CompTIA A+ Core 2 220-1202 (220-1202) — Questions 1–75

Why this answer

How to eliminate wrong answers

Option A is wrong because `ipconfig` is used to display network configuration details (e.g., IP address, subnet mask, default gateway) and has no capability to list running processes or their memory usage. Option C is wrong because `chkdsk` checks the file system and disk for errors and bad sectors, but it does not provide any information about running processes or memory consumption. Option D is wrong because `sfc /scannow` scans and repairs protected system files, but it does not list processes or report memory usage.

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA2-PSK with TKIP uses the deprecated TKIP cipher, which is vulnerable to attacks like MIC key recovery and is not the strongest available protocol. Option B is wrong because although WPA2-PSK with AES (CCMP) is more secure than TKIP, it still uses the four-way handshake that is susceptible to offline dictionary attacks and lacks forward secrecy, making it weaker than WPA3-SAE. Option D is wrong because a mixed mode of WPA2 and WPA3 would allow clients to connect using WPA2, which is less secure than WPA3-SAE alone, and does not enforce the strongest encryption for all traffic as required by the policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because System Settings > Desktop & Dock controls the Dock, Stage Manager, and desktop appearance, but does not include any options for customizing the Finder sidebar. Option C is wrong because the command 'defaults write com.apple.finder ShowSidebar -bool true' only toggles the entire sidebar's visibility (show/hide), not the individual items within it; the specific folder visibility is controlled by a different key (e.g., 'SidebarDevicesSectionDisclosedState'). Option D is wrong because Spotlight Preferences manage search indexing and results, not the persistent visibility of folders in the Finder sidebar.

Why this answer

How to eliminate wrong answers

Option A is wrong because ADB is a developer/debugging tool requiring USB debugging and manual commands per device; it does not scale, is not persistent, and is inappropriate for fleet-wide policy enforcement. Option B is wrong because Guest Mode is a user-facing feature that restricts what a guest can do on a shared device — it does not push corporate Wi-Fi credentials or enforce camera disablement as a managed policy. Option D is wrong because a third-party camera-blocking app from the Play Store is not a managed policy, can be uninstalled, may not work on all Android versions, and does not handle Wi-Fi auto-connect.

Why this answer

How to eliminate wrong answers

Option A is wrong because biometric authentication (e.g., fingerprint or facial recognition) is an access control mechanism that verifies identity, but it does not physically prevent the laptop from being taken. Option C is wrong because full disk encryption protects data confidentiality if the laptop is stolen, but it does not prevent the theft itself. Option D is wrong because a smart card reader is an authentication device that requires a smart card for access, but it does not physically secure the laptop to a location.

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Defender does not delete legitimate logon scripts; it quarantines detected malware, and the user reports other scripts work fine, indicating no system-wide deletion. Option B is wrong because Windows updates do not change the default script host from VBScript to PowerShell; the default host for .vbs files remains wscript.exe unless explicitly reconfigured, and PowerShell scripts use a different file extension (.ps1). Option D is wrong because SMB 2.0 is still supported in modern Windows versions; the issue is specific to VBScript execution, not network protocol compatibility.

Why this answer

How to eliminate wrong answers

Option A is wrong because a full format only removes the file system pointers and may not overwrite all sectors, leaving data recoverable with forensic tools. Option C is wrong because overwriting with zeros using a software tool may not be effective on SAS drives if the drive's firmware remaps bad sectors or if the drive is damaged, and it does not physically destroy the media. Option D is wrong because storing drives in a locked cabinet does not destroy or render data unreadable; it only delays access, violating the policy that mandates drives must be rendered unreadable by any means.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing the password in a plain text file and having the script read it leaves the password fully visible and accessible to anyone who can read the file, violating the requirement to not leave the password visible. Option C is wrong because embedding the password in a script variable, even if run from a hidden share, still exposes the password in plain text within the script file itself, which can be viewed by anyone with access to the share or the script. Option D is wrong because using a scheduled task running as SYSTEM does not address the password visibility issue—the script would still need to contain or reference the password in plain text, or rely on an insecure storage method.

