Courseiva

CompTIA A+ Core 2 220-1202 (220-1202) — Questions 226–300

495 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 7

Page 5
226
MCQmedium

A technician receives an angry email from a user claiming that the technician's previous fix made their computer worse. The technician knows the fix was correct. Which response is MOST professional?

A.Reply with a detailed technical explanation proving the fix was right.
B.Ignore the email to avoid an argument.
C.Apologize for the inconvenience and schedule a time to revisit the issue.
D.Forward the email to the user's manager to complain about the user's tone.
AnswerC

Apologizing for the inconvenience, even if the technician believes the initial fix was correct, is a crucial de-escalation technique that validates the user's frustration without admitting fault. Scheduling a follow-up demonstrates a commitment to resolving the user's perceived problem and provides an opportunity for further diagnosis, ensuring the user feels heard and supported. This approach prioritizes customer satisfaction and effective problem management over immediate technical vindication.

Why this answer

The most professional response in this scenario is to de-escalate the situation by acknowledging the user's frustration and offering to re-engage on the issue. Even if the technician's fix was technically correct, the user's perception of a problem is a valid concern that must be addressed to maintain trust and service quality. Scheduling a follow-up allows the technician to re-evaluate the system, verify that no other changes have affected the computer, and provide reassurance, which aligns with ITIL best practices for incident management and customer service.

Exam trap

CompTIA often tests the candidate's ability to prioritize emotional intelligence and de-escalation over technical accuracy, trapping those who think proving the fix was right (Option A) is the most professional response, when in fact it ignores the user's perspective and can damage the customer relationship.

How to eliminate wrong answers

Option A is wrong because replying with a detailed technical explanation, while factually accurate, is likely to be perceived as defensive and condescending, escalating the conflict rather than resolving the user's emotional concern; professionalism requires empathy over technical correctness. Option B is wrong because ignoring the email is a form of avoidance that neglects the user's complaint, potentially damaging the technician's reputation and the IT department's credibility, and it fails to address any underlying issue that may have arisen from the fix or subsequent changes. Option D is wrong because forwarding the email to the user's manager to complain about the user's tone is unprofessional, violates confidentiality, and shifts blame instead of focusing on problem resolution; it undermines the technician's role as a service provider and could create unnecessary workplace conflict.

Full explanation →
227
MCQmedium

A technician is setting up a wireless network for a small office that handles sensitive client data. The office has a mix of modern laptops and a few legacy printers that only support WEP. What should the technician do to maintain security while keeping the printers functional?

A.Enable WEP on the main router and set a complex 128-bit key.
B.Replace the printers with modern ones that support WPA2.
C.Create a separate VLAN for the printers using WEP and a strong passphrase, and keep the main network on WPA2.
D.Set the router to mixed mode (WEP + WPA2) and use a single SSID.
AnswerC

Creating a separate Virtual Local Area Network (VLAN) for the legacy WEP printers effectively segments the network, isolating the inherent security weaknesses of WEP to a dedicated subnet. This ensures that the main network, which carries sensitive data, can maintain robust WPA2 encryption without being compromised by the less secure WEP traffic. Network segmentation prevents an attacker who might compromise the WEP VLAN from easily accessing resources on the more secure WPA2 network, thus mitigating risk while accommodating legacy hardware.

Why this answer

It isolates the insecure WEP-based printers on a separate VLAN, preventing their weak encryption from compromising the main network which uses WPA2. This allows the legacy printers to remain functional while sensitive client data on the main network is protected by the stronger WPA2 protocol.

Exam trap

The trap here is that candidates often think mixed mode (WEP + WPA2) is a valid compromise, but CompTIA A+ tests the understanding that mixed mode on a single SSID downgrades security for all devices, whereas VLAN segmentation isolates the weak protocol without affecting the secure network.

How to eliminate wrong answers

Option A is wrong because WEP is fundamentally broken and can be cracked in minutes using tools like aircrack-ng, regardless of key length; a complex 128-bit key does not fix the underlying RC4 cipher weaknesses. Option B is wrong because replacing functional printers is an unnecessary cost and not a network configuration solution; the question asks how to maintain security while keeping the printers functional. Option D is wrong because mixed mode (WEP + WPA2) on a single SSID forces all clients to use the lowest common denominator security, allowing attackers to downgrade modern clients to WEP and compromise the entire network.

Full explanation →
228
MCQeasy

A technician is configuring a company-issued iPhone for a new employee. After setting up the email account, the employee says they cannot receive emails, but they can send them. Which setting should the technician check first?

A.The outgoing mail server (SMTP) settings.
B.The incoming mail server (IMAP/POP3) settings.
C.The device's date and time settings.
D.The phone's VPN configuration.
AnswerB

The Incoming Mail Server settings, utilizing protocols like IMAP (Internet Message Access Protocol) or POP3 (Post Office Protocol version 3), are directly responsible for retrieving emails from the mail server to the device. If these settings, such as the server address, port number, or authentication credentials, are misconfigured, the iPhone will be unable to connect to the mail server to download new messages. This directly explains why the user can send but not receive emails.

Why this answer

The symptom—able to send but not receive emails—indicates a problem with the incoming mail server configuration. Sending uses SMTP (outgoing), while receiving uses IMAP or POP3 (incoming). The technician should first verify the incoming mail server settings (server hostname, port, SSL/TLS, and authentication) because a misconfiguration there would prevent the device from downloading new messages.

Exam trap

CompTIA often tests the distinction between incoming and outgoing mail protocols, and the trap here is that candidates mistakenly focus on SMTP (outgoing) because they think 'send' and 'receive' are handled by the same server, when in fact they use separate protocols and settings.

How to eliminate wrong answers

Option A is wrong because the outgoing mail server (SMTP) settings are responsible for sending emails, which the employee can already do successfully, so checking SMTP would not resolve the receive issue. Option C is wrong because incorrect date and time settings can cause SSL/TLS certificate validation failures for both sending and receiving, but the employee can send emails, indicating that the device's time is likely correct or at least not the primary cause of the receive-only failure. Option D is wrong because a VPN configuration issue would typically affect all network traffic or specific app connectivity, not selectively block incoming email while allowing outgoing email; email protocols operate independently of VPN unless the VPN is misconfigured to block specific ports.

Full explanation →
229
MCQhard

You are troubleshooting a Windows 10 PC that fails to boot with the error 'Boot Configuration Data is missing.' Which built-in tool can you use from the Windows Recovery Environment to rebuild the BCD store?

A.System File Checker (sfc /scannow)
B.Diskpart
C.Bootrec.exe
D.CHKDSK
AnswerC

Bootrec.exe is a specialized command-line tool specifically engineered for troubleshooting and repairing boot-related issues in Windows operating systems. When invoked with the `/rebuildbcd` switch, it performs a comprehensive scan of all disks for compatible Windows installations. It then allows the user to select which identified installations to add to a newly created Boot Configuration Data (BCD) store, effectively reconstructing the BCD and resolving critical errors such as a missing or corrupted BCD that prevent the system from booting.

Why this answer

Bootrec.exe is the correct built-in tool for rebuilding the Boot Configuration Data (BCD) store from the Windows Recovery Environment (WinRE). The specific command 'bootrec /rebuildbcd' scans all disks for Windows installations and allows you to rebuild the BCD store, directly addressing the 'Boot Configuration Data is missing' error. Other tools like SFC, Diskpart, and CHKDSK do not have the capability to reconstruct the BCD store.

