CompTIA A+ Core 2 220-1202 (220-1202) — Questions 676–750

Option B is correct because running 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt bypasses PowerShell's execution policy for that session and ensures the script runs with administrative privileges. This combination allows silent, unattended execution of the security update installation across multiple workstations without user interaction.

The tasklist command displays a list of running processes along with their PID, session name, and memory usage. This makes it the correct tool for identifying a memory-hungry process by name. Other options either do not show memory details or are used for different purposes like network configuration or disk management.

The scenario describes a critical security patch that must be applied immediately to prevent a data breach, which aligns with the definition of an emergency change. Emergency changes are pre-approved or fast-tracked to address urgent threats or service outages, bypassing the normal change advisory board (CAB) review process. This ensures the patch can be deployed without delay to mitigate the risk.

Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

The Personalization applet in Control Panel allows you to set a desktop background image. To enforce a mandatory background for all users, you would configure a Group Policy setting (via gpedit.msc) that references the Personalization category, specifically the 'Desktop Wallpaper' policy under User Configuration > Administrative Templates > Desktop > Desktop. This overrides individual user settings and locks the background.

Unsecured cables on ceiling tiles can cause the tiles to fall, creating a head injury risk and damaging equipment. Cables should be secured to the building structure using J-hooks or cable trays. This also prevents tripping hazards and maintains fire code compliance.

Tamper-evident seals show visible signs of removal or tampering, indicating unauthorized access to the server chassis. This is a passive but effective control for detecting physical breaches after they occur.

The rotation lock icon indicates the feature is enabled. On an iPad, this can be controlled via the Control Center or a physical switch on the side. The technician should disable rotation lock before any other troubleshooting.

The PowerShell execution policy controls which scripts can run and from where. The RemoteSigned policy requires that scripts from the internet (including network shares) be digitally signed, and it treats network drives as an 'internet' zone. When the script is run from a network folder, the policy blocks execution unless the script is signed, resulting in a 'permission denied' error, even though the user has full NTFS permissions.

The first step in malware remediation is to disconnect from the network to prevent further communication with command-and-control servers. Then boot into Safe Mode to prevent malicious processes from loading, and run a full antivirus scan. This isolates the threat before attempting removal.

PEAP-MSCHAPv2 is prone to authentication timeouts if the RADIUS server is slow or if the client's certificate validation fails. This can cause periodic disconnects. The issue is specific to the client's configuration or certificate trust.

Active Directory Users and Computers (ADUC) allows delegating control, including password reset permissions, through the Delegation of Control Wizard. This is a standard method for granular permission assignment in Active Directory. The other tools do not offer this delegation capability.

Option C is correct because the virus likely modified the Group Policy setting that enforces a specific desktop wallpaper. Even after the virus is removed, the Group Policy setting persists and overrides any user attempts to change the background. Resetting the Group Policy wallpaper enforcement restores the user's ability to change the background normally.

Even local administrators can be blocked from running executables that were downloaded from the internet because Windows marks them with a zone identifier. The 'Unblock' button in the file's Properties removes this mark, allowing the file to run. This is a common security feature in Windows to prevent accidental execution of potentially unsafe files.

iOS's 'Offload Unused Apps' feature automatically removes app binaries but keeps documents and data. It is found in Settings > General > iPhone Storage. This is distinct from manual deletion or iCloud storage management.

PowerShell Constrained Language Mode (CLM) restricts the language elements available to PowerShell, preventing the use of most .NET types, COM objects, and other advanced features that attackers rely on for in-memory payload execution. Since the attack used an obfuscated script that ran entirely in memory without touching disk, CLM would block the script's ability to invoke arbitrary .NET methods or Win32 API calls needed to download and execute the remote payload, stopping the attack before it could run.

This question tests the change management process when an approved change causes unexpected issues. The correct action is to stop the rollout and document the problem so the CAB can reassess the change.

The START /WAIT command launches a specified program or script and pauses execution of the batch file until that process terminates. This is exactly what is needed to ensure the installer completes before the next line runs, making it the correct choice for sequential automation.

Adding the user to a group with 'Modify' permissions is efficient because it avoids individual permission assignments and follows the principle of group-based access control. This ensures the user can edit files without overcomplicating permissions.