Why this answer

How to eliminate wrong answers

Option A is wrong because Firewall & network protection only manages inbound/outbound network rules and does not control file system access. Option B is wrong because App & browser control configures SmartScreen and Exploit Protection settings, not folder-level ransomware defenses. Option C is wrong because Device security covers Core Isolation, Memory Integrity, and TPM/Secure Boot, which are hardware-based protections unrelated to Controlled Folder Access.

Why this answer

How to eliminate wrong answers

Option A is wrong because Services.msc manages Windows services (background processes that run independently of user logon), not user-installed startup programs; disabling a service could break system functionality. Option C is wrong because Control Panel > Programs and Features is used to uninstall or change installed programs, not to manage their startup behavior. Option D is wrong because Settings > Apps > Startup in Windows 10 only shows a list of startup apps with toggle switches, but it does not provide the detailed startup impact information or the ability to manage all startup items (e.g., those from the registry or startup folder) that Task Manager's Startup tab offers.

Why this answer

How to eliminate wrong answers

Option A is wrong because iCloud compromise alone does not directly grant access to a corporate Exchange email account unless the email is configured via iCloud Mail or the iCloud Keychain stores the Exchange credentials; the scenario specifies the email is synced via Exchange, not iCloud. Option C is wrong because a jailbreak that hides malicious apps is unlikely to be the cause given the user's iPhone shows no suspicious apps, and jailbreak detection would typically flag such behavior; moreover, hidden apps would still leave traces in system logs or profiles. Option D is wrong because a backdoor account on the corporate email server would be a server-side vulnerability, not a client-side issue, and the question focuses on the user's device and account access; such a backdoor would not be tied to the user's specific password change.

Why this answer

How to eliminate wrong answers

Option A is wrong because reinstalling the operating system removes the malware but does not address the underlying security gaps (e.g., unpatched software or user susceptibility to phishing) that allowed the infection. Option B is wrong because updating software patches known vulnerabilities, but it does not prevent infections caused by user actions like opening malicious email attachments or visiting compromised websites. Option D is wrong because disabling all browser plugins is overly restrictive and does not address the primary infection vector (phishing emails or drive-by downloads), nor does it protect against ransomware that arrives via other means like malicious macros in documents.

Why this answer

How to eliminate wrong answers

Option A is wrong because the `os` module does not have an `os.regread` function; it provides operating system interfaces like file and process management, not registry access. Option B is wrong because while `subprocess` can run `reg query`, it is an indirect, slower, and less reliable method that requires parsing command output, whereas `winreg` provides direct, native registry access. Option D is wrong because the `sys` module provides system-specific parameters and functions (e.g., `sys.path`, `sys.argv`), not registry access; it cannot be used to read the registry via system calls.

Why this answer

How to eliminate wrong answers

Option A is wrong because phishing is a social engineering attack delivered via electronic communication (e.g., email, SMS, or fake websites) that tricks the user into revealing credentials or clicking a malicious link, not by physically plugging in a USB drive. Option B is wrong because pretexting involves creating a fabricated scenario or false identity (e.g., impersonating IT support) to obtain information, not using a physical lure like a USB drive. Option D is wrong because tailgating (or piggybacking) is a physical security attack where an unauthorized person follows an authorized individual into a restricted area without proper authentication, not involving a USB drive or computer interaction.

Why this answer

How to eliminate wrong answers

Option A is wrong because a public cloud alone would require all data to be transferred over the internet or a direct connection, incurring egress fees for large transfers and potentially higher latency for local employees. Option B is wrong because a private cloud still requires the business to own and maintain the underlying hardware, which does not reduce hardware maintenance costs as required. Option D is wrong because a community cloud is shared among several organizations with common concerns (e.g., regulatory compliance), but it does not inherently provide low-latency local access or eliminate egress fees for a single business's file server migration.

Why this answer

How to eliminate wrong answers

Option A is wrong because Device Manager is used to view and manage hardware devices and drivers, but it does not show runtime error logs or service-specific messages from the print spooler. Option B is wrong because Services.msc allows you to start, stop, or restart the print spooler service and view its status, but it does not display detailed error messages or event logs. Option D is wrong because Performance Monitor tracks system performance counters (e.g., CPU, memory, print queue length) over time, but it does not log or display error messages from the print spooler service.