Exam trap

The trap here is that candidates often confuse System File Checker (SFC) as a universal repair tool, but it cannot fix boot configuration issues because the BCD store is not a system file protected by Windows File Protection.

How to eliminate wrong answers

Option A is wrong because System File Checker (sfc /scannow) scans and repairs protected system files, but it does not interact with or rebuild the BCD store, which is a separate boot configuration database. Option B is wrong because Diskpart is a disk partitioning tool used to manage volumes and partitions, not to repair boot configuration data; it cannot rebuild the BCD store. Option D is wrong because CHKDSK checks the file system for integrity and fixes logical disk errors, but it has no mechanism to rebuild or repair the BCD store, which is stored in a hidden system partition.

Full explanation →
230
MCQmedium

During a security audit, a technician discovers that an employee has been using a third-party remote desktop tool without IT approval. The employee claims it was necessary to access a legacy application. Which security risk is most directly associated with unauthorized remote access tools?

A.Increased bandwidth usage
B.Man-in-the-middle attacks
C.Compatibility issues with the operating system
D.Increased licensing costs
AnswerB

Unauthorized tools, especially those not properly vetted or configured, often lack robust security features such as strong encryption protocols (e.g., TLS 1.3) or proper certificate validation. This deficiency creates vulnerabilities where an attacker can intercept communications between two parties, read sensitive data, or even alter messages in transit without either party being aware. Such tools provide an ideal vector for man-in-the-middle attacks, directly compromising the confidentiality and integrity of data exchanged and potentially leading to unauthorized access or system manipulation.

Why this answer

Unauthorized remote desktop tools often lack the encryption and authentication controls found in approved solutions like SSH or RDP with Network Level Authentication. This exposes the connection to man-in-the-middle attacks, where an attacker can intercept, decrypt, or modify the traffic between the employee's workstation and the legacy application server, potentially capturing credentials or sensitive data.

Exam trap

CompTIA often tests the distinction between operational issues (bandwidth, compatibility, cost) and actual security threats, so candidates mistakenly choose a non-security answer like increased bandwidth usage because it sounds like a plausible downside of remote access tools.

How to eliminate wrong answers

Option A is wrong because increased bandwidth usage is a performance concern, not a direct security risk, and unauthorized remote tools may actually use less bandwidth than approved ones. Option C is wrong because compatibility issues with the operating system are a functional problem, not a security risk, and the employee's claim of needing access to a legacy application suggests compatibility was achieved, not a risk. Option D is wrong because increased licensing costs are a financial or compliance issue, not a security risk, and unauthorized tools typically avoid licensing fees altogether.

Full explanation →
231
MCQhard

A technician is updating the documentation for a server that had its RAID controller replaced. The technician must ensure that future technicians can quickly identify the new hardware configuration. Which type of documentation should be updated?

A.The network topology diagram.
B.The change management log.
C.The server's asset inventory record.
D.The knowledge base article for RAID troubleshooting.
AnswerC

The server's asset inventory record, often integrated into a Configuration Management Database (CMDB), is the definitive source for detailed hardware and software specifications of an IT asset. This record precisely documents components like the RAID controller model, firmware version, installed memory, and storage configuration. Maintaining this information ensures that technicians can quickly identify, troubleshoot, and replace specific hardware components, facilitating efficient maintenance and support.

Why this answer

The server's asset inventory record (Option C) is the correct documentation to update because it contains the detailed hardware configuration of the server, including the RAID controller model, firmware version, and disk layout. Future technicians rely on this record to quickly identify the exact hardware components without having to physically inspect the server or dig through logs. Updating the asset inventory ensures that the documented configuration matches the actual hardware, which is critical for troubleshooting, warranty claims, and future upgrades.

Exam trap

CompTIA often tests the distinction between operational documentation (like asset inventory) and process documentation (like change logs or knowledge bases), and the trap here is that candidates confuse the change management log (which tracks the change event) with the hardware configuration record (which documents the resulting state).

How to eliminate wrong answers

Option A is wrong because a network topology diagram shows how devices are connected on the network (e.g., switches, routers, IP subnets), not the internal hardware components of a server like a RAID controller. Option B is wrong because the change management log records the approval and timeline of changes (e.g., who authorized the replacement, when it occurred), but it does not serve as a quick-reference for the new hardware configuration. Option D is wrong because a knowledge base article for RAID troubleshooting provides generic guidance on resolving RAID issues, not the specific hardware details of this particular server's RAID controller.

Full explanation →
232
MCQhard

A technician is troubleshooting a network issue for a remote employee. The employee's internet connection is unstable, and the technician suspects the home router. The employee is not technical and becomes defensive when the technician asks about their router setup. Which approach is MOST effective?

A.Tell the employee that their router is probably cheap and needs replacement.
B.Say, 'Let's work together to check a few things on your router to improve your connection.'
C.Ask the employee to run a command prompt command without explanation.
D.Escalate the issue to a senior technician without further attempts.
AnswerB

This collaborative language reduces blame and invites cooperation.

Why this answer

It uses a collaborative, non-confrontational approach that respects the employee's lack of technical knowledge and defuses defensiveness. By saying 'Let's work together,' the technician invites the employee to participate without blame, making it easier to guide them through checking the router's configuration (e.g., verifying Wi-Fi channel congestion, checking for firmware updates, or reviewing DHCP lease times) without requiring the employee to understand technical details. This aligns with CompTIA's emphasis on professionalism and effective communication in remote troubleshooting.

Exam trap

CompTIA often tests the candidate's ability to choose the most professional and effective communication strategy in a stressful or non-technical user scenario, where the trap is that candidates may select a technically correct but socially inappropriate option (like A or C) because they focus on the technical fix rather than the human interaction required to achieve it.

How to eliminate wrong answers

Option A is wrong because telling the employee their router is 'probably cheap and needs replacement' is dismissive, insulting, and fails to diagnose the actual issue; it assumes hardware fault without evidence and can damage trust, making the employee less cooperative. Option C is wrong because asking a non-technical employee to run a command prompt command without explanation (e.g., 'ipconfig /flushdns' or 'ping 8.8.8.8') creates confusion and anxiety, and the employee may misinterpret or incorrectly execute the command, leading to wasted time or further issues. Option D is wrong because escalating to a senior technician without attempting any troubleshooting abdicates the technician's responsibility and fails to leverage the opportunity to resolve the issue with basic communication and guidance, which is inefficient and unprofessional.

Full explanation →
233
MCQeasy

A small business owner calls for support because all of their files on the server have been renamed with a .encrypted extension, and a text file named 'README_TO_DECRYPT.txt' appears on the desktop demanding a Bitcoin payment. What is the first step the technician should take?

A.Pay the ransom to get the decryption key immediately.
B.Disconnect the server from the network.
C.Run a full antivirus scan on the server.
D.Restore files from a recent backup immediately.
AnswerB

Immediately disconnecting the infected server from the network is the critical first step in containing a ransomware incident. This action prevents the ransomware from encrypting additional files on the local system, halts its ability to spread to other network shares, connected devices, or backup systems, and isolates the threat. By containing the infection, IT personnel can safely begin investigation, eradication, and recovery procedures without risking wider organizational impact.

