CompTIA A+ Core 2 220-1202 (220-1202) — Questions 226–300

Android's Work Profile (part of Android Enterprise) creates a separate, managed profile on the device for work apps and data. This allows IT to enforce policies (like encryption and remote wipe) on the work profile without affecting the personal profile. Multi-User mode is for separate users, not a single user with two contexts, and Screen Pinning is for single-app lockdown.

The correct answer is B because the scenario describes a cramped, dusty storage room with poor lighting, which creates two immediate hazards: inhalation of dust particles and reduced visibility. Wearing a dust mask protects the technician's respiratory system from airborne particulates, while using a flashlight ensures they can see clearly to avoid accidental contact with components or cables. These measures directly address the environmental risks before any work begins.

Option B is correct because it demonstrates professional communication by clearly explaining the standard deployment process—which includes user training and data migration—and offering a revised timeline. This aligns with the CompTIA A+ objective of managing expectations and ensuring a complete, effective rollout rather than a rushed, incomplete installation.

Powercfg /batteryreport is the correct built-in tool because it generates a comprehensive HTML report detailing battery capacity history, usage patterns, and estimated life. This command analyzes the system's power efficiency and battery health, which directly addresses the user's complaint of rapid drain even when idle, without relying on running processes visible in Task Manager.

Cloning an RFID badge exploits the lack of mutual authentication. Smart cards with cryptographic chips are much harder to clone because they require a private key stored on the card that cannot be easily extracted.

SSH (Secure Shell) is the correct choice because it provides encrypted, authenticated remote shell access to Linux/Unix servers over an insecure network. It uses TCP port 22 and supports strong encryption algorithms (e.g., AES, ChaCha20) and public-key authentication, making it the standard secure remote access protocol for Linux systems.

After removing the initial malware, additional payloads or backdoors may remain. Running a second opinion scanner like Malwarebytes can detect remnants that the primary antivirus missed. Reimaging is drastic if not yet necessary, and resetting the browser or disabling startup items may not address hidden threats.

This tests understanding of script execution context and permissions. When a script runs under a user account, it may not have the necessary permissions to access network resources or system files after reboot if the user isn't logged on. The 'run whether user is logged on or not' option requires the password to be stored, and if the password changes or is not provided, the task fails.

The ping -t command sends continuous ICMP echo requests until stopped, and appending > log.txt redirects output to a file. This allows for long-term monitoring of connectivity. Other commands either perform a single test or trace the route.

Donating or recycling the CDs through a media recycling program is the best approach. CDs are made of polycarbonate and can be recycled, but they should not go into regular trash. This question tests knowledge of proper disposal of electronic media.

Windows 11 includes a Windows 10 compatibility mode that can be applied to individual applications. Using the Application Compatibility Toolkit (ACT) or the built-in compatibility troubleshooter to set the application to run in Windows 10 compatibility mode is the most efficient fix, as it does not require a full OS rollback.

The netstat -b command displays active connections along with the executable involved in creating each connection, making it ideal for identifying suspicious processes. Other options either show process information without network details or vice versa.

DNS filtering is a network-level solution that blocks access to malicious domains without client software. This tests knowledge of different security implementations. Other options are either client-side or not effective for blocking specific sites.

The strong ozone smell indicates a high-voltage issue, likely with the corona wire or power supply. Before servicing, you must unplug the printer and discharge the high-voltage power supply to prevent electric shock, as laser printers store lethal voltages in capacitors even when powered off.

The correct answer is C because chmod 600 sets owner read/write and removes all permissions for group and others. This matches the requirement that only root can read and write the file.

The script needs to conditionally execute code based on whether a registry key exists. An if-else statement is the correct construct for this because it evaluates a condition (e.g., Test-Path 'HKLM:\Software\MyKey') and executes one block if true (modify the key) and another if false (skip or create). Loops are for repetition, not conditional branching, and try-catch handles runtime errors, not existence checks.