Why this answer

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee the attacker will provide a working decryption key, and it encourages further criminal activity. Option B is wrong because rebooting into Safe Mode and running a malware scan can remove the ransomware executable but cannot decrypt files that are already encrypted; the encryption persists. Option D is wrong because System Restore does not affect user files; it only restores system files and registry settings, leaving the encrypted files unchanged.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing a lithium-ion battery in regular trash violates environmental regulations (e.g., RCRA in the US) and creates fire and toxic waste hazards, regardless of whether it appears swollen. Option B is wrong because shorting the terminals of a lithium-ion battery can cause a short circuit, leading to rapid discharge, overheating, fire, or explosion; safe discharge requires a controlled load. Option D is wrong because storing a lithium-ion battery in a metal container without prior discharge or proper packaging can create a short-circuit risk and is not a standard disposal procedure; returning to the manufacturer is acceptable only if they provide a specific take-back program, but the question asks for the proper disposal procedure, which emphasizes safe discharge and certified recycling.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling a critical backup job without authorization violates change management and creates a data-protection gap — it treats the symptom by removing a business-critical control. Option C is wrong because simply adding bandwidth may mask the problem without addressing scheduling contention, and it incurs cost without confirming the backup is truly the sole cause. Option D is wrong because ignoring a recurring outage because the backup is 'critical' leaves users and services impacted weekly; the backup can be preserved while its schedule is adjusted.

Why this answer

How to eliminate wrong answers

Option A is wrong because a faulty Wi-Fi antenna would prevent the smartphone from connecting to the Wi-Fi at all, not just block internet access. Option C is wrong because if the router's DHCP server had run out of IP addresses, the smartphone would fail to obtain an IP address and would not show a 'connected' status; other devices working fine also indicates DHCP is functional. Option D is wrong because DNS misconfiguration would still allow the smartphone to have internet access via IP addresses (e.g., pinging 8.8.8.8 would work), and the symptom is a complete lack of internet access, not just name resolution failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall with Advanced Security controls network traffic based on port, protocol, and IP address rules, not application execution or code signing. Option B is wrong because BitLocker Drive Encryption provides full-disk encryption to protect data at rest but does not enforce any application whitelisting or publisher signing policies. Option D is wrong because User Account Control (UAC) prompts for elevation of privileges but does not restrict which applications can run based on their digital signature or publisher; it only controls administrative consent.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Audit Logon Events' records logon/logoff attempts (Event IDs 4624, 4625), not account creation events; account creation falls under account management auditing. Option C is wrong because 'File and Printer Sharing' is a network discovery and sharing feature that has no impact on security event logging or auditing. Option D is wrong because Windows Defender is an antivirus/antimalware solution that does not audit account creation events; it does not generate or record security event logs for user account operations.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing CRT monitors in a regular dumpster violates environmental regulations due to the hazardous materials (lead, cadmium) they contain, which can leach into landfills. Option C is wrong because smashing the glass releases toxic phosphor dust and lead into the air and environment, posing health risks and violating safety protocols. Option D is wrong while donating for reuse may seem environmentally friendly, it does not address the eventual disposal of the monitors when they fail; proper disposal still requires certified recycling to handle the hazardous components at end-of-life.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Local Group Policy to hide the taskbar only hides the taskbar visually but does not prevent users from accessing the desktop or launching other apps via keyboard shortcuts (e.g., Ctrl+Alt+Del, Alt+Tab, or Win+D). Option B is wrong because User Account Control set to 'Always notify' only prompts for consent or credentials when changes are made to the system; it does not restrict access to the desktop, taskbar, or other applications. Option C is wrong because Windows Defender Application Guard is a hardware-isolated browser container for Microsoft Edge that protects against malicious websites, but it does not enforce a single-app kiosk experience or block access to the desktop or other apps.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because deploying the application to all laptops and disabling the VPN client on each bypasses the change management process and could disrupt remote access for sales staff, violating security and operational requirements. Option C is wrong because continuing with deployment while merely noting the conflict in the change log fails to resolve the known issue, which could lead to widespread VPN failures and non-compliance with the pilot test requirement. Option D is wrong because uninstalling the VPN client from all laptops before deployment is a disruptive workaround that ignores the root cause and may violate security policies; the conflict should be resolved through proper change management, not by removing critical software.

