CompTIA A+ Core 2 220-1202 (220-1202) — Questions 601–675

App crashes on deployment often stem from missing dependencies or incompatible API levels. The most common cause is that the target devices are running an older Android version than the app's minimum SDK. The technician should check the app's manifest requirements against the device OS version.

Option C is correct because the requirement is to conditionally skip rows based on a property value. An 'if' statement in PowerShell allows you to test whether the 'Username' property is empty or null using a condition like `if ($_.Username -ne '')` and then skip the row with `continue` or simply not process it. This is the most direct and efficient control structure for a simple boolean check on each row.

Option D is correct because the Apps > Startup page in the Windows 10 Settings app provides a list of all startup programs with toggle switches to enable or disable them. This directly addresses the user's issue of too many programs launching automatically, which can slow down boot time and overall performance. The tool shows the impact of each startup item (e.g., 'High', 'Medium', 'Low') to help prioritize which to disable.

The voltage selector switch on the power supply must match the local mains voltage (typically 115V in North America or 230V in Europe). If set to 230V while plugged into a 115V outlet, the power supply will receive insufficient voltage to start, causing the computer to appear completely dead. This is a common safety-related oversight because the switch is often overlooked during installation.

WEP encryption is fundamentally flawed and can be cracked in minutes with readily available tools. This is the most pressing risk, as it allows attackers to decrypt traffic and potentially access the network.

The System Configuration (msconfig) tool allows you to enable 'Selective startup' and load only essential services and startup items, while still allowing network drivers to load. Safe Mode with Networking would also work but is not a msconfig setting; the question specifies using msconfig.

After a security policy update, authentication failures often stem from outdated or incorrect server settings. The most common change is an updated server address or port. The technician should verify the incoming/outgoing server settings in the email app.

Option C is correct because holding the Shift key while clicking Restart forces the system to boot directly into the Windows Recovery Environment (WinRE) without needing installation media. This method leverages the built-in boot configuration data (BCD) to load the recovery tools, including the option to disable automatic restart on system failure under advanced startup settings.

A zero-day vulnerability is a previously unknown flaw that attackers exploit before a patch is available. Even with recent updates, such vulnerabilities can exist, leading to unauthorized access.

This is a tech support scam, a form of social engineering that uses scare tactics (fake virus warnings) to trick users into calling a fake support line. The user should close the pop-up and run a security scan to ensure no malware was installed.

The Local Group Policy Editor (gpedit.msc) allows administrators to configure the 'Set a default associations configuration file' policy under Computer Configuration > Administrative Templates > Windows Components > File Explorer. When enabled, this policy prevents applications from changing file associations and default programs by locking the association file, overriding any user or application changes. This is the correct tool for enforcing system-wide control over default programs in Windows 10/11 Pro, Enterprise, or Education editions.

This is smishing, which is phishing conducted via SMS text messages. The attacker uses urgency and a fake login page to steal credentials. Smishing is increasingly common due to the high trust users place in text messages.

KRACK attacks exploit vulnerabilities in the WPA2 protocol's four-way handshake. WPA3 is designed to mitigate these attacks through the use of SAE (Simultaneous Authentication of Equals) and 256-bit encryption. This question tests knowledge of specific vulnerabilities and the corresponding protocol improvements.

A mismatch in the saved passphrase is a common cause of connection failures when the network is visible. The correct answer is to forget the network and re-enter the correct passphrase. This tests troubleshooting skills for wireless authentication issues.

If a credential-stealing extension was active, passwords may have been captured. The correct step is to force password changes for all accounts used in that browser. This tests understanding of post-infection remediation and the scope of data theft.

Option A is correct because degaussing a hard drive uses a strong magnetic field to disrupt the magnetic domains on the platters, rendering the data permanently unrecoverable. This is a NIST SP 800-88 approved method for sanitizing magnetic media and ensures that unencrypted customer data cannot be retrieved after disposal.

BitLocker with a TPM + startup PIN provides full-disk encryption and requires a pre-boot authentication PIN, meeting the requirement to protect the entire hard drive in case of theft. The TPM validates system integrity, and the PIN must be entered before the OS loads, preventing unauthorized access even if the drive is removed.