Why this answer

The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Paying the ransom is discouraged as it does not guarantee data recovery and funds criminal activity. After isolation, the technician can assess the damage and attempt recovery from backups.

Full explanation →
234
MCQmedium

Your company's security policy requires that all workstations have the latest Windows security updates installed. You need to verify the update history on a user's Windows 10 PC to ensure no critical updates are missing. Which tool should you use?

A.Windows Update
B.Event Viewer
C.System Information
D.Reliability Monitor
AnswerA

Windows Update is the dedicated and primary interface within the operating system for managing and reviewing the status of security patches, feature updates, and driver installations. It provides a comprehensive history of all installed updates, allowing administrators to verify compliance with security policies and identify any missing or pending updates. This tool is essential for ensuring a workstation remains secure and up-to-date against known vulnerabilities.

Why this answer

Windows Update settings (in Settings app or old Control Panel) shows update history, including installed updates and their dates. This is the standard way to check which updates have been applied.

Full explanation →
235
MCQmedium

A user's iPhone 13 suddenly shows a black screen with a spinning gear icon after an iOS update. The device does not respond to touch or button presses. What is the most likely cause and the correct first step?

A.The battery is dead; connect to a charger and wait.
B.Force restart the iPhone by pressing and releasing Volume Up, then Volume Down, then holding the Side button until the Apple logo appears.
C.Place the device in DFU mode and restore via Finder.
D.The screen is damaged; replace the display assembly.
AnswerB

This specific button sequence (press and release Volume Up, then press and release Volume Down, then press and hold the Side button) is the standard force restart procedure for iPhone 8 and newer models, including the iPhone 13. It performs a hardware-level reset, interrupting any hung software processes, such as a frozen operating system or a stalled update. This action often resolves issues like a black screen with a spinning gear by forcing the device to reboot cleanly without data loss.

Why this answer

The black screen with a spinning gear icon after an iOS update indicates the device is stuck in a boot loop or update process, not a hardware failure. A force restart (Volume Up, Volume Down, hold Side button) is the correct first step because it forces the iPhone to reboot without erasing data, often resolving temporary software hangs. This sequence is specific to iPhone 7 and later models, including the iPhone 13, and bypasses unresponsive touch or button inputs.

Exam trap

CompTIA often tests the distinction between a force restart and DFU mode, where candidates mistakenly jump to DFU restore (Option C) as the first step, not realizing that a force restart is a non-destructive recovery method that resolves most post-update boot loops.

How to eliminate wrong answers

Option A is wrong because a dead battery would show a black screen without the spinning gear icon, and the device would respond to a charger by displaying a low-battery indicator; the gear icon indicates the OS is partially active. Option C is wrong because DFU mode and restore via Finder is a more drastic step that erases all data and should only be attempted after simpler recovery methods like force restart fail; it is not the first step. Option D is wrong because a damaged display would typically show physical cracks, discoloration, or no image at all, not a spinning gear icon, and the device would still respond to button presses or sounds.

Full explanation →
236
MCQeasy

A company wants to allow external contractors to access a specific internal web application without installing any client software. Which remote access technology best meets this requirement?

A.VPN with a client
B.Remote Desktop Protocol
C.Reverse proxy
D.SSH
AnswerC

A reverse proxy acts as an intermediary server that sits in front of one or more web servers, forwarding client requests to the appropriate backend server and returning the server's response to the client. For external contractors, this means they can access internal web applications simply by using a standard web browser, as the reverse proxy handles the routing, security, and potentially SSL termination without requiring any special client software or configuration on their devices. This method centralizes access control and enhances security by shielding internal servers from direct internet exposure.

Why this answer

A reverse proxy is the correct choice because it allows external contractors to access a specific internal web application through a public-facing proxy server without requiring any client software installation. The reverse proxy terminates the external connection and forwards requests to the internal web server, handling authentication and encryption at the proxy layer, which meets the requirement of zero client-side setup.

Exam trap

The trap here is that candidates often confuse 'remote access' with VPN or RDP, assuming any secure remote connection requires a client, but the question specifically tests the understanding that a reverse proxy provides application-layer access without client software, unlike VPN or RDP which require dedicated clients.

How to eliminate wrong answers

Option A is wrong because a VPN with a client requires installing and configuring VPN client software on the contractor's device, which violates the 'without installing any client software' requirement. Option B is wrong because Remote Desktop Protocol (RDP) requires a client application (such as Microsoft Remote Desktop Client) to be installed on the accessing device, and it provides full desktop access rather than access to a specific web application. Option D is wrong because SSH is a protocol for secure command-line access to remote systems, typically requiring an SSH client (like PuTTY or OpenSSH) to be installed, and it does not natively provide web application access without additional tunneling or port forwarding.

Full explanation →
237
MCQmedium

A user's browser is displaying a warning that the website's certificate is not trusted, even though the URL is correct. The technician checks the date and time on the computer and finds it is set to 2019. What is the most likely cause of the certificate warning?

A.The website's SSL certificate has been revoked.
B.The browser's certificate store is corrupted.
C.The system date is incorrect, causing certificate validation to fail.
D.The user is connected to a malicious proxy.
AnswerC

SSL/TLS certificates contain specific 'valid from' and 'valid to' date ranges, which are cryptographically signed by the Certificate Authority. If the client system's date and time fall outside this defined validity period, the browser's cryptographic validation process will fail, as it cannot confirm the certificate is currently legitimate. An incorrect system date, such as being set to 2019 when the certificate is valid for a later period, directly causes this validation failure and triggers a security warning.

Why this answer

The system date is set to 2019, which is outside the certificate's validity period. SSL/TLS certificates have a specific notBefore and notAfter date range; when the client's clock is outside this range, the browser rejects the certificate as untrusted. This is the most direct and common cause of the warning given the symptom and the technician's finding.

Exam trap

CompTIA A+ often tests the candidate's ability to distinguish between certificate revocation, corruption, and simple date/time misconfiguration, trapping those who overthink the problem or assume a security breach (like a proxy) when the most basic setting is wrong.

How to eliminate wrong answers

Option A is wrong because a revoked certificate would trigger a different warning (e.g., 'certificate revoked') and is not caused by an incorrect system date; revocation is checked via CRL or OCSP, not local clock. Option B is wrong because a corrupted certificate store would cause failures across many sites, not just one, and the date issue is a specific, isolated cause. Option D is wrong because a malicious proxy would typically present a different certificate or cause a different error (e.g., name mismatch or untrusted root), not a date-related warning, and the technician already found the date is incorrect.

Full explanation →
238
MCQeasy

A user on an Android tablet reports that the Google Play Store is not downloading any apps, showing an error message about insufficient storage. The device's storage settings show 2GB free. What should you do first?

A.Factory reset the tablet.
B.Clear the cache and data of the Google Play Store app.
C.Uninstall large apps to free up more storage.
D.Check for a system update.
AnswerB

Clearing the cache and data for the Google Play Store app is a primary troubleshooting step because it removes any corrupted temporary files or outdated configuration data that the app has stored. These files can interfere with the Play Store's ability to download or install applications correctly, even when ample device storage is available. This action forces the app to rebuild its operational data, often resolving transient download errors without affecting other user data or system settings.