Option C is correct because it demonstrates active listening and empathy while immediately addressing the technical issue. The technician first allows the user to vent without interruption, then acknowledges the urgency and proposes a clear, step-by-step recovery plan starting with the Recycle Bin (a common first-resort recovery method) and escalating to backups if needed. This approach de-escalates the emotional situation while efficiently moving toward a solution, which is key for professional customer service in IT support.

The Services console (services.msc) is the correct tool to view and manage the status of the Workstation service (LanmanWorkstation), which is required for SMB connections to network shares. The other tools are not designed for service management.

Multifactor authentication requires two or more factors from different categories: something you know (password), something you have (smart card, token), and something you are (biometric). A password plus a one-time code from a hardware token uses two distinct factors, satisfying the policy.

This describes tailgating, where an attacker follows an authorized person into a secure area without proper credentials. The use of a former employee's badge suggests the attacker may have obtained it through theft or social engineering. Proper badge deactivation upon termination is a key countermeasure.

The correct answer is to use a degausser rated for magnetic tape, which will erase the data by randomizing the magnetic particles. Physical destruction (shredding) is also effective but may be more costly. This question tests knowledge that tape media requires specialized degaussers.

Verifying the caller's identity before making any access changes is a critical security practice to prevent social engineering attacks. This scenario tests the balance between customer service and security protocol.

This is a phishing attack, where the attacker creates a fake login page to steal credentials. Users should be trained to verify URLs and never enter credentials from email links.

Fast roaming (802.11r) allows clients to quickly re-authenticate when moving between access points, reducing latency. WPA2-Enterprise alone does not provide fast roaming; 802.11r must be enabled on the controller and access points.

Option B is correct because pressing and holding the power button for 10 seconds after unplugging the system discharges the remaining charge in the power supply capacitors and other components, reducing the risk of electric shock or damage. Wearing an ESD strap then provides a path to ground for static electricity, protecting sensitive internal components from electrostatic discharge.

Physical destruction methods like shredding or crushing provide verifiable destruction (e.g., through a certificate of destruction) and ensure the drives cannot be reused, meeting strict security policies. Degaussing also destroys data but may not physically destroy the drive.

The Windows Defender Firewall with Advanced Security (wf.msc) is the correct tool because it provides granular control over inbound rules, allowing the technician to block all incoming connections by default and then create explicit allow rules for specific applications. This meets the security policy requirement for a host-based firewall that blocks incoming traffic except for permitted applications.

This attack exploits curiosity and the baiting principle, where an attacker leaves a malicious device in a place where it will be found. The enticing label increases the likelihood of someone picking it up. This is a form of social engineering that relies on human psychology rather than technical vulnerabilities.

The correct answer is `regsvr32` which is used to register or unregister DLL files. This command verifies that the necessary DLLs are properly registered, which is essential for application functionality. Incorrect answers involve network configuration, file system repair, or process listing.

This is a classic vishing (voice phishing) attack combined with a tech support scam. The attacker used a phone call to impersonate a trusted entity and tricked the user into installing remote access software, giving the attacker control over the device to perform fraudulent transactions.

Services.msc provides a complete list of all Windows services, including those related to network discovery and sharing. You can check their status and start them if they are stopped. Other tools like Network and Sharing Center or Device Manager do not offer direct service management.

This question tests knowledge of kiosk mode configuration. Windows 10 supports 'Assigned Access' which can be configured to automatically log on a specified user account and launch a single app. This requires enabling the 'Automatic logon' setting in the registry or via the 'netplwiz' tool, and then configuring Assigned Access for that account.

Since the user can reach the VPN server, the issue is likely at the authentication or configuration layer. Checking the VPN client logs provides detailed error messages that can pinpoint the problem.

Event Viewer contains Security logs that record logon events (success and failure) with timestamps and user account details. This is the primary tool for auditing user logon activity on Windows.

Invoke-Command is the correct cmdlet because it is designed to execute PowerShell commands or script blocks on one or more remote computers and return the results to the local session. This allows the technician to run the IP configuration retrieval script against all domain computers from the management workstation and then pipe the output to Export-Csv.

