This tests understanding of Safe Mode as a troubleshooting environment for driver conflicts.

Full explanation →
147
MCQmedium

A technician is troubleshooting an Android phone that cannot send or receive SMS messages, but can make and receive calls and use mobile data. The phone is on a corporate plan with a new SIM card. What is the most likely cause?

A.The phone's IMEI is blacklisted.
B.The SMS message center number is incorrect or missing.
C.The mobile data APN settings are incorrect.
D.The phone is in airplane mode.
AnswerB

The Short Message Service Center (SMSC) number is a crucial setting that directs outgoing SMS messages to the correct network gateway for delivery. If this number is either incorrectly configured, corrupted, or entirely absent from the phone's messaging settings, the device will be unable to send or properly route SMS messages. Critically, the SMSC only pertains to standard SMS, meaning other cellular functions like voice calls and mobile data would remain fully operational, aligning with a scenario where only SMS fails.

Why this answer

The SMS message center number (SMSC) is a required parameter stored on the SIM card or phone that tells the device where to route outgoing SMS messages for delivery. If this number is incorrect or missing, the phone cannot send or receive SMS, but voice calls and mobile data remain unaffected because they use separate signaling paths (CSFB for calls and packet-switched data for mobile data). A new SIM card may have a misconfigured or missing SMSC, which is the most likely cause given the symptom pattern.

Exam trap

CompTIA often tests the distinction between services that use the control plane (SMS, voice) versus the data plane (mobile data), leading candidates to incorrectly blame APN settings (Option C) when the issue is actually a missing SMSC number.

How to eliminate wrong answers

Option A is wrong because an IMEI blacklist blocks all cellular services (calls, SMS, data) on the network, not just SMS, and the phone can still make calls and use data. Option C is wrong because incorrect APN settings affect mobile data connectivity, not SMS; SMS uses the control channel (SS7 or SIP) and does not rely on APN configuration. Option D is wrong because airplane mode disables all radios, preventing calls, data, and SMS, which contradicts the symptom that calls and data work.

Full explanation →
148
MCQhard

A security incident response team needs to find all files in /var/www that have the SUID bit set, which may indicate a privilege escalation risk. Which command should they use?

A.find /var/www -type f -perm 4000
B.find /var/www -type f -perm /4000
C.ls -la /var/www | grep '^...s'
D.chmod -R u+s /var/www
AnswerB

The correct `find` command utilizes the `-type f -perm /4000` syntax, which signifies a 'bitwise OR' or 'any of' match for the specified permission bits. This ensures that any file with the SUID bit (4000) set, regardless of other standard read, write, or execute permissions, will be successfully identified. This method accurately targets all files where the SUID flag is active, fulfilling the requirement to locate them.

Why this answer

The `find` command with `-perm /4000` matches any file that has the SUID bit set (the 4000 octal permission), regardless of other permission bits. The `/` prefix tells `find` to match if any of the specified permission bits are set, which is the precise way to locate files with the SUID bit enabled. This command will recursively search `/var/www` for regular files (`-type f`) with the SUID bit, helping identify potential privilege escalation risks.

Exam trap

CompTIA often tests the distinction between `-perm 4000` (exact match) and `-perm /4000` (any match), where candidates mistakenly choose the exact match option, not realizing it will miss files with additional permission bits set.

How to eliminate wrong answers

Option A is wrong because `-perm 4000` matches files with exactly the permission 4000 (i.e., only the SUID bit set and no other bits), which would miss files that have the SUID bit set along with other permissions like 4755. Option C is wrong because `ls -la /var/www | grep '^...s'` only checks the first level of `/var/www` and does not search recursively, so it would miss files in subdirectories; also, the grep pattern is incorrect as it expects the SUID indicator in the owner execute position but does not account for other permission patterns. Option D is wrong because `chmod -R u+s /var/www` sets the SUID bit on all files and directories recursively, which is a dangerous action that would create privilege escalation risks, not find them.

Full explanation →
149
MCQmedium

A company uses a login script that sets environment variables and maps drives based on the user's department. The script works for most users, but some report that the drive mappings are missing. The script is written in batch and uses 'if' statements to check department codes. What is the most likely cause of the intermittent failures?

A.The script runs too early before the network is fully initialized
B.The department codes in the script do not match the actual codes due to case sensitivity
C.The script is using 'setx' instead of 'set' for environment variables
D.The user accounts lack permission to run login scripts
AnswerB

Batch script 'IF' comparisons, by default, are case-sensitive. If a login script uses a conditional statement like 'IF "%DEPARTMENT%"=="Sales"' to map a drive, but a user's actual department attribute is stored as "sales" or "SALES" in Active Directory, the condition will evaluate as false. This mismatch prevents the drive mapping for those specific users, explaining why some users experience successful mappings while others, whose department codes differ only in case, do not, leading to intermittent failures across the user base.

Why this answer

Batch file 'if' statements are case-sensitive by default when comparing strings. If the script checks for department codes like 'SALES' but the actual environment variable or user input contains 'sales' or 'Sales', the comparison fails and the drive mapping block is skipped. This explains why the issue is intermittent — it depends on how the department code is stored or passed.

Exam trap

CompTIA often tests the case sensitivity of batch file string comparisons, knowing that candidates assume string comparisons are case-insensitive by default, leading them to overlook this subtle but critical behavior.

How to eliminate wrong answers

Option A is wrong because network initialization issues would affect all users or cause complete failure, not just drive mappings for specific departments, and the script works for most users. Option C is wrong because 'setx' sets persistent environment variables, which would not cause intermittent drive mapping failures; the script uses 'set' for temporary variables, and the issue is with conditional logic, not variable persistence. Option D is wrong because if user accounts lacked permission to run login scripts, the script would fail entirely for those users, not just skip drive mappings intermittently.

Full explanation →
150
MCQhard

A technician is troubleshooting a Windows 10 computer that randomly restarts without any error message. The system does not create a minidump file. Which advanced startup option should be disabled in the System Properties to help capture the error for analysis?

A.Fast Startup
B.Automatic restart
C.Write an event to the system log
D.Small memory dump (256 KB)
AnswerB

The 'Automatic restart' option, found within the 'Startup and Recovery' settings under System Properties, directly governs the system's behavior immediately following a critical error like a Blue Screen of Death (BSOD). When this setting is enabled, Windows automatically reboots, often too quickly for a user to read the error message or for a complete memory dump file to be written. Disabling this feature is crucial for troubleshooting, as it forces the system to halt on the error screen, allowing technicians to gather vital diagnostic information and ensuring the memory dump process can successfully complete.

Why this answer

When 'Automatic restart' is enabled, the system restarts immediately after a critical error (BSOD) without displaying the error screen or creating a dump file. Disabling this option allows the system to halt on the blue screen, showing the error code and enabling dump file generation for troubleshooting.

Full explanation →
Page 1

Page 2 of 7

Page 3

All pages

1234567

Practice 220-1202 by domain

Target a specific domain to shore up weak areas.

Operating SystemsSecuritySoftware TroubleshootingOperational Procedures
See all domains with question counts →