hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: A security incident occurred on a Windows 10…
A security incident occurred on a Windows 10 workstation where an attacker gained administrative access and created several hidden user accounts. You need to ensure no unauthorized accounts exist and that the built-in Administrator account is disabled. Which two tools can you use from the command line to list all user accounts and check the status of the Administrator account?
⚠ Common exam trap
CompTIA often tests the distinction between listing all accounts versus showing only the current user or group membership, leading candidates to confuse 'whoami' or 'net localgroup' with account enumeration commands.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use 'net user' to list accounts and 'net user Administrator | findstr /i active' to check status.
The 'net user' command lists all local user accounts on a Windows system, which is necessary to identify hidden or unauthorized accounts. Piping 'net user Administrator' through 'findstr /i active' filters the output to show whether the built-in Administrator account is enabled or disabled, as the status line contains 'Active' or 'Account active' depending on the locale. This combination directly fulfills the requirement to list all accounts and check the Administrator account's status from the command line.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use 'net user' to list accounts and 'net user Administrator | findstr /i active' to check status.
Why this is correct
The 'net user' command is a fundamental Windows command-line utility for managing local user accounts. Executing 'net user' without arguments lists all local user accounts on the system, which is crucial for identifying unauthorized or suspicious accounts during a security incident. To check the status of a specific account, such as 'Administrator', 'net user Administrator' displays detailed information, including the "Account active" status. Piping this output to 'findstr /i active' efficiently filters for and confirms the account's enabled or disabled state, directly addressing the need to check account status.
- ✗
Use 'whoami' to list current user and 'net localgroup Administrators' to see group members.
Why it's wrong here
The 'whoami' command provides information solely about the user currently logged in or executing the command, which is insufficient for a comprehensive audit of all local user accounts on the system during a security incident. While 'net localgroup Administrators' effectively lists members of the local Administrators group, it does not reveal the active/inactive status of those members directly, nor does it list *all* local user accounts, especially those not part of the Administrators group or those that might be disabled. Therefore, these commands do not fully address the need to identify all accounts and their status.
- ✗
Use 'dir C:\Users' to list user profile folders and 'net accounts' to see password policies.
Why it's wrong here
Using 'dir C:\Users' will list user profile folders, but this method is unreliable for identifying all local user accounts. Some accounts, such as built-in system accounts or those created without a full profile, may not have a corresponding folder, and disabled accounts might still have a profile folder. Furthermore, 'net accounts' displays local password and account lockout policies, which is relevant for security posture but provides no information about individual user account names or their active/inactive status, making it ineffective for the primary goal of listing accounts and checking their status.
- ✗
Use 'gpresult /R' to list applied policies and 'net start' to see running services.
Why it's wrong here
The 'gpresult /R' command is used to display the Group Policy Objects (GPOs) that are currently applied to the user and computer, which is useful for policy troubleshooting but provides no information about local user accounts or their active status. Similarly, 'net start' lists all running services on the system, which is relevant for understanding system processes but has no direct correlation to identifying user accounts, their existence, or their enabled/disabled state. Neither of these commands contributes to the objective of listing all user accounts and checking their status after a security incident.
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.