CompTIA A+ Core 2 220-1202 (220-1202) — Questions 151–225

Option C is correct because toner powder is a fine, electrically charged plastic dust that can be hazardous if inhaled or if it melts into carpet fibers. Using a toner-rated vacuum with a HEPA filter safely captures the particles without dispersing them, or a damp cloth can be used to gently lift the toner without smearing it deeper into the carpet. This procedure follows manufacturer safety guidelines and prevents damage to standard vacuums, which can ignite or spread the toner.

Local Group Policy Editor (gpedit.msc) allows configuration of password policies on standalone systems. Password must meet complexity requirements and maximum password age can be set to 60 days.

On an open Wi-Fi network, an attacker can perform a man-in-the-middle attack to intercept unencrypted HTTP traffic. Without HTTPS, the login credentials are sent in plaintext and can be captured easily. This is a common risk on public Wi-Fi.

Two-factor authentication (2FA) adds a second factor beyond the password, such as a one-time code from an authenticator app. This significantly reduces the risk of account compromise even if the password is stolen.

USB auto-run devices can bypass authentication and pose a security risk. Disabling auto-run prevents unauthorized access and malware from executing automatically, which is a key security practice.

The wevtutil command can query event logs using structured XML queries, allowing you to filter events by time and ID (e.g., 4720 for user creation). It is a powerful tool for log analysis. Other commands either display logs without filtering or manage disk partitions.

Tailgating (or piggybacking) exploits human politeness and the natural instinct to hold doors for others, allowing unauthorized physical access. This attack often precedes other malicious actions like planting malware via USB.

Immediately removing an unknown USB device is crucial to prevent potential malware infections or data theft. This scenario tests incident response procedures for physical media threats.

Writing down passwords in plain sight is a security risk that directly enables shoulder surfing or dumpster diving. An attacker who sees the note can easily gain unauthorized access.

A virtual switch with a host-only or internal network isolates the VM from the corporate LAN, while port forwarding or a NAT rule allows specific inbound HTTPS traffic. This ensures the VM is not directly exposed to the broader network. The question tests understanding of virtual networking and security isolation.

Option B is correct because the immediate reset of the user's password stops further unauthorized use of the account, and checking email logs (e.g., SMTP logs, IMAP/POP3 access logs, or Exchange/Office 365 audit logs) allows the technician to identify the source of the spam, such as a compromised credential or a malicious forwarding rule. This follows the CompTIA A+ incident response procedure of containment first, then investigation, while maintaining professional communication with the user.

Simply deleting files or formatting does not meet data destruction standards. Proper methods like overwriting, degaussing, or physical destruction are required to ensure data is unrecoverable.

A door closer ensures the door automatically shuts and latches after each use, preventing it from being left ajar. This addresses the root cause of the security gap by maintaining the integrity of the access control system.

The correct answer is to use a drive wiping tool that overwrites all data multiple times. The 'Reset this PC' with 'Remove everything' does not securely erase data; it only resets the OS. This scenario highlights the difference between a simple reset and proper data sanitization.

Activity Monitor is the built-in macOS utility that displays real-time system resource usage, including memory, CPU, energy, disk, and network. The Memory tab shows memory pressure and per-process memory consumption, helping identify memory hogs. Force Quit is only for terminating applications, not for monitoring.

Option B is correct because the technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Option A is correct because booting into Safe Mode from the Windows Recovery Environment (WinRE) allows you to access the desktop with minimal drivers and services, then use Settings > Windows Update > Update History > Uninstall updates to remove the problematic cumulative update. This directly addresses the 'Critical Process Died' bugcheck (0x000000EF), which often results from a corrupted system file or driver conflict introduced by a recent update, and Safe Mode bypasses the crash loop to enable the uninstall.

Windows Features (optionalfeatures.exe) allows you to turn on or off Windows components, including .NET Framework 3.5. This is the standard method for enabling such features without downloading full installers.

Propping open a secured door bypasses all physical access controls, creating an immediate security risk. The first step is to close the door to restore security, then address the policy violation.

Services.msc (the Services console) is the tool for starting, stopping, and managing Windows services like the Print Spooler. It provides a graphical interface to control service status and startup type. Other tools like Task Manager or Event Viewer do not offer direct service management.