Why this answer

How to eliminate wrong answers

Option A is wrong because DirectX errors usually produce different error codes (e.g., 0xc000007b is not a DirectX-specific error) and DirectX is primarily for graphics APIs, not general application startup. Option C is wrong because insufficient administrative privileges typically trigger 'Access Denied' or UAC prompts, not error 0xc000007b. Option D is wrong because bad sectors on the hard drive would cause file read errors or data corruption, not a specific STATUS_INVALID_IMAGE_FORMAT error; the error occurs before the application files are fully read.

Why this answer

How to eliminate wrong answers

Option A is wrong because copying the ISO directly to the virtual hard disk does not create a bootable environment; the VM would attempt to boot from a raw ISO file on the disk, which is not a valid bootable filesystem structure. Option C is wrong because plugging a USB flash drive into the host does not automatically make it available to the VM; the USB device must be passed through to the VM via USB passthrough or a virtual USB controller, and the VM must be configured to boot from it. Option D is wrong because changing the hypervisor's default settings does not add support for an unsupported OS; hypervisors support OS installation via standard boot media (ISO, PXE) regardless of the default OS list, and the 'default settings' typically refer to guest OS templates or optimizations, not a block on installation.

Why this answer

How to eliminate wrong answers

Option A is wrong because insufficient permissions to create files would produce a 'Permission denied' error, not an 'ActiveX component can't create object' error, which is specifically about COM instantiation failure. Option C is wrong because a syntax error in the CreateObject line would cause a compile-time error (e.g., 'Expected end of statement') before the script even attempts to create the object, not a runtime 'ActiveX component can't create object' error. Option D is wrong because the scheduled task running when the user is not logged in can cause issues with interactive desktop access or network drives, but it does not prevent COM object creation; the error is about the COM component itself being missing or unregistered, not about session context.

Why this answer

How to eliminate wrong answers

Option A is wrong because opening the UPS battery compartment exposes the technician to toxic hydrogen sulfide gas and risks electrical shock or short circuits from exposed terminals, worsening the hazard. Option B is wrong because continuing to monitor the UPS while it is in thermal runaway allows the condition to escalate, increasing the likelihood of fire, explosion, or release of corrosive electrolyte. Option D is wrong because spraying a UPS with a fire extinguisher is premature and ineffective—thermal runaway is an internal chemical process, not an open flame, and extinguisher discharge can cause electrical shorts or damage equipment without addressing the root cause.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a full format on an SSD does not securely erase data; it only marks the file system as empty and may trigger a TRIM command, but data remains recoverable until overwritten by new writes. Option C is wrong because degaussing an SSD destroys the magnetic storage medium (NAND flash is not magnetic), rendering the drive completely inoperable and unusable for reuse, which violates the policy to preserve the drives. Option D is wrong because overwriting SSDs with zeros three times is ineffective due to wear-leveling and the SSD's inability to guarantee that all logical blocks map to the same physical cells, leaving data potentially recoverable from over-provisioned or retired blocks.

Why this answer

How to eliminate wrong answers

Option A is wrong because offloading and reinstalling the app does not change the iOS version; it only removes and re-downloads the app data, which would still fail with the same error if iOS 15 remains. Option B is wrong because clearing the App Store cache by force-closing the app does not alter the device's iOS version; it only refreshes temporary data and cannot resolve a version-based compatibility issue. Option C is wrong because performing a factory reset erases all content and settings but does not upgrade the iOS version; the device would still be on iOS 15 after the reset, so the app would still be incompatible.

Why this answer

How to eliminate wrong answers

Option A is wrong because Local Users and Groups (lusrmgr.msc) is used to manage user accounts and groups, not to enforce password policies; it cannot set minimum length or complexity requirements. Option C is wrong because Registry Editor (regedit) can modify password policy values indirectly via registry keys (e.g., under HKLM\SAM), but it is not the intended tool for policy enforcement and lacks the structured interface and validation provided by secpol.msc. Option D is wrong because Windows Defender Firewall with Advanced Security manages network traffic filtering and firewall rules, not local password policies.

Why this answer

How to eliminate wrong answers

Option A is wrong because Time Machine is a backup solution that creates incremental backups to an external drive; it does not automatically free up local storage by offloading files—it only duplicates them for recovery purposes. Option C is wrong because erasing and repartitioning the drive is a destructive process that would delete all data, not preserve it for on-demand access, and is unrelated to automatic space management. Option D is wrong because local Time Machine snapshots are temporary backups stored on the same drive; they consume additional space rather than freeing it, and they are not designed for on-demand file retrieval without manual restoration.