Why this answer

Clearing the cache and data of the Google Play Store app is the correct first step because the error message about insufficient storage, despite 2GB free, often indicates a corrupted cache or data within the Play Store itself. This corruption can cause the Play Store to misreport storage availability or fail to initialize downloads. Clearing these app-specific files forces the Play Store to rebuild its state, resolving the false positive without affecting user data or requiring additional free space.

Exam trap

CompTIA often tests the misconception that 'insufficient storage' errors always require freeing up physical space, when in reality the error can stem from a corrupted app cache that misreports storage, making clearing the cache the correct first step rather than deleting apps.

How to eliminate wrong answers

Option A is wrong because a factory reset is a drastic, last-resort measure that wipes all user data and settings; it is not appropriate for a software-level issue like a corrupted Play Store cache, which can be resolved with a targeted app data clear. Option C is wrong because uninstalling large apps to free up more storage addresses a genuine lack of space, but the device already shows 2GB free, which should be sufficient for most app downloads; the problem is a false storage detection, not actual insufficient capacity. Option D is wrong because checking for a system update is a general maintenance step that does not directly fix a corrupted Play Store cache or data; while updates can resolve bugs, the immediate symptom of a false storage error is best addressed by clearing the app's local data first.

Full explanation →
239
MCQhard

A company's network was breached, and forensic analysis reveals that an attacker used a pass-the-hash attack to move laterally. Which security measure would most effectively prevent this type of attack in the future?

A.Require all users to change passwords every 30 days.
B.Implement network segmentation and firewall rules.
C.Enable Windows Defender Credential Guard.
D.Disable NTLM authentication entirely.
AnswerC

Enabling Windows Defender Credential Guard is a highly effective countermeasure specifically designed to mitigate pass-the-hash attacks by isolating credential material. It uses virtualization-based security to store NTLM password hashes and Kerberos Ticket Granting Tickets (TGTs) in a secure, isolated container, making them inaccessible to malware even if the operating system kernel is compromised. This isolation prevents attackers from extracting and reusing these critical credentials for lateral movement, directly addressing the core mechanism of pass-the-hash.

Why this answer

Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate and protect NTLM password hashes and Kerberos tickets in a secure container, preventing attackers from extracting them from LSASS memory even if they have administrative access. This directly stops pass-the-hash attacks because the hashes are never accessible to the operating system or tools like Mimikatz.

Exam trap

CompTIA often tests the misconception that network segmentation or disabling NTLM alone stops pass-the-hash, but the core issue is protecting the hash in memory, which only Credential Guard (or equivalent) addresses.

How to eliminate wrong answers

Option A is wrong because frequent password changes do not prevent pass-the-hash attacks; the attacker uses the hash of the current password, and changing passwords every 30 days does not protect the hash stored in memory during an active session. Option B is wrong because network segmentation and firewall rules can limit lateral movement but do not prevent the extraction or reuse of password hashes from a compromised host; the attacker can still move within the allowed segment. Option D is wrong because disabling NTLM authentication entirely is often impractical due to legacy application dependencies, and pass-the-hash attacks can also target Kerberos tickets (pass-the-ticket), so this measure is not comprehensive and may break critical services.

Full explanation →
240
MCQmedium

A small office has a UPS that emits a loud beeping sound and a burning smell. The technician suspects the battery is overheating. What is the correct immediate action?

A.Replace the battery while the UPS is still plugged in.
B.Unplug the UPS and move it to an open, well-ventilated area.
C.Reset the UPS by pressing the power button.
D.Spray the UPS with a fire extinguisher.
AnswerB

An overheating UPS, especially one emitting a burning smell, indicates a critical internal fault, most commonly a failing battery experiencing thermal runaway. Unplugging the unit immediately removes all power input, preventing further charging or discharge that could exacerbate the thermal event. Moving it to a well-ventilated area helps dissipate any hazardous fumes or heat, significantly mitigating the risk of fire, explosion, or inhalation exposure to toxic gases.

Why this answer

The correct immediate action is to unplug the UPS and move it to an open, well-ventilated area. A burning smell combined with loud beeping indicates a critical thermal runaway condition in the battery, which can lead to fire or explosion. Disconnecting the UPS from mains power stops the charging current that is likely exacerbating the overheating, and moving it to a ventilated area reduces the risk of toxic gas accumulation and fire spread.

Exam trap

CompTIA often tests the misconception that resetting the UPS or replacing the battery while powered on is a safe troubleshooting step, when in fact the immediate priority is to isolate the hazard by disconnecting power and ventilating the area.

How to eliminate wrong answers

Option A is wrong because replacing a battery while the UPS is still plugged in exposes the technician to high DC voltage (typically 12V–48V) and the risk of short circuits or electric shock, and the continued charging current could accelerate thermal runaway. Option C is wrong because resetting the UPS by pressing the power button does not address the underlying overheating battery; it may briefly silence the alarm but will not stop the chemical reaction causing the burning smell, and could even restart charging. Option D is wrong because spraying a UPS with a fire extinguisher, especially a CO2 or dry chemical type, can damage sensitive electronics, create a conductive residue, and is not the correct first response; the priority is to disconnect power and ventilate, not to apply an extinguisher to a device that is not yet on fire.

Full explanation →
241
MCQhard

During a network upgrade, a technician finds a box of old NICs, cables, and small electronic components that are no longer needed. The company has no formal e-waste policy. What should the technician do?

A.Throw the items in the dumpster since they are small and the company has no policy.
B.Store the items indefinitely in a closet until a policy is created.
C.Research local e-waste recycling facilities and present a disposal plan to the manager for approval.
D.Sell the items online as a lot to a recycler.
AnswerC

This option demonstrates proactive problem-solving, professional responsibility, and environmental stewardship. By researching local e-waste recycling facilities, the technician identifies compliant and environmentally sound disposal methods for electronic waste. Presenting a formal disposal plan to management ensures proper authorization, facilitates the establishment of company-wide e-waste policies, and mitigates legal and environmental risks associated with improper disposal.

Why this answer

In the absence of a formal e-waste policy, the technician must act responsibly by researching local e-waste recycling facilities and presenting a disposal plan to the manager for approval. This aligns with environmental best practices and regulatory compliance, as improper disposal of electronic components can violate local laws and harm the environment. The technician should not unilaterally dispose of or sell the items without management authorization.

Exam trap

CompTIA often tests the trap that 'no policy means no rules,' leading candidates to choose Option A or B, but the correct approach is to proactively research and propose a compliant disposal plan rather than ignoring the issue or taking unilateral action.

How to eliminate wrong answers

Option A is wrong because throwing e-waste in a dumpster is illegal in many jurisdictions due to hazardous materials like lead, mercury, and cadmium found in NICs and electronic components; it also violates environmental responsibility even without a formal policy. Option B is wrong because storing items indefinitely in a closet is not a sustainable solution and can lead to safety hazards, space issues, and potential regulatory non-compliance if the items contain hazardous materials. Option D is wrong because selling e-waste online to a recycler without management approval and without vetting the recycler's compliance with environmental regulations could expose the company to liability and data security risks, as NICs may retain network configuration data.