When a drive is not recognized after a suspected malware incident, the issue is often driver-related or due to a corrupted file system, not necessarily malware. Reinstalling or updating the USB controller driver in Device Manager can resolve recognition issues. The correct answer is to check Device Manager for driver issues.

The root cause is that the shared drive access is tied to individual accounts, encouraging sharing. Implementing group-based permissions with proper access control lists (ACLs) allows the company to grant access to a group rather than an individual, eliminating the need to share passwords. Additionally, enforcing a policy of non-repudiation and using audit logs can deter sharing.

This scenario tests troubleshooting cloud storage issues. The correct answer is C because many cloud services have file size limits, and a large video file may exceed that limit. The other options are less likely given that other uploads work and the connection is stable.

This question tests adaptability and respectful communication when language barriers exist. The correct answer uses a collaborative, patient approach to ensure understanding without causing embarrassment.

Biometric systems use unique physical traits (fingerprint, retina) that cannot be lost or easily duplicated. This eliminates the need to reissue credentials if a card or key is lost, though biometrics have their own management challenges.

Resource Monitor (resmon.exe) provides real-time metrics on disk activity, including disk queue length, average disk seconds per read/write, and per-process I/O. The user's symptom of 100% disk usage with low CPU/memory suggests a disk bottleneck; a consistently high queue length (above 2 per spindle) indicates the disk cannot keep up with I/O requests, which Resource Monitor can pinpoint directly.

Option B is correct because the virus likely uses a persistence mechanism such as a scheduled task (via schtasks.exe) or a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to re-infect the system after boot. Safe Mode may bypass some of these mechanisms, but a normal boot re-triggers them, allowing the virus to reinstall itself even after the initial removal.

A mismatched pre-shared key or RADIUS secret between the access point and the RADIUS server will cause authentication failures. Other options like channel interference or encryption mismatch would not specifically show RADIUS authentication failures.

A swelling lithium-ion battery indicates internal chemical breakdown and gas generation, which can lead to thermal runaway, fire, or explosion. The immediate risk is physical rupture of the battery casing and potential short-circuiting. The correct action is to shut down the laptop, disconnect the battery if it can be done safely without puncturing it, and replace it as soon as possible to eliminate the hazard.

Frequent freezing when multitasking on a system with a mechanical hard drive and limited RAM often points to excessive disk usage due to paging. The 'Avg. Disk Queue Length' counter in Performance Monitor indicates how many requests are waiting for the disk; a sustained value over 2 suggests the disk is the bottleneck, likely from swapping memory to the page file.

Windows Defender Firewall can block file and printer sharing even if sharing settings are enabled. The 'File and Printer Sharing' inbound rule must be allowed for the appropriate network profile (e.g., Private). This is a common issue after updates that reset firewall rules.

This is a classic phishing attack, specifically a form of spear phishing or whaling, where the attacker impersonates a high-level executive to trick the victim into performing an action. The slight alteration in the email address is a common indicator of a spoofed sender.

The correct answer is tasklist, which displays a list of running processes along with memory usage. You can sort the output by memory to quickly find the culprit. This is a fundamental command for identifying resource-hungry processes.

Rogue antivirus (scareware) displays fake warnings to trick users into paying for unnecessary software. The best approach is to boot into Safe Mode with Networking and run a legitimate malware removal tool, as the malware may block normal mode.

Leaking capacitors often contain hazardous materials such as electrolytes or polychlorinated biphenyls (PCBs), which require special handling to prevent environmental contamination and personal injury. The correct procedure is to wear nitrile gloves (to avoid skin contact with corrosive or toxic substances), place the switches in a sealed bag to contain any leaked material, and label them for e-waste recycling, ensuring compliance with environmental regulations like the WEEE Directive or RCRA.

The 'createinstallmedia' utility is the built-in Apple tool for creating bootable macOS installers. It must be run from Terminal with the correct path to the installer app and the target volume.

Option B is correct because the change management process explicitly requires a full system backup before patch installation. Deleting temporary files is a standard, low-risk method to free disk space and retry the backup, ensuring compliance without violating policy. This approach maintains data integrity and follows the established procedure.

Asset tracking tags allow the school to identify and recover stolen devices, acting as a deterrent and aiding in recovery. This balances security with usability, as the laptops remain fully functional for students.