Why this answer

How to eliminate wrong answers

Option A is wrong because telling a user to 'calm down' and minimizing the loss of data dismisses their emotional state and violates professional conduct; it can escalate the situation and damage trust. Option B is wrong because matching the user's raised tone is confrontational and unprofessional; it does not de-escalate the situation and can lead to a hostile interaction. Option D is wrong because transferring the call to a manager immediately is premature; the technician should first attempt to resolve the issue using standard recovery methods (e.g., Recycle Bin, backup) before escalating.

Why this answer

How to eliminate wrong answers

Option A is wrong because phishing typically refers to email-based attacks that lure victims to fake websites or malicious attachments; the scenario involves a phone call, not email. Option C is wrong because smishing is phishing via SMS/text messages, which is not the channel used here. Option D is wrong because pretexting is the creation of a fabricated scenario (a pretext) to extract information; while the caller does use a pretext, the specific attack vector — a voice call — makes vishing the more precise and correct classification.

Why this answer

How to eliminate wrong answers

Option A is wrong because immediately running a full antivirus scan without first gathering information from the user can disrupt their workflow, may miss root cause analysis (e.g., the specific file or URL involved), and does not address the professional need to understand the user's actions for future prevention. Option C is wrong because telling the user they should know better is accusatory and unprofessional; it damages the technician-user relationship and discourages the user from reporting future security incidents, which is a core violation of professional communication standards. Option D is wrong because remotely uninstalling the program without informing the user violates user consent and transparency, and it may remove evidence needed for deeper forensic analysis or for identifying additional malware components.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'something you are' refers to biometric factors such as fingerprints, facial recognition, or iris scans, not a code delivered to a device. Option B is wrong because 'something you know' refers to knowledge factors like passwords, PINs, or security questions, and the one-time code is not memorized by the user. Option D is wrong because 'somewhere you are' refers to location-based factors such as GPS position or network location, not a device-delivered code.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling System Integrity Protection (SIP) removes critical kernel-level protections and does not address the authentication requirement for network settings; SIP controls file system integrity, not authorization policies. Option C is wrong because using the 'security authorizationdb' command to remove the requirement would globally weaken the authorization database, potentially allowing any process to change network settings without authentication, which is less secure than simply elevating the user account. Option D is wrong because turning off FileVault disables full-disk encryption and has no effect on per-application or per-preference authentication prompts; FileVault protects data at rest, not authorization for system preferences.

Why this answer

How to eliminate wrong answers

Option A is wrong because Network Discovery only allows the workstation to see other devices on the network and be seen by them; it does not enable the actual sharing of folders or files. Option C is wrong because HomeGroup was removed from Windows 10 (version 1803 and later) and Windows 11; it is a deprecated feature and not required for standard SMB-based file sharing. Option D is wrong because Windows Firewall is a security component that can block or allow traffic, but it is not the feature that enables file sharing; in fact, File and Printer Sharing must be allowed as an exception within the firewall for sharing to work.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling User Account Control (UAC) reduces system security by allowing all processes to run with elevated privileges without prompting, but it does not provide a rollback mechanism for registry changes; it only removes the elevation prompt, not the risk of corruption. Option C is wrong because running the installation as an administrator only ensures the installer has sufficient permissions to write to protected areas like the registry, but it does not create a backup or restore point; if the registry edit fails, there is no way to undo it. Option D is wrong because closing other applications reduces resource conflicts and potential interference during installation, but it does not safeguard against registry corruption; it is a general best practice for stability, not a safety procedure for registry modifications.

Why this answer

How to eliminate wrong answers

Option A is wrong because MAC address filtering only controls which devices can associate with the wireless network; it does not restrict access to internal resources once a device is connected. Option C is wrong because a complex password only authenticates users to the Wi-Fi network; it does not prevent authenticated guest users from accessing internal subnets. Option D is wrong because disabling SSID broadcast merely hides the network name from beacon frames; it does not provide any logical separation between guest and internal traffic.