Full explanation →
242
MCQmedium

A user reports that their cloud-synced files are not appearing on their laptop after a recent OS reinstall. The technician verifies that the cloud storage account is active and the internet connection works. Which of the following is the most likely reason for the missing files?

A.The cloud storage provider has deleted the files due to inactivity
B.The user's account is not licensed for the cloud service
C.The local sync client is configured for selective sync and not downloading all folders
D.The laptop's hard drive is full
AnswerC

Many cloud synchronization clients, especially following a fresh installation or reset, default to a selective sync configuration. This setting allows users to manually specify which folders and files from the cloud should be downloaded and stored locally on the device. If the user did not explicitly select all desired folders for local synchronization, those unselected folders would appear missing on the laptop, despite being fully present and accessible in the cloud.

Why this answer

Cloud storage clients use a local cache to sync files. After an OS reinstall, the client must re-download files from the cloud, but if selective sync is enabled, only certain folders are synced. The user may need to adjust sync settings to restore all files.

This tests understanding of cloud storage synchronization behavior.

Full explanation →
243
MCQmedium

A company's IT policy requires that all wireless connections use certificate-based authentication to prevent unauthorized access. The network is currently using WPA2-PSK. Which configuration change is necessary to meet this policy?

A.Enable MAC address filtering on the access point.
B.Upgrade to WPA3-Personal.
C.Switch to WPA2-Enterprise and configure a RADIUS server.
D.Change the encryption from AES to TKIP.
AnswerC

WPA2-Enterprise is the appropriate solution because it leverages the 802.1X authentication framework, which is designed for robust, centralized user and device authentication. This framework integrates with a RADIUS (Remote Authentication Dial-In User Service) server, allowing for authentication against various credentials, including digital certificates. By configuring a RADIUS server to issue and validate certificates, the company can effectively enforce its policy for certificate-based authentication on wireless connections.

Why this answer

The policy requires certificate-based authentication, which is a feature of WPA2-Enterprise (802.1X). WPA2-Enterprise uses a RADIUS server to validate certificates and authenticate users individually, replacing the pre-shared key (PSK) model. This meets the requirement for certificate-based authentication to prevent unauthorized access.

Exam trap

The 220-1202 exam often tests the distinction between Personal and Enterprise modes, where candidates mistakenly think upgrading to WPA3-Personal (Option B) adds certificate support, but only the Enterprise mode with a RADIUS server enables certificate-based authentication.

How to eliminate wrong answers

Option A is wrong because MAC address filtering is not a form of authentication and can be easily spoofed; it does not use certificates. Option B is wrong because WPA3-Personal still uses a shared passphrase (SAE handshake), not certificate-based authentication; it is the Personal mode, not Enterprise. Option D is wrong because changing encryption from AES to TKIP would weaken security and does not introduce certificate-based authentication; TKIP is deprecated and not compatible with 802.1X in this context.

Full explanation →
244
MCQmedium

A retail store wants to protect its point-of-sale (POS) terminals from unauthorized physical access during off-hours. The terminals are in an open area with no lockable cabinets. Which control should be prioritized?

A.Install a privacy screen on each POS terminal.
B.Use tamper-evident seals on the terminal casings.
C.Require a smart card to power on the terminal.
D.Enable a screensaver with a password.
AnswerB

Tamper-evident seals are physical security devices designed to provide a clear visual indication if a device's casing has been opened or manipulated. These seals typically break, tear, or display a "void" message upon removal, immediately alerting staff to potential unauthorized physical access. This proactive detection mechanism allows for timely investigation and mitigation of risks associated with internal hardware modifications or the installation of skimming devices, directly addressing the need to protect against physical tampering.

Why this answer

Tamper-evident seals provide a visible indicator if a device has been opened, deterring unauthorized physical access to internal components. This question tests understanding of physical security for unattended devices.

Full explanation →
245
MCQmedium

During a security audit, you discover that a user's browser has multiple pop-up windows appearing, even when no websites are open. The user denies installing any software. Which tool should you use to identify and remove the underlying cause?

A.Reset the browser settings to default
B.Run a full scan with Windows Defender or another anti-malware tool
C.Disable JavaScript in the browser
D.Clear the browser cache and cookies
AnswerB

Running a full scan with Windows Defender or another reputable anti-malware tool is the most effective solution because these tools are specifically designed to detect, quarantine, and remove malicious software, including adware and Potentially Unwanted Programs (PUPs). They scan the entire file system, registry, and running processes for known signatures and behavioral patterns associated with such threats, providing comprehensive remediation. This directly addresses the root cause of the pop-ups by eliminating the adware.

Why this answer

Pop-ups appearing without a browser suggest adware or a potentially unwanted program (PUP) running as a background process. Using Windows Defender or an anti-malware scanner is the correct approach. This tests understanding of adware behavior and removal tools.

Full explanation →
246
MCQmedium

A technician is tasked with replacing a failed power supply in a desktop computer. The old power supply is labeled with a RoHS compliance mark. How should the technician handle the old unit?

A.Place it in the regular trash because RoHS means it's non-hazardous.
B.Return it to the manufacturer for recycling or dispose of it through a certified e-waste recycler.
C.Sell it as scrap metal.
D.Store it indefinitely in case it is needed later.
AnswerB

The most environmentally responsible and legally compliant method for disposing of a failed power supply is to return it to the original manufacturer, many of whom operate take-back or recycling programs. Alternatively, utilizing a certified e-waste recycler ensures that the device is disassembled, hazardous materials are safely managed, and valuable components are recovered in accordance with local, state, and federal environmental regulations. This approach minimizes ecological impact and promotes resource sustainability.

Why this answer

The RoHS (Restriction of Hazardous Substances) compliance mark indicates the power supply was manufactured without certain hazardous materials, but it does not make the unit non-hazardous for disposal. Electronic waste (e-waste) like power supplies still contains materials such as lead solder, capacitors, and other components that require proper handling. The correct procedure is to return it to the manufacturer for recycling or dispose of it through a certified e-waste recycler to comply with environmental regulations and avoid legal penalties.

Exam trap

The trap here is that candidates mistakenly believe RoHS compliance means the device is completely non-hazardous and can be thrown in regular trash, ignoring that e-waste disposal laws apply regardless of RoHS status.

How to eliminate wrong answers

Option A is wrong because RoHS compliance only restricts the use of specific hazardous substances in manufacturing; it does not render the unit non-hazardous for disposal, and placing it in regular trash violates e-waste regulations. Option C is wrong because selling a failed power supply as scrap metal is not a standard disposal method and may expose the technician to liability if the unit contains hazardous components that are not properly handled. Option D is wrong because storing a failed power supply indefinitely is impractical, takes up space, and does not comply with environmental policies that require proper recycling or disposal of e-waste.

Full explanation →
247
MCQhard

A company's security policy requires that all Windows 10 workstations automatically lock the screen after 5 minutes of inactivity. However, users in the sales department often leave their desks for extended periods. A technician configures the 'Interactive logon: Machine inactivity limit' policy to 300 seconds. Despite this, the screensaver does not activate. What is the most likely reason?