Hardware RAID controllers often use non-standard sector layouts, making software-based wiping unreliable. The best approach is to use the RAID controller's own low-level format or secure erase utility, which understands the controller's geometry.

The correct approach is to use System Protection (System Restore) or the System File Checker (SFC) via Command Prompt. Since the user can access Task Manager, they can run 'sfc /scannow' from a command prompt. The System Protection tab in System Properties allows restoring to a previous state if available.

Sysprep is the correct tool because it generalizes a Windows installation by removing unique system identifiers (such as the computer SID, computer name, and driver caches) so that the reference computer’s image can be safely captured and deployed to multiple workstations. After Sysprep runs with the /generalize option, the image is captured using a tool like DISM or ImageX, then deployed to 200 identical workstations, ensuring each machine generates its own unique SID and settings on first boot.

This is a classic tech support scam, a form of scareware that locks the browser or desktop to trick users into calling a fake support number. The best removal approach is to boot into Safe Mode with Networking, then run a malware removal tool like Malwarebytes. This bypasses the malware's ability to block Task Manager and allows the technician to clean the system.

This scenario describes classic symptoms of adware or potentially unwanted program (PUP) infection. Adware displays unsolicited advertisements and often installs toolbars; it degrades performance and can be a vector for more serious malware. The correct answer identifies the issue as adware.

Option C is correct because it aligns with the CompTIA A+ objective of balancing security with business needs. The technician must communicate the security risks of the manager's requested configuration (e.g., using default credentials or disabling encryption on the POS system) in non-technical terms, then propose a secure alternative that still meets the operational requirements, such as using WPA3 with a strong passphrase instead of an open Wi-Fi network. This approach maintains professionalism, avoids data breaches, and preserves the working relationship.

The desired permissions are rw-r----- which is numeric 640. The chmod command with 640 sets owner read/write, group read, and no permissions for others.

A certificate error for a different domain indicates a possible man-in-the-middle attack or DNS hijacking. The correct action is to investigate the network and not proceed to the site. This tests understanding of SSL/TLS certificate warnings and their security implications.

Physical security for server rooms should include access control (e.g., electronic lock) and environmental monitoring (e.g., temperature/humidity sensors) to protect equipment. This addresses both security and operational continuity.

WPA2-PSK with a separate guest network and content filtering DNS provides both security and isolation. WPA3 is not yet widely supported on all devices, and MAC filtering is not effective for guest isolation.

The UPS is a heavy piece of equipment, and improper lifting can cause serious injury or damage. Using a lifting team or mechanical lift ensures safe handling and prevents back strain, crush injuries, or dropping the unit, which is the primary safety concern during physical installation.

The runas command allows executing a program with different credentials, typically an administrator account. In deployment scripts, runas /user:Administrator ensures the script runs with elevated privileges. Other options like msiexec install MSI packages, wmic queries WMI, and schtasks schedules tasks.

After removing malware, it is critical to check and clean startup entries using tools like MSConfig or Autoruns to prevent the malware from reloading on reboot. Malware often adds entries to the registry Run keys or the Startup folder to persist. Simply deleting files may leave these entries intact, allowing the malware to reinstall itself.

The 'Local Users and Groups' snap-in (lusrmgr.msc) is the correct tool for managing local user accounts and groups. Even if it's missing from Computer Management, it can be run directly or added via the MMC. The other options are not designed for user account management.

Magnetic tape is best destroyed by degaussing, which disrupts the magnetic domains, or by physical shredding. Degaussing is fast and effective for tape, but it renders the tape unusable. Shredding is also acceptable.

This question tests knowledge of Android's privacy features. The correct answer is 'Randomized MAC Address', a security feature that spoofs the MAC address per network. The displayed address suggests the randomization is active, and disabling it for the specific network or turning off 'Use randomized MAC' can resolve connectivity issues.

Some legitimate software installers include options to change browser settings, and users may inadvertently agree. This is a common cause of homepage changes that are not malware-related.

The user's RDP session disconnects after a few minutes, which is a classic symptom of an idle session timeout enforced by the Remote Desktop Session Host (RD Session Host) or Group Policy. By default, Windows Server RDS roles have an idle session limit (often 15 minutes) that disconnects inactive sessions to free resources. Checking this configuration directly addresses the symptom, whereas other options target less likely causes for a consistent, time-based disconnect.