A keylogger is a type of spyware that records keystrokes to capture sensitive information like passwords. It often operates stealthily without the user's knowledge, matching the scenario where the user did not install anything. Spyware is the broader category, but keylogger is the specific variant described.

The most likely cause is that the power strip is overloaded because it is simultaneously supplying power to a space heater (a high-wattage resistive load), a laser printer (which draws significant current during fuser warm-up), and the PC. This overload causes the power strip's circuit breaker to trip or the voltage to sag below the PC's power supply tolerance, resulting in repeated shutdowns. Option B is correct because the combined current draw exceeds the power strip's rated capacity, leading to unstable voltage delivery.

Local Group Policy Editor (gpedit.msc) allows granular control over user permissions and system settings without removing admin rights. It can restrict specific actions like changing time or installing printers via Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

CRT monitors contain leaded glass and other hazardous materials, making them regulated e-waste. The technician must follow local hazardous waste disposal laws and arrange for proper recycling or disposal through a certified e-waste facility.

Option B is correct because the technician can use the 'Run as administrator' feature to supply administrative credentials for a one-time elevated installation without changing the user's account type. This adheres to the principle of least privilege, maintaining security by not permanently elevating the standard user's rights.

WPA2 or WPA3 with AES encryption provides strong wireless security. MAC address filtering can be added as an extra layer to restrict which devices can associate. This combination meets both requirements of encryption and device restriction.

Fluorescent light tubes contain mercury, a hazardous substance, so they are classified as universal waste under the Resource Conservation and Recovery Act (RCRA). Option B is correct because certified universal waste recyclers are legally authorized to handle, transport, and recycle mercury-containing lamps, ensuring environmental compliance and safety.

The System Restore tool rolls back system files and registry settings to a previous restore point, which can undo changes made by the problematic application. It does not affect personal files. The other options either don't target system changes or are too drastic.

The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is corrupted or missing. The 'bootrec /rebuildbcd' command scans all disks for Windows installations and prompts you to add them to a new BCD store, directly rebuilding the BCD. This is the correct repair for a missing or corrupt BCD, which is the specific cause of this error.

PCI passthrough allows a VM to directly access a physical PCIe device, providing the low-level access required by the legacy application. Type 2 hypervisors often support this for compatible hardware. This tests knowledge of hardware pass-through in virtualization.

Since the backup is offline and not encrypted, restoring from it is the safest and most reliable recovery method. Paying the ransom is discouraged as it funds criminals and may not work. The system should be cleaned of malware before restoration.

Dynamically expanding virtual hard disks can cause performance degradation because they grow as data is written, leading to fragmentation and increased I/O overhead. Fixed-size virtual hard disks pre-allocate space, reducing fragmentation and improving disk performance. The RAM and CPU configuration are not directly related to the disk slowness described.

SSDs require a secure erase command (ATA Secure Erase) to reset all cells to an empty state, making data unrecoverable and the drive reusable. Overwriting SSDs is less effective due to wear leveling, and degaussing can damage the controller.

Option B is correct because pressing F11 during the Windows 11 boot process is the standard key to access the Windows Recovery Environment (WinRE) on most modern systems. WinRE provides advanced troubleshooting tools such as System Restore, Startup Repair, Command Prompt, and Safe Mode, which are essential for repairing a system that fails to boot due to a blue screen error.

A Remote Desktop Gateway (RD Gateway) can be configured to broker and log RDP sessions, and when combined with a session recording solution, it can capture all activity. VPN alone does not provide session recording, and other methods like VNC or SSH typically lack built-in recording features.

This question covers Android parental controls. The correct answer is 'Google Family Link', a dedicated app and service that allows parents to manage app permissions, content filters, and screen time across Android devices. It is the standard tool for child safety on Android.

The 'createinstallmedia' command in Terminal is the official Apple tool for creating a bootable macOS installer from an application bundle. It writes the installer to the target volume and makes it bootable. Disk Utility can erase the drive but cannot create the installer media, and System Information does not have this capability.

Option A is correct because the technician discovered a security gap in the SOP that could leave the server vulnerable. The proper action is to immediately apply the missing critical security setting to protect the server, then update the SOP to reflect the correct procedure. This aligns with change management best practices where security findings take precedence over outdated documentation, and the SOP must be corrected to prevent future misconfigurations.