A.The 'Screen saver timeout' policy is set to a longer duration
B.The 'Password protect the screensaver' setting is disabled
C.The screensaver is not enabled or configured on the workstations
D.The 'Turn off the display' power setting is set to 'Never'
AnswerC

This is the correct answer because the 'Interactive logon: Machine inactivity limit' policy, while enforcing a workstation lock after a specified period of inactivity, does not inherently activate a screensaver. For a screensaver to appear before or concurrent with the lock, it must be explicitly enabled and configured, either through local display settings or via a Group Policy Object (GPO) like 'Enable screen saver' and 'Screen saver timeout'. If the screensaver is not enabled, the system will simply go to a blank screen or lock without displaying a screensaver.

Why this answer

This question tests understanding of the relationship between the 'Interactive logon: Machine inactivity limit' policy and screensaver settings. The policy locks the workstation after the specified idle time, but it does not automatically enable the screensaver. The screensaver must be separately configured and enabled, or the lock screen will appear without a screensaver.

Full explanation →
248
MCQeasy

A customer reports that their computer shuts down unexpectedly after a few minutes of use. The system feels hot to the touch, and the fan is running loudly. What is the most appropriate first step for a technician to take to ensure safety while diagnosing the issue?

A.Immediately open the case and touch the CPU heatsink to check temperature.
B.Unplug the computer, let it cool for 30 minutes, then inspect for dust or fan failure.
C.Spray compressed air into the vents while the system is running to clear dust.
D.Replace the power supply unit immediately to fix the overheating.
AnswerB

This is the safest and most logical initial troubleshooting step for an overheating issue. Unplugging the computer completely removes all power, eliminating the risk of electrical shock and minimizing ESD potential during physical interaction. Allowing the system to cool for 30 minutes ensures that internal components, especially heatsinks, reach a safe handling temperature, preventing burns. After cooling, a thorough visual inspection can safely identify common culprits like excessive dust accumulation on heatsinks and fans, or a non-spinning/faulty cooling fan.

Why this answer

This question tests knowledge of electrical safety and proper handling of overheated equipment. The correct answer is to unplug the computer to prevent electrical shock or fire, then allow it to cool before inspecting internal components. Attempting to open a hot system or ignoring the heat can lead to injury or further damage.

Full explanation →
249
MCQmedium

A customer complains that their computer is running slowly and they keep seeing pop-ups offering free antivirus software. They admit they clicked 'OK' on one pop-up. Which type of social engineering attack has likely occurred?

A.Phishing
B.Baiting
C.Pretexting
D.Shoulder surfing
AnswerB

Baiting is a social engineering attack that leverages a user's curiosity or greed by offering something desirable, such as "free" software, music, or a game, often advertised through a deceptive pop-up or left on a physical medium like a USB drive. The enticing offer serves as "bait" to trick the victim into installing or executing malware on their system. In this scenario, a pop-up offering "free antivirus" to a user with a slow computer directly aligns with baiting's modus operandi of exploiting a perceived need with a malicious solution.

Why this answer

Aiting. In this scenario, the user clicked 'OK' on a pop-up offering free antivirus software, which is a classic baiting attack. Baiting lures victims with a false promise (e.g., free software) to trick them into executing malware or revealing credentials.

Unlike phishing, which typically uses deceptive emails or websites to steal sensitive information, baiting relies on the allure of a free item or service to trigger a malicious download.

Exam trap

CompTIA often tests the distinction between phishing and baiting by presenting a scenario where a user is tricked by a free offer or physical media (like a USB drive), leading candidates to mistakenly choose phishing because both involve deception, but baiting specifically relies on the promise of a reward or free item.

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing usually involves fraudulent emails or websites that impersonate legitimate entities to steal credentials or financial data, not pop-ups offering free software. Option C (Pretexting) is wrong because pretexting involves fabricating a scenario or identity to gain trust and extract information, not offering a free download. Option D (Shoulder surfing) is wrong because shoulder surfing is the direct observation of a user's screen or keyboard to capture sensitive data, such as passwords, and does not involve pop-ups or downloads.

Full explanation →
250
MCQhard

A technician is configuring power settings for a server room that houses critical equipment. The UPS battery backup needs to be tested monthly. What is the most environmentally sound way to conduct the test?

A.Unplug the server from the UPS to simulate a power failure.
B.Use the UPS management software to run a self-test that checks battery health without full discharge.
C.Disconnect the UPS from mains power and let the battery drain completely.
D.Replace the UPS battery every month to avoid testing.
AnswerB

Modern UPS units include management software that allows technicians to initiate a self-test. This diagnostic procedure typically applies a brief load to the battery and measures its voltage drop and recovery characteristics to assess its health and remaining capacity. It is a non-disruptive, efficient method that verifies battery functionality without requiring a full discharge cycle, thereby preserving battery lifespan and ensuring server uptime. This is the recommended best practice for routine battery health checks.

Why this answer

Using UPS management software to run a self-test checks battery health without a full discharge, which conserves battery cycle life and avoids unnecessary waste. This method typically performs a brief impedance or load test that verifies the battery's ability to hold a charge without stressing it, aligning with environmental best practices by reducing battery replacement frequency and energy consumption.

Exam trap

CompTIA often tests the misconception that a full discharge is the only way to verify battery health, but the environmentally sound approach is to use a software-based self-test that avoids unnecessary battery wear and waste.

How to eliminate wrong answers

Option A is wrong because unplugging the server from the UPS simulates a power failure but does not test the battery's ability to provide backup power; it only tests the UPS's transfer to battery mode, which can cause unnecessary wear on the battery and risk data loss if the server shuts down improperly. Option C is wrong because disconnecting the UPS from mains power and letting the battery drain completely subjects the battery to a deep discharge cycle, which significantly reduces its lifespan and is not environmentally sound due to increased waste and energy loss. Option D is wrong because replacing the UPS battery every month is wasteful, costly, and environmentally harmful, as batteries contain hazardous materials and should only be replaced when their capacity degrades below acceptable thresholds.

Full explanation →
251
MCQhard

A technician is called to a warehouse where a forklift accidentally struck a rack containing several desktop PCs. The rack is leaning, and one PC has fallen and is sparking. What is the technician's first priority for safety?

A.Quickly unplug the sparking PC to prevent a fire.
B.Evacuate the area and report the incident to the safety officer or call 911.
C.Use a fire extinguisher on the sparking PC to prevent ignition.
D.Stabilize the rack with a nearby pallet to prevent further collapse.
AnswerB

The paramount concern in any hazardous situation is the safety of all personnel, making evacuation the correct initial response. A technician's primary responsibility is to remove themselves and others from immediate danger, not to attempt to mitigate a complex hazard without proper training or equipment. Reporting the incident to a safety officer or emergency services like 911 ensures that trained professionals, equipped to handle electrical fires and structural collapses, can safely secure the area and address the root cause.

Why this answer

The immediate priority when a PC is sparking and a rack is unstable is life safety. Evacuating the area and reporting the incident (to a safety officer or by calling 911) ensures no one is exposed to potential electrical fire, arc flash, or structural collapse. Attempting to unplug or extinguish the sparking PC while the rack is leaning could result in electrocution, burns, or being struck by falling equipment.

Exam trap

CompTIA often tests the principle that life safety (evacuation and reporting) always takes precedence over equipment preservation or firefighting, tempting candidates to choose a hands-on action like unplugging or extinguishing the sparking PC.