Why this answer

How to eliminate wrong answers

Option B is wrong because `chkdsk /f` checks the file system for logical and physical errors on a disk volume (e.g., bad sectors, cross-linked files) and does not scan or repair the content of system files that an application depends on. Option C is wrong because `tasklist` only displays a list of currently running processes and their associated details (PID, session name, memory usage); it cannot scan or repair any files. Option D is wrong because `dism /online /cleanup-image /restorehealth` repairs the Windows system image (the source files used by SFC) and is typically used when SFC itself fails due to a corrupted component store, but it does not directly scan and repair the application's dependent system files in the same targeted manner as SFC.

Why this answer

How to eliminate wrong answers

Option B is wrong because it shifts blame to the network without offering a solution, which is unprofessional and fails to resolve the user's concern. Option C is wrong because using technical jargon like 'DHCP lease expiration' and 'subnet mask misconfiguration' without explanation confuses the user and violates the principle of clear communication. Option D is wrong because it incorrectly attributes the issue to a faulty printer, ignoring the actual DHCP-related IP change and leading to unnecessary replacement costs.

Why this answer

How to eliminate wrong answers

Option A is wrong because performing a factory reset is a drastic, data-destructive step that should only be considered after all non-destructive diagnostics have failed; it does not help identify the root cause and may unnecessarily erase user data. Option C is wrong because replacing the battery immediately assumes the hardware is faulty, but the problem started after a software update, making a software-related cause far more likely; battery replacement is premature without first verifying app-level power usage. Option D is wrong because disabling all background data is an overly broad and restrictive measure that can break legitimate app functionality; it should only be applied to the specific misbehaving app after identification, not as a blanket solution.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Guest Mode creates a temporary user account with its own apps and settings, but it does not lock the device to a single app; the guest can still navigate to other apps or system settings. Option C is wrong because a restricted profile limits which apps a secondary user can access, but it still allows the user to switch between permitted apps and access system UI elements like the status bar; it does not enforce single-app confinement. Option D is wrong because Factory Reset Protection (FRP) is a security feature that prevents unauthorized use of a device after a factory reset by requiring the previous Google account credentials; it has no function for locking the device into a single app during normal operation.

Why this answer

How to eliminate wrong answers

Option A is wrong because Safe Mode with SFC is a heavier, slower remediation that requires a reboot and is unnecessary when the shell can be restarted in seconds from the current session. Option C is wrong because System Restore rolls back drivers, apps, and registry changes, potentially undoing legitimate recent work, and is overkill for a shell process that simply failed to launch. Option D is wrong because Windows+P switches between display projection modes (duplicate/extend) and has nothing to do with a missing desktop shell; the display is clearly working since the cursor is visible.

Why this answer

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee you will receive a working decryption key, and it encourages further criminal activity; law enforcement and security best practices strongly advise against paying. Option B is wrong because running a full antivirus scan while the PC is still connected to the network allows the ransomware to continue communicating with its C2 server and potentially encrypt more files or spread to other systems; containment must come first. Option D is wrong because restoring files from a backup without first disconnecting the network risks re-infection if the backup media is still accessible over the network or if the ransomware is still active and can immediately re-encrypt the restored files.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Guest Mode creates a separate user profile with limited access but does not lock the device to a single app; users can still switch to other apps or settings within the guest session. Option C is wrong because Safe Mode boots the device with only pre-installed system apps, disabling third-party apps like the point-of-sale app, which is counterproductive for a kiosk. Option D is wrong because a launcher replacement app can customize the home screen but does not enforce single-app lockdown; users can still access the Overview menu or notifications to launch other apps unless combined with additional restrictions like Screen Pinning.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware devices and drivers, not to configure VPN connections; installing a virtual network adapter is not the primary step for setting up a VPN. Option C is wrong because the 'Remote Access Connection Manager' service is automatically started when needed and does not require manual enabling through the Services console for a standard VPN setup. Option D is wrong because Task Scheduler is used to automate tasks at specific times or events, not to launch a VPN client for on-demand connectivity.

Why this answer

How to eliminate wrong answers

Option B is wrong because BitLocker To Go provides encryption for USB drives to protect data at rest, not malware scanning. Option C is wrong because Windows Firewall controls network traffic based on rules and does not scan local storage devices for malware. Option D is wrong because User Account Control (UAC) prompts for administrative consent before system changes but does not perform any malware detection or scanning of inserted media.

