CompTIA A+ Core 2 220-1202 (220-1202) — Questions 76–150

Option B is correct because it demonstrates professional due diligence: confirming the exact software list and version requirements prevents misconfigurations that could waste the executive's time later. A technician must verify requirements before installation to avoid compatibility issues or missing critical features, which is a core communication skill in the CompTIA A+ 220-1202 domain.

User Account Control (UAC) prompts for permission before allowing changes that affect system settings. If the user had denied the UAC prompt, the application would not have been able to modify network settings.

A quick format only clears the file table, leaving the actual data on the drive. This data can be recovered with simple software tools, exposing PII. Proper destruction (overwrite, degauss, or physical destruction) is required to prevent data recovery.

Option C is correct because certified e-waste recycling companies follow strict environmental regulations (e.g., the Basel Convention and local e-waste laws) to ensure hazardous materials like lead, mercury, and cadmium are safely extracted and disposed of, while also securely destroying data through methods such as degaussing or physical shredding. This approach minimizes environmental harm and aligns with the EPA's recommended practices for responsible electronics recycling.

Task Manager provides real-time performance monitoring, including CPU usage per process. This makes it the ideal tool for quickly identifying resource hogs. Other tools like Event Viewer or Services.msc are for different purposes.

Propping open a secured door completely bypasses the access control system, allowing unauthorized individuals to enter the server room undetected. This highlights the importance of maintaining door closure mechanisms to ensure physical security.

Group Policy can be used to block all USB storage by default, but you can create an exception by allowing specific devices via device ID or by using a more granular policy. The best approach is to temporarily grant access to the specific device, then reapply the block.

Option B is correct because the most common cause of a single device failing to connect after forgetting and re-entering the network is a typo or case-sensitive error in the Wi-Fi password. Since other devices connect fine, the issue is isolated to the phone, and verifying the password is the quickest, least intrusive step before escalating to more complex troubleshooting.

DISM (Deployment Imaging Service and Management Tool) can repair the system image that sfc relies on. Running DISM /Online /Cleanup-Image /RestoreHealth fixes corruption in the component store, allowing sfc to then repair system files.

The simultaneous failure of the flashlight and camera strongly points to a shared hardware component failure. Both the camera module and the LED flash are typically integrated on the same flex cable assembly or share a common power management IC. Since other apps function normally and the device has been restarted, a hardware fault in the camera module or its flex cable is the most likely cause.

Windows 10's S mode restricts app installations to the Microsoft Store, which also affects browser extensions. Disabling S mode or using a different browser that supports the extension is the solution.

This is a tech support scam using a social engineering tactic to frighten the user. The correct first step is to close the browser forcefully using Task Manager, then run a security scan. This tests the ability to distinguish between different attack types and appropriate response procedures.

The repeated tripping indicates the circuit is overloaded. The safest and most effective step is to redistribute the load by moving one high-power device to a different circuit and plugging the server directly into a dedicated wall outlet. This isolates the server's power draw and prevents overloading the shared circuit, addressing the root cause without bypassing safety limits.

The Bootrec.exe tool with the /FixMbr switch is used to repair the Master Boot Record in Windows. System Restore, SFC, and CHKDSK do not specifically repair the MBR.

The 'Prevent changing desktop background' policy, when enabled in Local Group Policy Editor (gpedit.msc) under User Configuration > Administrative Templates > Control Panel > Personalization, explicitly blocks background changes regardless of local administrator rights. Since the user has local admin rights but still sees the restriction, this policy is the most likely cause, as it overrides user permissions.

The folder with a question mark indicates the system cannot find a valid boot volume. This is often due to a corrupted boot loader or disconnected internal drive, not a failed backup or simple login issue.

This is baiting, where an attacker leaves a physical item (like a USB drive) in a location where it is likely to be found and used. The enticing label is the 'bait' that exploits human curiosity.