How to eliminate wrong answers

Option A is wrong because attempting to unplug a sparking PC while the rack is unstable puts the technician at risk of electric shock or arc flash, and the spark may indicate a live short that could ignite flammable materials. Option C is wrong because using a fire extinguisher on a sparking PC before evacuating and assessing the situation wastes critical time and may not address the underlying electrical hazard; the spark could be from a capacitor or power supply that could reignite. Option D is wrong because stabilizing the rack with a pallet is a secondary action that should only be performed after the area is safe and the immediate electrical hazard is controlled; it does not address the sparking PC or the risk of fire.

Full explanation →
252
MCQmedium

A user reports that their Windows 10 laptop shows a blue screen with an error message about 'Driver IRQL not less or equal' after connecting a new external hard drive. They need to use the drive for work. Which security setting should you check to ensure driver installation is not blocked?

A.Check if Secure Boot is enabled in UEFI.
B.Verify that User Account Control is set to 'Notify me only when apps try to make changes.'
C.Disable Driver Signature Enforcement temporarily.
D.Run Windows Update to find a signed driver.
AnswerC

Disabling Driver Signature Enforcement temporarily allows the Windows operating system to load drivers that lack a valid digital signature or have an invalid one. If a blue screen error is occurring because Windows is actively blocking a newly installed or updated driver due to a signature verification failure, this action provides a crucial diagnostic step. By bypassing the enforcement, the system can potentially boot, allowing the problematic driver to load and confirming whether an unsigned or improperly signed driver is the direct cause of the system instability.

Why this answer

The 'Driver IRQL not less or equal' blue screen error typically indicates a faulty or unsigned driver. Disabling Driver Signature Enforcement (Option C) allows the installation of an unsigned driver, which is often necessary for older or third-party hardware like an external hard drive. This directly addresses the driver installation being blocked by Windows' driver signature requirements.

Exam trap

CompTIA A+ often tests the confusion between Secure Boot and Driver Signature Enforcement, as both involve driver integrity but operate at different stages (boot-time vs. runtime) and serve distinct purposes.

How to eliminate wrong answers

Option A is wrong because Secure Boot ensures that only trusted bootloaders and drivers are loaded during startup, but it does not block the installation of a driver after the OS is running; the error occurs post-boot. Option B is wrong because User Account Control (UAC) controls administrative consent for software changes, not driver signature enforcement; UAC prompts for elevation but does not block unsigned drivers specifically. Option D is wrong because running Windows Update to find a signed driver assumes a signed driver exists for the device, but the user needs to use the drive immediately, and the error indicates the current driver is problematic; this is a long-term fix, not a direct solution to the installation block.

Full explanation →
253
MCQmedium

A technician is troubleshooting a Windows 10 PC that was infected with a rootkit. After booting from a rescue disk and running a scan, the rootkit is removed, but the system is still unstable. What should the technician do next to ensure the system is fully remediated?

A.Reinstall the operating system from scratch.
B.Run the System File Checker (SFC) tool to repair corrupted files.
C.Disable System Restore and delete all restore points.
D.Perform a disk cleanup to remove temporary files.
AnswerB

SFC scans and repairs protected system files that may have been damaged by the rootkit, addressing the instability without a full reinstall.

Why this answer

After removing a rootkit, the system may have corrupted system files that cause instability. Running the System File Checker (SFC) tool with the 'sfc /scannow' command scans protected system files and replaces corrupted versions with cached copies from the Windows side-by-side store, directly addressing file integrity issues left by the rootkit.

Exam trap

The trap here is that candidates may choose to reinstall the OS (Option A) because they assume any rootkit infection requires a full wipe, but the question specifies the rootkit is already removed and the remaining issue is instability from file corruption, making SFC the targeted remediation step.

How to eliminate wrong answers

Option A is wrong because reinstalling the OS from scratch is an overly drastic step that is unnecessary when the rootkit has already been removed and the issue is limited to file corruption; it would also waste time and user data. Option C is wrong because disabling System Restore and deleting restore points removes potentially useful recovery snapshots but does not repair the corrupted system files causing instability. Option D is wrong because disk cleanup only removes temporary files and frees disk space, which has no effect on corrupted system files or system stability.

Full explanation →
254
MCQmedium

A technician is troubleshooting a Windows 10 PC that fails to boot with a 'Bootmgr is missing' error. They need to repair the boot configuration. Which administrative tool should be used from the Windows Recovery Environment (WinRE)?

A.System Restore to revert to a previous restore point.
B.Command Prompt to run bootrec /rebuildbcd.
C.Device Manager to update the disk driver.
D.Local Security Policy to adjust boot options.
AnswerB

When a Windows PC fails to boot due to a missing or corrupted `bootmgr` (Boot Manager) or Boot Configuration Data (BCD), accessing the Command Prompt in the Windows Recovery Environment (WinRE) is the correct approach. The `bootrec /rebuildbcd` command specifically scans for Windows installations on the disk and allows the user to add them to a newly created BCD store, effectively repairing the boot configuration and resolving critical boot errors like "bootmgr is missing."

Why this answer

The Command Prompt in WinRE allows running bootrec.exe and bcdedit.exe to repair the boot configuration. System Restore and Startup Repair are also in WinRE but do not directly rebuild the BCD. The other options are not available in WinRE.

Full explanation →
255
MCQeasy

A user reports that their web browser frequently redirects to an unfamiliar search engine and displays pop-up ads even when no tabs are open. What is the most likely cause of this behavior?

A.The browser needs to be updated to the latest version.
B.The user has accidentally enabled a malicious browser extension.
C.The internet connection is unstable and causing DNS errors.
D.The browser cache is full and needs to be cleared.
AnswerB

Malicious browser extensions are a primary cause of unwanted redirects and pop-ups because they operate with elevated permissions within the browser environment. These extensions can modify browser settings, intercept network requests, and inject scripts to force redirects to advertising or phishing sites. Users often install them unknowingly, bundled with other software or disguised as legitimate tools, granting them the necessary permissions to hijack browsing sessions.

Why this answer

The described behavior—unwanted redirects to an unfamiliar search engine and pop-up ads appearing even with no tabs open—is a classic symptom of adware or a malicious browser extension. Such extensions hijack browser settings, inject ads, and redirect search queries without the user's consent. Unlike a simple update or cache issue, this requires a malicious add-on that has been granted permissions to modify web content and navigation.

Exam trap

CompTIA often tests the misconception that browser issues are always caused by outdated software or cache problems, when in fact malicious extensions are a common source of persistent adware behavior that updates and cache clearing cannot fix.

How to eliminate wrong answers

Option A is wrong because updating the browser version patches security vulnerabilities but does not remove already-installed malicious extensions or undo their configuration changes. Option C is wrong because unstable internet connections or DNS errors cause timeouts or failure to load pages, not persistent redirects to a specific unfamiliar search engine or pop-up ads when no tabs are open. Option D is wrong because a full browser cache may slow performance or cause stale content to display, but it cannot generate pop-up ads or redirects to an unknown search engine; those actions require active code execution, not cached data.

Full explanation →
256
MCQhard

A change advisory board (CAB) approves a network switch replacement, but the technician discovers during implementation that the new switch requires a different firmware version than documented. The change plan does not include a rollback for this scenario. What is the best course of action?