Option B is correct because the fuser unit is a consumable component that degrades over time, and replacing only the faulty fuser while recycling the old one through a certified e-waste recycler minimizes electronic waste. This approach addresses the root cause (a worn-out fuser) without discarding the entire printer, which would generate unnecessary e-waste and violate environmental best practices.

Task Manager provides real-time monitoring of CPU, memory, disk, and network usage by process. It is the default tool for quickly identifying resource hogs on a Windows system.

The correct answer is physical destruction, such as shredding or crushing the SSD. Because the SSD is non-functional, software-based wiping or degaussing (which is ineffective on SSDs) cannot be used. This tests knowledge that SSDs require different destruction methods than HDDs.

Option A is correct because the Compatibility tab in a shortcut's properties allows you to set the 'Run as administrator' flag, which embeds a compatibility manifest that prompts for elevation via UAC when the application is launched. This ensures the legacy application always runs with administrative privileges, even for standard users, by triggering a credential prompt for an administrator account.

This question tests knowledge of password policies and user permissions. In a domain environment, password policies are typically enforced by the domain controller, not the local machine. The 'Password must meet complexity requirements' policy may be enabled, and the user's new password might not meet those requirements, even though they know the current password.

This question tests understanding of the 'Deny log on locally' user rights assignment. When a computer joins a domain, domain policies may override local settings, and the 'Deny log on locally' policy can be configured to block local accounts. This is a common security measure to enforce domain-only authentication.

Option B is correct because it demonstrates professional respect for the user's current activity while ensuring the issue is addressed. Leaving a note and returning in 15 minutes maintains a service-level commitment without disrupting the user's call, aligning with CompTIA's best practices for customer communication and time management in a support scenario.

Task Manager provides a real-time overview of system performance, including memory, CPU, and disk usage, making it the ideal tool for diagnosing resource bottlenecks. The Resource Monitor offers more detailed data but is accessed from Task Manager, not directly. Performance Monitor and System Configuration are for advanced logging and startup management, respectively.

This is a social engineering attack where the attacker posed as IT support. The technician should immediately report the incident to the security team and flag the account as compromised, as the credentials are now in the hands of an attacker.

This question tests the concept of active listening and gathering information before jumping to solutions. The correct answer is to ask clarifying questions to understand the issue fully, which ensures the technician does not waste time on incorrect assumptions.

The correct answer is to use a cross-cut shredder designed for optical media. Shredding physically destroys the discs, making data unrecoverable. Degaussing does not work on optical media, and formatting or deleting files is not possible on read-only discs.

The DoD 5220.22-M standard for top-secret data requires a three-pass overwrite (pass 1: zeros, pass 2: ones, pass 3: random) to ensure data is unrecoverable. A single overwrite may not meet this standard. Degaussing and physical destruction are also acceptable but prevent reuse.

Option A is correct because Get-Service with the -ComputerName parameter can query multiple remote computers directly, and piping its output to Where-Object with the condition {$_.Status -eq 'Running'} filters only services whose Status property equals 'Running'. This meets the requirement to output the service name and status for each computer where the service is running, as Get-Service returns objects containing both Name and Status properties by default.

The System applet (Control Panel > System) provides direct access to the Windows activation status and the 'Change product key' option. Since the user already has a retail license key, the first troubleshooting step is to verify the current activation state and re-enter the key via this applet, which triggers a re-activation with Microsoft's licensing servers.

Configuration profiles are managed under Settings > General > VPN & Device Management. If the profile is not there, it may be installed via MDM or be a supervised profile. The technician should verify MDM enrollment.

WPA2-PSK with AES is the most secure option, but it is not backward compatible with WPA-TKIP devices. The technician must choose between compatibility and security; the best practice is to upgrade legacy devices or use a separate network for them.

The 'net localgroup' command allows you to view and modify local group memberships, such as adding or removing users from the Administrators group. The other options are either for different purposes (like disk management) or require a GUI.

A site-to-site VPN (often using IPsec or a secure tunnel protocol) creates an encrypted, always-on connection between the two office routers, allowing all 10 users transparent access to the main office resources as if they were on the same LAN. This method is both secure (encrypting all traffic) and scalable (handling multiple users without per-client configuration), making it the best fit for connecting entire networks over the internet.