Option B is correct because a VPN client creates an encrypted tunnel between the user's laptop and the office network, allowing secure access to files regardless of the user's dynamic IP address. VPNs authenticate the user and encrypt all traffic, protecting data over untrusted networks like hotel Wi-Fi.

Malware often disables antivirus software and blocks access to security tools to avoid detection. This is a common sign of infection, and a boot-time scan or offline scan should be performed.

The user's internet connection is working, but they cannot reach the internal file server via Remote Desktop. This indicates the VPN tunnel, which provides encrypted access to the internal network, has likely dropped or is misconfigured. Without an active VPN connection, the user's client cannot route traffic to the private IP range of the file server, even though general internet access is available.

WinDbg (Windows Debugging Tools) is the correct built-in tool for analyzing memory dump (.dmp) files. It can parse crash dump data and identify the specific driver or module that caused the IRQL_NOT_LESS_OR_EQUAL stop code by examining the stack trace and loaded module list. This is the standard approach for post-mortem debugging of blue screen errors.

The netstat command with the -a (all connections) and -n (numerical addresses) options shows all listening ports and their associated processes. This is essential for security analysis. Other tools like nslookup resolve DNS, tracert trace routes, and ipconfig show IP configuration.

The strong smell of burnt plastic and melted power cable indicate an electrical fault that could cause a fire or electric shock. Turning off the circuit breaker (Option B) is the most appropriate safety action because it disconnects power at the source, eliminating the risk of arcing or electrocution before any physical contact is made with the damaged equipment.

The tablet shows 'Saved, secured' but has no IP address, indicating it successfully associated and authenticated with the Wi-Fi network but failed to obtain an IP address via DHCP. A static IP configuration that conflicts with the network's DHCP scope or subnet prevents the device from receiving a valid lease, causing the IP assignment failure while other devices using DHCP connect normally.

Kernel-Power 41 errors indicate unexpected shutdowns or restarts. Under heavy load, a failing power supply (even if it appears to function) can cause voltage drops that trigger restarts. However, if the PSU is ruled out, the most likely culprit is the motherboard, as it regulates power delivery to components and can cause instability under load.

This is a classic tech support scam, a form of social engineering where attackers use fake virus warnings to gain remote access. The pop-up is designed to scare the user into calling a fraudulent support number. Once access is granted, the attacker can install malware or steal data.

The ipconfig /release command releases the current DHCP lease, and ipconfig /renew requests a new IP address from the DHCP server. This is the standard troubleshooting sequence for IP configuration issues. Other commands either display information or flush DNS, which does not address the IP lease issue.

Full disk encryption (FDE) encrypts the entire drive, making data unreadable without the decryption key. This protects data in case of theft, as the drive cannot be accessed without proper authentication.

For RAID arrays, wiping each individual drive separately ensures that all data is destroyed, as RAID striping distributes data across drives. A single wipe of the logical volume may not cover all physical sectors. Certified destruction often involves physical shredding or secure wiping with verification.

This question tests knowledge of User Account Control (UAC) levels and their impact on standard users. The 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' setting allows standard users to be prompted for credentials without the secure desktop, which is the default behavior that was likely changed. Understanding the four UAC notification levels is essential for troubleshooting permission-related issues after updates.

Google Play Protect scans apps for harmful behavior, even sideloaded ones, and can block or warn about dangerous permissions. However, it is not foolproof. The technician should also check 'Install unknown apps' permissions.

The Windows Audio service is a background service that must be running for audio to function. The Administrative Tools applet provides access to the Services console (services.msc), where you can check the status of the Windows Audio service and restart it if it is disabled or stopped. This is the correct tool because the Sound applet only configures playback devices and volume, not service states.

The correct answer is A because chmod o+w /opt/app adds write permission for 'others' (the non-root user), which is the minimal change needed. The script runs as a non-root user, so this grants write access without affecting group permissions.

Option B is correct because it respects the user's disability by seeking their consent and providing an accessible description of the command-line process, aligning with both professional communication and the requirement to maintain accessibility. The technician demonstrates empathy and collaboration, ensuring the user remains informed and in control of their workstation setup.