The '-ExecutionPolicy Bypass' parameter when launching PowerShell tells the PowerShell engine to bypass the execution policy for that session only, allowing any script to run without restriction. This is a common technique used by attackers because it does not require administrative privileges or permanent policy changes, making it stealthy and effective for executing malicious payloads.

EAP-TLS requires both the server and client to present valid certificates. If the client certificates are expired or not trusted by the RADIUS server, authentication will fail. This causes intermittent disconnects as clients attempt to reauthenticate.

Event Viewer's Windows Logs > Security log records all security-related events, including logon attempts (success and failure). This is the standard location for auditing user activity. Other logs like System or Application do not focus on authentication events.

iOS has a Portrait Orientation Lock in Control Center that prevents screen rotation. Toggling this off restores auto-rotation. Other settings like Display Zoom or Accessibility options do not lock orientation in this manner.

Task Manager's Startup tab allows you to manage per-user startup programs from a simple interface. For more control, you can also use the Startup folder or Registry, but Task Manager is the standard administrative tool for this task. Other tools like Services.msc or Group Policy are for system-wide or advanced configurations.

The black screen with a movable cursor after login, combined with the ability to open Task Manager via Ctrl+Alt+Del, indicates that the Windows shell (explorer.exe) has crashed or is not running. Restarting the 'Windows Explorer' process from Task Manager (File > Run new task > 'explorer.exe') reloads the desktop, taskbar, and File Explorer, restoring the graphical user interface. This is the standard recovery step for a missing shell in Windows 10.

Option A is correct because it balances transparency with professionalism: the technician clearly explains the issue (corrupt Outlook profile) and the necessary action (rebuild), while proactively managing expectations about a brief interruption. This approach respects the user's need to stay informed during an important project, aligning with ITIL best practices for incident management and user communication.

This is a phishing attack, specifically a form of spear phishing targeting a new employee. The email uses social engineering tactics (urgency, authority) to trick the recipient into clicking a malicious link that could steal credentials or install malware.

Slow shutdowns are often caused by services or drivers that fail to terminate properly. The Event Viewer logs system events, including errors and warnings during shutdown, which can pinpoint the offending component. This is more effective than generic performance monitoring or disk cleanup for this specific issue.

For traditional HDDs, a full overwrite with zeros or random data (often called wiping) renders the data unrecoverable without special equipment. Degaussing destroys the magnetic field but also renders the drive unusable; physical destruction is extreme; reformatting leaves recoverable data.

A lockable cabinet prevents physical access to the switch, and port security prevents unauthorized devices from connecting to the network. This question tests layered physical and logical security for network infrastructure.

This question focuses on the importance of creating a deployment plan or runbook before performing installations. Standardized documentation ensures consistency and reduces errors across multiple machines.

Option C is correct because it replaces confusing jargon with a simple analogy ('secure tunnel') and provides step-by-step guidance, which directly addresses the user's frustration and lack of technical knowledge. This approach aligns with the CompTIA A+ objective of adapting communication style to the audience, ensuring the user understands the VPN concept without needing to know terms like 'authentication protocol' or 'tunnel endpoint'.

Option B is correct because setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

The 'Previous Versions' tab is accessible via File Explorer by right-clicking a file or folder, selecting Properties, and then clicking the Previous Versions tab. This tab lists shadow copies or File History backups of the selected item, allowing you to restore an earlier version. In this scenario, since File History was enabled, the previous versions of the Documents folder will appear here for restoration.

The correct path is Settings > System > Power & battery > Screen and sleep. This is the modern location in Windows 11 for adjusting display and sleep timeouts, replacing the older Power Options in Control Panel.

Option B is correct because it balances the user's privacy concern with the technician's professional obligation to follow company policy. Documenting the incident (e.g., in a help desk ticket) is standard procedure for tracking PUP infections, which may indicate broader security issues like drive-by downloads or social engineering. The technician can remove the PUP using tools like Malwarebytes or AdwCleaner while omitting the user's name from unnecessary reports, preserving trust without violating policy.