The script has no execute permission for any user. Using chmod with the numeric value 755 sets read, write, and execute for the owner, and read and execute for group and others, allowing the user to run the script.

The Windows Defender Firewall applet (Option B) is the dedicated Control Panel interface for managing Windows Firewall settings, including turning the firewall on or off. Since the question specifically asks which applet to use to enable the firewall, this is the correct tool. Other applets may display firewall status but do not provide the direct toggle to enable or disable the firewall.

After adware removal, the browser's homepage and settings are often stored in the browser's configuration files or registry keys that the antivirus does not reset. Resetting the browser settings to default restores the homepage, search engine, and new tab page to their original state, clearing any persistent malicious configurations left behind by the adware.

Account lockout policies are configured in the Local Security Policy under Account Policies. Setting 'Account lockout threshold' to 5 will lock the account after that many failed attempts, preventing brute-force attacks.

Windows Defender Application Guard is designed to isolate untrusted downloads and prevent execution until scanned. This tests knowledge of Windows security features for browser and file safety. The other options are either not relevant or less effective.

A small fire in a power strip involves energized electrical equipment. Class C fire extinguishers (dry chemical) are specifically designed for electrical fires because the dry chemical agent is non-conductive, preventing the risk of electric shock. Using a water-based extinguisher (Class A) or CO2 (Class B) on live electrical equipment can cause electrocution or damage, while Class D is for combustible metals.

Option B is correct because it first validates the user's frustration (professionalism) and then uses a probing question to gather diagnostic data about the specific conditions causing the freezing. This aligns with the CompTIA A+ troubleshooting methodology (identify the problem) and maintains rapport, which is critical for customer satisfaction. The technician avoids premature blame or dismissal, instead focusing on correlating the symptom (freezing) with resource contention from the browser tabs and design app.

The correct tool is 'Default Apps' in Windows Settings, where you can set per-application defaults. This ensures the change persists across restarts, unlike simply choosing 'Always use this app' from a file dialog which may not override system policies.

The runas command allows you to run a program with different credentials, such as an administrator account, from the command line. It is the standard way to elevate privileges in a script. Other commands either manage user accounts or change directories.

The bootrec tool is specifically designed to repair BCD and boot sector issues. Running bootrec /rebuildbcd scans for Windows installations and rebuilds the BCD store.

Forcing a legacy app to run as administrator without UAC prompts for a standard user requires creating a scheduled task that runs with elevated privileges. The task can be set to run at user logon or on demand, and the application is launched by the task with the stored admin credentials. This bypasses UAC while maintaining security for the standard user account.

This scenario describes a phishing attack, specifically a variant called whaling or CEO fraud, where the attacker impersonates a high-level executive. Phishing is the use of deceptive emails to trick users into revealing sensitive information or performing actions. The slightly off email address and missing disclaimer are classic indicators of a phishing attempt.

Windows User Account Control (UAC) can be configured to prompt for consent or credentials when software installation is attempted, even for local admins. If UAC is set to 'Always notify,' it will block installations that don't receive explicit approval. The 'blocked by administrator' message often points to UAC or AppLocker, but with local admin rights, UAC is the primary control.

A worm self-replicates and spreads automatically, often via email or network shares, without needing to attach to a host file. This behavior distinguishes it from a virus, Trojan, or rootkit.

B is correct because RDP traffic is encrypted but not authenticated at the transport layer, making it vulnerable to man-in-the-middle attacks, especially over untrusted international networks. A VPN (e.g., IPsec or OpenVPN) provides an additional layer of encryption and authentication for the entire session before RDP traffic is sent, ensuring confidentiality and integrity even if the RDP protocol itself is compromised.

This scenario tests troubleshooting touchscreen issues. Since a forced restart didn't help, booting into Safe Mode can determine if a third-party app is causing the problem.

Option B is correct because change management best practices require that before any action is taken, the technician should first consult the change log to understand what was changed and identify the documented rollback procedure. This ensures a controlled, reversible approach rather than risking data loss or further instability by acting without full knowledge of the update's scope.

BitLocker with a PIN enhances pre-boot authentication by requiring both a TPM (for integrity verification) and a user-entered PIN before the OS loads. This prevents unauthorized access even if the TPM is present. This question tests the understanding of BitLocker's pre-boot authentication options and the role of the TPM.