The correct answer is to use the built-in 'Reset this PC' with the 'Remove everything and clean the drive' option, which performs a secure wipe on SSDs. This ensures data is overwritten while keeping the laptop usable. Simple deletion or formatting is insufficient, and physical destruction would make the laptop unusable.

This tests the find command with the -mtime option, which filters files by modification time. find /var/log -mtime 0 finds files modified within the last 24 hours.

Full disk encryption (FDE) protects all data on the drive by encrypting it, making it unreadable without the decryption key. BitLocker is the native FDE solution in Windows 10 Pro. This question tests the understanding that FDE is the appropriate countermeasure for data theft from stolen devices, as opposed to file-level encryption or access controls.

The correct answer is to use a certified e-waste recycler that performs secure data destruction. This ensures data is destroyed (often via shredding or degaussing) and the materials are recycled responsibly. Simple wiping may not be sufficient for all drives, and donating without destruction risks data exposure.

BitLocker is the native full-disk encryption feature in Windows 11 Pro that encrypts the entire system drive, including the operating system, applications, and all user data. If the laptop is stolen, the data on the drive remains unreadable without the recovery key or TPM authentication, even if the drive is removed and attached to another computer. This directly addresses the requirement to prevent data access after theft.

This question tests enterprise deployment tools. The correct answer is 'Android Enterprise' (formerly Android for Work), which supports zero-touch enrollment and managed configurations via a Mobile Device Management (MDM) system. This enables bulk provisioning without manual setup.

This question tests basic error handling in scripting. Adding error-checking logic, such as checking the exit code of 'net use' and retrying if it fails, makes the script more robust. A simple 'if errorlevel' or 'if %errorlevel% neq 0' construct allows the script to retry the command instead of failing silently.

The correct answer is `net use Z: \\Server\Data /persistent:yes`. This command maps the network drive and makes it persistent so it reconnects at logon. Other commands deal with user accounts, disk repair, or network configuration.

A systematic approach to troubleshooting shows competence. Starting with simple checks and explaining each step keeps the customer informed and involved.

Remote Desktop Protocol (RDP) is highly sensitive to upload bandwidth because it transmits screen updates, keyboard/mouse input, and clipboard data from the client to the server. With only 10 Mbps upload at the user's home, the bottleneck is the user's upstream capacity, which is insufficient to handle the continuous screen refresh and input data required for a smooth RDP session, especially if the remote desktop is graphics-intensive or has high resolution.

Option A is correct because it directly addresses the manager's concern about productivity loss by clearly explaining the security risk (data theft via an unpatched vulnerability) and why the reboot is necessary to apply the update. This approach uses risk-benefit language that a non-technical manager can understand, aligning with the CompTIA A+ objective of communicating technical requirements to stakeholders in business terms.

A worm that spreads via network shares requires immediate network segmentation to stop propagation. Disabling the network shares on all workstations and isolating infected systems from the network prevents the worm from reaching other devices. Patching the vulnerability used for spread (e.g., SMB) is also critical, but containment is the priority.

A keylogger records keystrokes to steal credentials and sensitive data. As a kernel-level rootkit, it hides from standard scans. Booting from a rescue disk and using a specialized anti-rootkit tool is necessary to remove it without reinstalling the OS.

This question tests knowledge of physical security controls that deter theft. A cable lock physically attaches the laptop to a desk, making it difficult to remove quickly. Key locks on doors alone are insufficient if someone gains access; cable locks provide a secondary layer of defense.

The user's internet connection is working (they can browse websites), which rules out general network connectivity issues. The most common cause of VPN authentication failure is incorrect or expired credentials, so verifying the username and password is the quickest and most logical first step before escalating to more complex troubleshooting.

After a major OS update, Android devices often perform background indexing of files, media, and app data to optimize search and performance. This process is CPU- and I/O-intensive, causing increased battery drain for 24–48 hours. The correct solution is to wait a day or two for indexing to complete, as restarting alone does not stop this background task.