WPA-TKIP is vulnerable and should be replaced. The best approach is to upgrade the router to support WPA2 and use WPA2-PSK with AES, which is backward-compatible with most devices. If some devices truly cannot support WPA2, they should be replaced or isolated.

Rootkits are deeply embedded and often cannot be removed by standard tools. The most reliable removal method is to wipe the drive and reinstall the operating system from a trusted source.

For magnetic HDDs, degaussing destroys data by disrupting the magnetic field, but it makes the drive unusable. Physical destruction (shredding) is also effective. Both methods produce scrap that can be recycled as e-waste.

The 'netsh winsock reset' command is the correct first step because it resets the Winsock catalog, which manages network I/O and API calls. When the Wi-Fi adapter shows no errors but the network list is empty, the issue is often a corrupted Winsock configuration rather than a driver or service failure. This command restores the Winsock stack to a clean state without requiring a reboot, making it the most direct fix for this specific symptom.

The useradd command with -m creates the home directory, and the default permissions are usually 755. To make it private, you need to change the permissions to 700 after creation, or use the -K UMASK=0077 option to set the umask during creation. The correct answer uses useradd with -m and then chmod 700.

Microsoft LAPS (Local Administrator Password Solution) is the correct tool because it automatically manages local administrator passwords on domain-joined computers, storing them in Active Directory and rotating them to unique values per machine. This directly enforces the policy of unique local admin passwords without manual intervention, using the `AdmPwd` extension and Group Policy to configure password complexity and rotation intervals.

The correct answer is the Battery Usage tool, which is a standard Android feature that breaks down power consumption by app and system services. This allows a technician to pinpoint which app is causing excessive drain and then force stop or uninstall it. Task Killers are not recommended, and a factory reset is too drastic for this issue.

The problem is caused by a faulty driver, and the safest way to recover is to boot into Safe Mode, which loads only essential drivers. From Safe Mode, the technician can uninstall the problematic printer driver. This tests understanding of Safe Mode as a troubleshooting environment for driver conflicts.

The SMS message center number (SMSC) is a required parameter stored on the SIM card or phone that tells the device where to route outgoing SMS messages for delivery. If this number is incorrect or missing, the phone cannot send or receive SMS, but voice calls and mobile data remain unaffected because they use separate signaling paths (CSFB for calls and packet-switched data for mobile data). A new SIM card may have a misconfigured or missing SMSC, which is the most likely cause given the symptom pattern.

The find command with the -perm /4000 option searches for files with the SUID bit set (the setuid permission). This is a standard security audit technique.

Supervised iOS devices can have restrictions enforced via MDM, including blocking app installations. The technician must check the MDM policy to allow app installs or whitelist the specific app.

The 'Wireless Diagnostics' tool includes a 'Monitor' mode and a 'Log' feature, but more importantly, it provides a 'Scan' and 'Info' view. However, to reset Wi-Fi configuration, you often need to remove plist files or use the 'Assist me' option in Network settings. The correct answer is Wireless Diagnostics because it offers a 'Wi-Fi Reset' option under the Window menu.

Batch file 'if' statements are case-sensitive by default when comparing strings. If the script checks for department codes like 'SALES' but the actual environment variable or user input contains 'sales' or 'Sales', the comparison fails and the drive mapping block is skipped. This explains why the issue is intermittent — it depends on how the department code is stored or passed.

When 'Automatic restart' is enabled, the system restarts immediately after a critical error (BSOD) without displaying the error screen or creating a dump file. Disabling this option allows the system to halt on the blue screen, showing the error code and enabling dump file generation for troubleshooting.

This is pretexting, where the attacker created a false identity (fire inspector) to gain trust and access. The best mitigation is implementing strict verification procedures for all visitors, including calling the agency they claim to represent.

An application gateway (reverse proxy) is the correct choice because it provides granular, application-layer access control, allowing remote employees to reach a specific internal application without granting them full network-level access. Unlike VPNs that create a tunnel to the entire network, an application gateway authenticates and proxies only the designated application traffic, often using protocols like HTTPS and enforcing policies at Layer 7.

Windows Memory Diagnostic (mdsched.exe) tests RAM for errors, but to analyze crash dump files, you use tools like WinDbg or the built-in Reliability Monitor. However, the question asks for a built-in tool to view dump files; the correct answer is Event Viewer, which logs crash events and can point to the dump file location.