Activity Monitor is the primary tool for viewing memory usage, identifying memory-hungry processes, and checking memory pressure. It helps pinpoint which app is leaking or consuming excessive RAM.

This scenario describes classic symptoms of a browser hijacker, a type of malware that modifies browser settings without user consent. The correct answer is to remove the malicious extensions and reset the browser settings. This reinforces the importance of managing browser extensions and understanding common malware behaviors.

Mobile Device Management (MDM) with a containerized work profile creates a separate, encrypted sandbox on the smartphone that stores corporate email and documents. This container can be remotely wiped by the administrator without affecting the user's personal data, ensuring no corporate data remains on a lost or wiped device.

Administrative Tools is the Control Panel applet that provides access to advanced system tools, including Event Viewer. To investigate a security breach, you would open Administrative Tools and then launch Event Viewer to review security logs for unauthorized access events. This is the correct path because Event Viewer is not directly listed in the main Control Panel categories; it is nested within Administrative Tools.

The correct answer is `bootrec /rebuildbcd`, which scans for Windows installations and rebuilds the BCD store. This is a standard repair for boot manager issues. Other commands are for disk checking, system file repair, or partition management.

Ransomware encrypts files and demands payment for decryption. This scenario describes classic ransomware behavior, where the user is locked out of their data and a ransom note is displayed.

Full-disk encryption protects data at rest, and a BIOS/UEFI password prevents unauthorized booting or tampering with boot settings. This question tests the combination of controls needed for remote device security.

Since the user can send emails but not receive them, the issue is isolated to the incoming mail path. IMAP uses port 143 (or 993 for SSL/TLS) to retrieve messages, and the incoming server settings (server address, port, security type) must match the corporate email configuration. Incorrect IMAP settings would prevent the device from connecting to the server to download new emails, while SMTP (outgoing) settings remain unaffected, explaining the send-only symptom.

Logical security controls restrict access to digital resources. For physical access to a server room, a smart card or key fob system provides a good balance of cost and security by requiring something the user possesses. This question tests the understanding of logical versus physical controls and the principle of least cost for basic access control.

Local Group Policy Editor (gpedit.msc) allows you to configure security and restriction policies on a standalone computer. You can disable the ability to install software by setting the 'Disable Windows Installer' policy and restrict access to Control Panel settings. This is the appropriate tool for a non-domain joined machine.

The technician enabled the dedicated device management app but did not activate Android's 'Lock task mode' (or 'Pin app' feature). This mode is required to pin the kiosk app to the foreground and block system navigation keys (Home, Recent Apps), preventing users from exiting the app. Without it, the Home button remains functional, allowing escape from the kiosk environment.

A DNS-based content filter (like OpenDNS or a corporate DNS server) can block malicious domains without requiring client software. This is a scalable solution for network-wide filtering.

OpenVPN is the correct choice because it provides a robust balance of security and compatibility, especially for remote users behind NAT. It uses SSL/TLS for encryption and can operate over a single UDP or TCP port (typically 1194), which easily traverses NAT without requiring additional configuration. Unlike L2TP/IPsec, OpenVPN does not rely on IPsec's NAT-sensitive protocols like ESP, making it more reliable across home routers.

A browser hijacker modifies browser settings like the homepage and adds unwanted toolbars. It often installs silently through drive-by downloads or bundled with other software. Removal requires resetting the browser and scanning with anti-malware tools.

This scenario tests the understanding of cloud service models and common issues. The correct answer is B because the problem is isolated to a single cloud service, indicating a service outage on the provider's end, not a local network or client issue. The other options are less likely as the internet is working and other services are accessible.

Dumpster diving is the physical act of searching through trash to find sensitive information. This attack relies on the failure to properly dispose of documents. Shredding or secure disposal policies are essential countermeasures.

Preventing physical theft requires both a physical lock (cable lock) to secure the device and full-disk encryption (like BitLocker) to protect data if the drive is removed. This is a layered approach.