By giving remote access, the user likely allowed the attacker to install malware, such as ransomware, spyware, or a backdoor. The slow performance and pop-ups are symptoms of malware infection. The technician should immediately disconnect the computer from the network and perform a full security scan.

The Remote Desktop Session Host (RDSH) has a configurable idle session limit that disconnects sessions after a period of inactivity. By default, Windows 10 Pro may enforce a short idle timeout (often 1-5 minutes) to conserve resources. Increasing this limit in the Remote Desktop Session Host settings (under Local Group Policy or the Remote Desktop Services configuration) prevents the automatic disconnection the user is experiencing.

This question tests understanding of cloud service models. Email as a service is a common SaaS offering, where the provider manages the infrastructure, platform, and software. PaaS and IaaS would require the company to manage the email application itself, which is less likely for a simple migration.

An open rogue access point allows anyone within range to connect to the corporate network without authentication, bypassing all security controls. This is a severe security incident. The question tests knowledge of rogue AP risks and the importance of wireless security policies.

The scheduled network maintenance window is the key clue: it likely involved changes to network infrastructure such as switches, routers, or VLAN configurations. If a network switch that the file server depends on was modified or rebooted during maintenance, the workstation would lose connectivity even though the file server itself was untouched. Change management records only track changes to the file server, not to network devices, so the absence of file server changes does not rule out a network-level cause.

A bulging capacitor indicates a failed or failing component that can leak electrolyte, cause further damage, or even burst. The safest course is to wear insulated gloves to avoid electric shock or chemical exposure and replace the entire motherboard, as the capacitor cannot be safely repaired in the field. Ignoring it or attempting makeshift fixes risks short circuits, fire, or injury.

The correct answer is C because chgrp staff file changes the group ownership to 'staff', making the group permissions apply to the user's team. The current group is 'admin', so the staff group has no access.

Option C is correct because any unapproved change to a system, even if necessary, must follow the change management process. The technician discovered that the deployment script modifies a registry key shared with a legacy application, which was not included in the original change request. Stopping the deployment and submitting a new change request ensures proper review, risk assessment, and approval before altering a shared resource that could impact the legacy application.

The Services console (services.msc) allows you to view and manage all Windows services, including stopping, starting, and disabling them. Task Manager shows running processes but provides less detail for service management. The other tools are not designed for service control.

A Trojan horse disguises as legitimate software (the PDF converter) but contains malicious code. This Trojan opens a backdoor (a RAT). Removal requires disconnecting from the network, booting into Safe Mode, and using an updated anti-malware scanner to eliminate the Trojan and its persistence mechanisms.

Option B is correct because the automatic lock behavior in Windows is controlled by the screen saver settings. When 'On resume, display logon screen' is enabled with a 10-minute wait, the screen saver triggers after inactivity and locks the workstation by requiring authentication upon resume. This is the standard mechanism for enforcing a lock timeout, not the power plan sleep timeout.

Activity Monitor is the primary macOS tool for viewing CPU, memory, energy, disk, and network usage. In this scenario, it can help identify a runaway process or memory pressure causing the system to hang. Force quitting unresponsive apps is a secondary step, but Activity Monitor first provides the diagnostic data needed.

Some malware can persist in the boot sector or firmware. A full wipe of the entire drive (including the boot sector) using a secure erase or low-level format ensures no malware remnants remain. A simple format may leave boot-sector malware intact.

CRT monitors contain hazardous materials like lead, phosphorus, and other heavy metals that require specialized handling. Taking them to an e-waste recycling center ensures compliance with environmental regulations such as the Resource Conservation and Recovery Act (RCRA) and local e-waste laws, as these facilities are equipped to safely dismantle and recycle the toxic components.

Configuring Active Hours in Windows Update allows you to specify the time range during which the system should not automatically restart after installing updates. By setting Active Hours to cover the entire workday, critical updates can be downloaded and installed automatically, but the required restart is deferred until outside those hours, meeting both the security policy and the user experience requirement.