Option B is correct because setting the computer to sleep after 30 minutes of inactivity allows users to save their work before the system enters a low-power state. Sleep keeps the system state in RAM, enabling a quick resume, while still reducing energy consumption. This balances power savings with user control, as the user can manually trigger sleep after saving work.

Activation Lock is an iOS security feature that is automatically enabled when Find My iPhone is turned on. It ties the device to the owner's Apple ID, preventing anyone from reactivating the device after it is erased or restored without entering the correct Apple ID and password. Find My iPhone locates the device, but Activation Lock provides the anti-theft protection. iCloud Keychain is for passwords, and Lost Mode locks the device but does not prevent reactivation after a wipe.

The scenario describes a Finder crash, which often causes the desktop, menu bar, and icons to disappear. Relaunching Finder via the Force Quit Applications window restores these elements without rebooting the entire system. This is a common troubleshooting step for macOS GUI issues.

The User State Migration Tool (USMT) is a command-line tool designed for large-scale migrations of user profiles and settings. It is included in the Windows Assessment and Deployment Kit (ADK). For simpler transfers, Windows Easy Transfer was used in older versions, but USMT is the enterprise-grade solution.

The 'Draw over other apps' permission allows an app to display content on top of other applications, including the home screen and lock screen. This is a common technique used by adware and malicious apps to serve persistent pop-up ads even when no browser is open, as the app can draw its own window outside of the normal app lifecycle. Since the employee only downloaded from Google Play, this permission abuse is the most likely cause, as even Play Store apps can be granted this permission by the user during installation or runtime.

The correct tool is 'Set up a kiosk' under Accounts > Other users in Windows Settings. This uses Assigned Access to lock the device to a single app and prevents users from leaving that app without an administrator password.

This tests the lsof command, which lists open files and the processes using them. lsof /path/to/script shows which process has the file open, causing the 'Text file busy' error.

The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Spear phishing is a targeted phishing attack aimed at specific individuals or groups within an organization. The use of a spoofed internal domain makes it more convincing. This contrasts with regular phishing, which is broader and less personalized.

This scenario describes a pretexting attack where the attacker used a false identity (delivery person) to gain physical access to a computer. The technician should immediately check for unauthorized software or connections that may have been installed.

A virus that reinstalls itself likely has a rootkit or persistent mechanism. Booting from trusted media and scanning the offline system ensures the malware cannot run, allowing complete removal.

USB flash drives use NAND flash memory, similar to SSDs. A full overwrite with zeros is effective for most flash drives, as it writes to all accessible blocks. However, some drives may have hidden areas, so a secure erase tool is recommended.

The screen saver settings in Windows include an option to 'On resume, display logon screen,' which locks the workstation after the screen saver activates. Setting the screen saver timeout to 5 minutes and enabling the logon screen requirement meets the policy.

Option B is correct because it demonstrates active listening and professional courtesy by politely asking the user to slow down and repeat the issue. This approach maintains rapport, ensures accurate information gathering, and avoids misdiagnosis that could lead to wasted time or incorrect troubleshooting steps. In a support context, clear communication is essential for identifying the root cause and applying the correct fix.

For encrypted drives, a cryptographic erase (crypto erase) is the most efficient method. It destroys the encryption key, making the data inaccessible even if the encrypted data remains on the drive. This preserves the drive for reuse.

This scenario describes a browser hijacker, which is often not detected by standard antivirus scans. Resetting the browser removes unwanted extensions, toolbars, and reverts the homepage and search engine settings, solving the problem without reinstalling the OS or replacing hardware.

This question covers idempotency and run-once mechanisms. Using a registry key or a marker file to record that the script has executed prevents it from running again on reboot or reapplication. Loops and parameters don't enforce a single execution.

BitLocker Drive Encryption (option C) is the correct technology because it provides full-disk encryption for Windows 10 Pro, ensuring that all data on the laptop's hard drive is encrypted at rest. This protects against data exposure if the device is stolen, as the drive cannot be accessed without the decryption key (e.g., a PIN, USB key, or TPM-based authentication). BitLocker is built into Windows 10 Pro and is specifically designed for whole-drive encryption, meeting the requirement for all company laptops.