The correct answer is A because find /var/log -mtime -1 finds files modified less than 1 day ago. The -mtime flag with a negative number means modified within the last n days.

An 'Access is denied' error when other users can print indicates that the user's permissions are the problem, not the printer or driver. This usually means the user account does not have the necessary permissions on the print server or the printer itself.

The 'INACCESSIBLE_BOOT_DEVICE' error often occurs after a faulty storage controller driver update. Booting into Safe Mode with minimal drivers can bypass the problematic driver. The command 'bcdedit /set {default} safeboot minimal' configures the boot loader to start Windows in Safe Mode on the next restart, loading only essential drivers and services, which allows the technician to roll back or uninstall the offending driver.

Disabling split tunneling ensures that all traffic from the remote user's device is routed through the corporate VPN tunnel, enforcing security policies such as content filtering and intrusion detection. When split tunneling is enabled, only traffic destined for the corporate network goes through the VPN, while internet-bound traffic bypasses it, violating the requirement. This setting is typically configured in the VPN client or server profile (e.g., using the 'DisableSplitTunneling' registry key on Windows or the 'tunnel-all' directive in OpenVPN).

Tailgating occurs when someone slips in behind an authorized user. A mantrap is a small room with two interlocking doors that only allows one person to pass at a time, effectively preventing tailgating.

Option B is correct because after basic troubleshooting (cache clear and re-pair) fails, the next logical step is to check for firmware updates on the car's infotainment system. Bluetooth connectivity issues between a phone and a car are often caused by incompatibilities or bugs in the car's Bluetooth stack, which can be resolved by updating the car's firmware. The technician should prioritize updating the car's system before considering hardware replacement or more drastic phone resets.

Option B is correct because the scheduled firmware update directly caused the printer to become inaccessible, and without a documented rollback plan, reverting to the previous firmware version is the safest and most immediate way to restore service. This aligns with change management best practices, which prioritize backing out a failed change before troubleshooting further, as the root cause is clearly the firmware update.

The correct answer is D because find / -name notes.txt searches the entire filesystem starting from root (/) for a file with that exact name. The -name flag is case-sensitive, which is appropriate here.

CRT monitors contain hazardous materials like lead and phosphor, making them e-waste that cannot be disposed of in regular trash. Certified e-waste recycling companies follow environmental regulations to safely dismantle and recycle these components, ensuring legal compliance and responsible handling.

The 'xcopy' command with the /d switch copies files only if the source is newer than the destination. This is a common requirement for updating configuration files without overwriting newer local versions. The /y switch suppresses confirmation prompts.

WPA3-SAE uses AES encryption by default and is the most secure option. It also provides forward secrecy and protection against offline dictionary attacks. The policy requires AES, and WPA3 meets that while being the latest standard.

PUPs like browser hijackers often come bundled with free software. Using a dedicated PUP removal tool or adware cleaner is more effective than a standard antivirus scan. After removal, resetting the browser ensures all changes are reverted.

Adware displays unwanted advertisements and often masquerades as legitimate processes. The misspelled 'svch0st.exe' mimics a Windows system process, a common adware tactic. This malware type is best removed using a dedicated anti-malware tool.

Deleting files and emptying the Recycle Bin does not actually remove data from the drive; it only marks the space as available. Proper sanitization requires overwriting or physical destruction to prevent recovery.

Option C is correct because industrial shredding physically destroys the platters into small fragments, making data recovery impossible, and the resulting metal fragments can be recycled, minimizing environmental impact. Unlike degaussing or drilling, shredding ensures complete destruction without leaving large e-waste components, and the recycling of ferrous and non-ferrous metals reduces raw material extraction.

Option C is correct because toner powder is extremely fine and can become airborne if mishandled. Blotting with a cold, damp cloth prevents the toner from spreading, and using a HEPA-filter vacuum ensures that microscopic toner particles are trapped without being exhausted back into the environment. Standard vacuum cleaners lack HEPA filtration and can release toner dust into the air, causing respiratory hazards.