Why this answer

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware devices and update drivers, but it cannot bypass driver signature enforcement; it will still block installation of an unsigned driver. Option B is wrong because System Configuration (msconfig) is used to configure boot options like safe mode or startup services, but it does not have a built-in setting to disable driver signature enforcement; you would need to use Advanced Startup Options or a command-line tool. Option D is wrong because 'bcdedit /set testsigning on' enables Test Signing mode, which permanently allows unsigned drivers to load, but this is a persistent change that weakens security and is not intended for a one-time installation; it also requires a reboot and leaves the system in a less secure state.

Why this answer

How to eliminate wrong answers

Option A is wrong because forwarding TCP 3389 directly exposes RDP to the internet, where it is constantly scanned and targeted by brute-force and BlueKeep-style exploits. Option C is wrong because using a third-party remote desktop service 'without additional configuration' ignores security hardening such as MFA, access controls, and session policies — convenience does not equal security. Option D is wrong because changing the RDP port is security through obscurity; scanners still find non-standard ports, and the underlying RDP exposure and vulnerabilities remain.

Why this answer

How to eliminate wrong answers

Option A is wrong because Single-user mode (Command + S) boots into a command-line interface as root without the GUI, but it does not restrict kernel extension loading—third-party kexts can still be loaded, and the malware may already be active in the kernel space. Option B is wrong because Verbose mode (Command + V) merely displays detailed boot logs on screen; it does not disable third-party software or kernel extensions, so the malware would still load normally. Option D is wrong because Target Disk Mode (T key) turns the Mac into an external disk for file transfer over Thunderbolt or FireWire; it does not provide a secure environment for malware removal and does not prevent the malware from executing on the host system.

Why this answer

How to eliminate wrong answers

Option A is wrong because Safe Mode only disables third-party apps and does not test hardware; it would not isolate a physical screen or touch controller issue caused by impact damage. Option C is wrong because 'Show taps' in Developer Options only visualizes touch input on the screen and does not perform any diagnostic or stress test of the display or touch hardware. Option D is wrong because a factory reset erases all user data and resets software settings but does not test or repair hardware; it is a software troubleshooting step that would be ineffective for a physical drop damage.

Why this answer

How to eliminate wrong answers

Option A is wrong because stopping the 'Task Scheduler' service would disable all scheduled tasks, including legitimate system tasks, and is not a targeted method for reviewing or disabling specific suspicious entries; it also does not allow you to examine the task library. Option C is wrong because Resource Monitor shows real-time system resource usage and currently running processes, but it does not display scheduled tasks or allow you to disable them; it is not designed for managing task definitions. Option D is wrong because Windows Firewall with Advanced Security controls network traffic based on rules, not scheduled tasks; blocking a task's network access would not disable the task itself, and the task would still execute locally, potentially causing harm.

Why this answer

How to eliminate wrong answers

Option A is wrong because jailbroken devices can still receive iOS updates, though they often break the jailbreak; the primary security risk is not the inability to update but the bypass of sandbox restrictions. Option B is wrong because voiding the warranty is a legal/contractual issue, not a direct security risk to corporate data. Option D is wrong because performance degradation is not a guaranteed or primary security concern; the core risk is the loss of app isolation and data protection.

Why this answer

How to eliminate wrong answers

Option A is wrong because holding the Option (⌥) key boots into the Startup Manager, which lets you select a different startup disk, not a recovery environment. Option C is wrong because holding the Shift key boots into Safe Mode, which disables non-essential kernel extensions and login items but does not provide Disk Utility or First Aid for repairing system files. Option D is wrong because holding Command (⌘) + Option (⌥) + P + R resets the NVRAM/PRAM (non-volatile random-access memory/parameter RAM), which clears certain hardware settings but does not load a recovery environment or allow disk repair.

Why this answer

How to eliminate wrong answers

Option A is wrong because paying the ransom is never a recommended first step — it funds criminals, does not guarantee decryption, and may violate policy or law. Option C is wrong because running a full antivirus scan while the machine is still networked allows the malware to continue spreading and communicating; containment must precede eradication. Option D is wrong because rebooting into Safe Mode may not stop network propagation and can destroy volatile evidence (memory-resident keys, running processes) needed for forensics.