The change request form is the central document that tracks the entire lifecycle of a change, including planning, approval, implementation, and post-implementation review. Once the deployment is successfully completed, the IT lead must update the change request form to mark it as 'Closed' or 'Completed,' documenting the actual outcome, any deviations, and the final status. This ensures an accurate audit trail for compliance and future troubleshooting, as required by ITIL-based change management processes.

BitLocker To Go allows encryption of removable drives like USB flash drives. It is available in Pro and Enterprise editions of Windows and provides strong protection. The encrypted drive can be accessed on other Windows systems with the password or recovery key.

The AutoPlay settings in Control Panel let you configure default actions for different media types. Disabling or setting 'Take no action' for removable drives stops automatic folder opening and media playback without affecting drive recognition.

Option C is correct because it demonstrates professional communication and sets realistic expectations. The technician acknowledges the issue, commits to researching the specific driver compatibility problem caused by the Windows update, and promises a follow-up within a defined timeframe. This approach maintains customer trust and avoids making promises or taking actions without a clear plan.

The Services console (services.msc) allows you to view, start, stop, and configure the startup type of Windows services. To fix the Print Spooler, you would open Services, find the Print Spooler service, start it, and set its startup type to Automatic.

A degausser generates a powerful magnetic field that physically randomizes the magnetic domains on the platters, effectively destroying all stored data and rendering the drive unusable. This is the only method listed that meets the strict security policy requirement for sanitization, as it prevents any possible data recovery even with advanced forensic tools.

Option A is correct because it upholds the company's security policy by refusing to install unapproved software on a non-managed device, while still providing a practical solution: setting up remote access (e.g., via VPN and Remote Desktop Protocol) to a company workstation that already has the accounting software. This approach ensures compliance with policy and maintains data security by keeping the software within the managed environment.

This question tests iOS app-specific troubleshooting. The correct answer is 'Offload App', which removes the app but keeps its documents and data, allowing a fresh reinstall without data loss. This is ideal for fixing a corrupted app without a full restore.

Group Policy in Windows allows administrators to centrally manage browser settings, including preventing extension installations. This is the standard enterprise approach for enforcing security policies across multiple computers.

Option C is correct because it directly addresses the user's complaint (battery degradation causing heat and poor runtime) while ensuring responsible disposal of the hazardous lithium-ion battery. Recycling at a certified e-waste facility prevents toxic materials from entering landfills and allows recovery of valuable metals, aligning with environmental best practices.

This question tests understanding of password storage policies. Reversible encryption means passwords are stored in a format that can be decrypted back to plaintext, which is a significant security risk if an attacker gains access to the SAM database. This setting should only be enabled when required by specific applications, such as those using CHAP authentication.

The Windows 11 PC Health Check app is the official Microsoft tool designed specifically to verify compatibility with Windows 11, including TPM 2.0 and Secure Boot capability. It generates a detailed compatibility report, making it the correct built-in tool for this pre-upgrade validation task.

The 'Preparing Automatic Repair' loop often indicates a corrupted boot configuration or system file. Using the Startup Repair tool from the Windows Recovery Environment (WinRE) is the first recommended step, as it can automatically fix many common boot problems without needing to reinstall the OS.

Task Manager (Option B) is the correct tool because it provides a real-time view of per-process memory usage, including the 'Memory (Active Private Working Set)' column, which can identify a process that is consuming an abnormally increasing amount of RAM over time—indicative of a memory leak. Unlike other tools, Task Manager allows you to quickly sort processes by memory usage and observe growth without needing to configure counters or parse logs.

The Local Group Policy Editor (gpedit.msc) allows administrators to configure detailed security and restriction policies for users and computers. It is available on Windows Pro/Enterprise editions and is the correct tool for applying such restrictions locally. Other tools like Local Security Policy or User Accounts have limited scope.

Electronic key card systems provide both access control and audit trails, making them ideal for environments where access needs to be centrally managed and logged. This question tests the ability to match a security requirement to the appropriate control.

Event Viewer is the correct tool because it provides a centralized, detailed log of security-related events, including logon attempts (Event ID 4624 for successful logons, 4625 for failed logons) and file access audits (Event ID 4663). These logs are essential for forensic analysis to determine the scope of a breach on a Windows 10 workstation.