Why this answer

How to eliminate wrong answers

Option A is wrong because using a degausser exposes the drives to a strong magnetic field that destroys the servo tracks and low-level formatting, rendering the HDDs completely unusable and non-reusable, which contradicts the requirement for reusability. Option B is wrong because physically drilling holes through the drive platters destroys the platters and makes the drives non-functional, preventing reuse; this method is appropriate only for physical destruction, not for drives that need to be repurposed. Option D is wrong because deleting files and emptying the recycle bin only removes file system pointers, leaving the actual data intact on the platters; the data can be easily recovered using file recovery software, failing to ensure confidentiality.

Why this answer

How to eliminate wrong answers

Option A is wrong because a pop-up blocker only prevents unwanted pop-up windows; it does not inspect or block malicious scripts injected into the page, so it cannot mitigate XSS. Option B is wrong because configuring a proxy server changes how HTTP requests are routed but does not alter the browser's execution of scripts or enforce content restrictions; a proxy cannot prevent the browser from running injected JavaScript. Option D is wrong because disabling JavaScript entirely would break the web application's core functionality (since it is a web application for internal communication, likely relying on JavaScript), and it is not a practical or selective mitigation; CSP allows JavaScript to run from trusted sources while blocking malicious scripts, whereas disabling JavaScript is a blunt, non-selective approach.

Why this answer

How to eliminate wrong answers

Option A is wrong because replying to the email confirms the technician's address as active to the attacker and may trigger further targeted attacks; legitimate HR would not request sensitive updates via an unverified link. Option B is wrong because clicking the link could execute a drive-by download, redirect to a credential harvesting page, or install malware, even if the page appears legitimate. Option D is wrong because the phone number in the email signature is likely controlled by the attacker or spoofed, and calling it could lead to social engineering or verification of the technician's contact details.

Why this answer

How to eliminate wrong answers

Option A is wrong because proceeding without verification risks installing incorrect software versions or missing dependencies, leading to rework and wasted time. Option C is wrong because assuming 'most commonly used' software may not meet the executive's specific needs, causing functionality gaps and potential security issues. Option D is wrong because refusing to proceed without direct executive contact is overly rigid and unprofessional; the assistant is a valid point of contact for initial coordination.

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall is a host-based packet filter that controls inbound and outbound network traffic based on rules, but it does not prevent software from modifying system settings like proxy or DNS configurations; it only blocks or allows network connections. Option C is wrong because BitLocker Drive Encryption is a full-disk encryption feature that protects data at rest by encrypting the entire drive, but it has no mechanism to prevent software from altering system settings or network configurations. Option D is wrong because Windows Defender Antivirus is a malware detection and removal tool that scans for known malicious signatures and behaviors, but it does not inherently block legitimate software from changing system settings unless the change is identified as malicious by heuristic analysis, which is not guaranteed for non-malicious applications.

Why this answer

How to eliminate wrong answers

Option A is wrong because a quick format does not affect the drive's ability to boot; the drive can still be booted after a quick format if an operating system is installed. Option B is wrong because while the drive can be reused, the underlying PII data remains recoverable, so reuse without proper sanitization does not eliminate the risk of data exposure. Option D is wrong because a quick format does not alter the magnetic charge of the drive's platters; the data is still magnetically stored and recoverable until overwritten.

Why this answer

How to eliminate wrong answers

Option A is wrong because donating computers without wiping data violates data privacy best practices and could expose sensitive company information, even if the intent is reuse. Option B is wrong because selling computers to a scrap metal dealer typically bypasses proper hazardous material handling, leading to toxic components like CRT glass or lithium batteries ending up in landfills or being processed unsafely. Option D is wrong because allowing employees to take computers home for personal use does not guarantee environmentally sound disposal and often results in devices being discarded improperly later, without any certified recycling process.

Why this answer

How to eliminate wrong answers

Option A is wrong because Event Viewer logs system, application, and security events but does not show live per-process CPU consumption — it's for diagnosing errors, not measuring resource usage. Option C is wrong because Services.msc only lists services and lets you start/stop them; it provides no CPU usage metrics, so you can't tell which service is consuming resources. Option D is wrong because Performance Monitor is designed for long-term, granular counter logging and baseline analysis — it's overkill and slower for a quick 'which process is eating CPU right now' check.