A.Proceed with the firmware update and document the change afterward.
B.Stop the implementation and contact the CAB for a revised change plan.
C.Use the old switch firmware on the new switch to match the documentation.
D.Implement the switch and create a separate change request for the firmware.
AnswerB

Halting the implementation and immediately contacting the Change Advisory Board (CAB) is the correct procedure when a deviation from the approved change plan is identified. This ensures that the proposed firmware update undergoes proper review, risk assessment, and formal approval, allowing the CAB to revise the change plan to include the new firmware, testing protocols, and a comprehensive rollback strategy.

Why this answer

When an undocumented deviation occurs during a change, the technician should halt the implementation and contact the CAB for guidance. Proceeding without approval risks network instability, and the CAB can provide a revised plan or approve the firmware change.

Full explanation →
257
MCQeasy

During a security audit, you find that a user's browser has an outdated version of Adobe Flash Player installed. What is the primary security risk associated with this finding?

A.The browser will run slower and may crash frequently.
B.The user will be unable to view some web content.
C.Attackers can exploit known vulnerabilities in the plugin to install malware.
D.The browser will automatically disable the plugin.
AnswerC

Outdated plugins frequently contain publicly documented security vulnerabilities that have been identified and subsequently patched in newer versions. Attackers actively scan for systems running these vulnerable plugin versions and can craft malicious web pages or network requests specifically designed to trigger these known flaws. Successful exploitation can grant the attacker remote code execution privileges, enabling them to install various forms of malware, such as ransomware, keyloggers, or backdoors, directly onto the user's system without their knowledge.

Why this answer

Outdated Adobe Flash Player versions contain publicly known vulnerabilities (CVEs) that attackers can exploit via drive-by downloads or malicious advertisements. Exploiting these flaws allows arbitrary code execution, enabling malware installation without user interaction. This is the primary security risk because unpatched plugins are a common entry point for ransomware, spyware, and botnets.

Exam trap

CompTIA often tests the distinction between operational issues (performance, compatibility) and actual security vulnerabilities, trapping candidates who confuse 'annoying' with 'dangerous'.

How to eliminate wrong answers

Option A is wrong because performance issues like slower browsing or crashes are operational annoyances, not the primary security risk; outdated Flash may cause instability, but the core concern is exploitation. Option B is wrong because inability to view content is a compatibility issue, not a security risk; while some sites may require newer Flash, the audit focuses on vulnerabilities, not functionality. Option D is wrong because modern browsers (e.g., Chrome, Edge) may block or disable outdated Flash by default, but this is a mitigation, not the risk itself; the risk exists before the browser takes action.

Full explanation →
258
MCQhard

A technician needs to deploy a custom configuration profile to 50 macOS devices in a lab. The profile must restrict access to System Settings and disable iCloud. Which tool is most appropriate for this task?

A.Terminal with 'profiles' command
B.Apple Configurator
C.System Preferences > Profiles
D.Remote Desktop
AnswerB

Apple Configurator is the correct and dedicated tool for creating and exporting custom configuration profiles (.mobileconfig files) for Apple devices, including macOS, iOS, and iPadOS. This application provides a graphical interface to define various settings, restrictions, and payloads, such as Wi-Fi, VPN, email accounts, and security policies. Once configured, the profile can be exported and then deployed to target devices, either manually or via a Mobile Device Management (MDM) solution.

Why this answer

Apple Configurator is the correct tool because it is designed for bulk deployment and management of configuration profiles on macOS and iOS devices. It allows a technician to create a single profile that restricts System Settings and disables iCloud, then apply it to multiple devices simultaneously via USB or network, making it ideal for lab environments with 50 machines.

Exam trap

A common pitfall in the A+ exam is thinking that the 'profiles' command in Terminal is sufficient for bulk deployment, but candidates overlook that it requires per-device execution and lacks the centralized management capabilities of Apple Configurator.

How to eliminate wrong answers

Option A is wrong because the 'profiles' command in Terminal is used for installing, removing, or managing configuration profiles on a single device, not for deploying to multiple devices in bulk without additional scripting or MDM infrastructure. Option C is wrong because System Preferences > Profiles is a user interface for viewing or manually installing profiles on a single Mac, not a tool for deploying profiles to multiple devices. Option D is wrong because Remote Desktop is primarily for remote control, screen sharing, and software distribution, but it lacks native support for creating or deploying configuration profiles; it would require manual profile installation on each device.

Full explanation →
259
MCQeasy

A customer reports that their laptop battery drains quickly and the device gets very hot. They want to know the safest way to dispose of the old battery after replacement. What should you advise?

A.Throw the battery in the regular trash bin.
B.Take the battery to a certified e-waste recycling center.
C.Burn the battery in an open area to neutralize it.
D.Store the battery in a metal container until it stops holding a charge.
AnswerB

Taking a laptop battery to a certified e-waste recycling center is the correct and responsible method for disposal. These specialized facilities employ processes like mechanical separation, hydrometallurgy, or pyrometallurgy to safely dismantle batteries and recover valuable materials such as lithium, cobalt, and copper. This practice not only conserves natural resources and reduces the demand for new mining but also prevents hazardous chemicals from polluting the environment, ensuring compliance with environmental regulations.

Why this answer

Lithium-ion and lithium-polymer batteries contain hazardous materials that can leak and cause environmental damage if disposed of improperly. Certified e-waste recycling centers have the specialized equipment and processes to safely extract and recycle these materials, preventing toxic exposure and complying with environmental regulations like the Resource Conservation and Recovery Act (RCRA).

Exam trap

CompTIA often tests the misconception that storing a battery in a metal container or waiting until it fully discharges makes it safe for regular disposal, but the chemical hazard remains regardless of charge state.

How to eliminate wrong answers

Option A is wrong because throwing the battery in regular trash violates hazardous waste disposal laws and can lead to fires in landfills or recycling facilities due to lithium's reactivity with moisture and other materials. Option C is wrong because burning a lithium-ion battery can cause a violent thermal runaway reaction, releasing toxic fumes and potentially causing an explosion. Option D is wrong because storing a battery in a metal container does not neutralize the chemical hazard; it only contains the risk temporarily, and the battery remains dangerous until properly recycled.

Full explanation →
260
MCQeasy

A technician is configuring a new Windows 11 workstation for a user who frequently downloads free software. To reduce the risk of malware infections from bundled applications, which security setting should be enabled?

A.Enable Windows Defender Application Guard.
B.Set User Account Control to always notify.
C.Turn on Windows Firewall with advanced logging.
D.Enable BitLocker drive encryption.
AnswerB

Setting User Account Control (UAC) to "Always notify" ensures that the user is prompted for explicit consent before any program makes changes that require administrative privileges, including software installations. This prompt provides a crucial opportunity to review and reject installations, effectively preventing unwanted bundled software from being installed alongside a desired application. It acts as a critical gatekeeper for system-wide changes, empowering the user to control what gets installed.

Why this answer

User Account Control (UAC) set to 'Always notify' is the correct choice because it prompts the user for consent or credentials whenever an application (including bundled installers) attempts to make system-level changes. This gives the user a chance to review and block unauthorized installations, directly reducing the risk of malware from bundled freeware. The other options address different security concerns: Application Guard isolates browser sessions, Firewall controls network traffic, and BitLocker encrypts data at rest.

Exam trap

CompTIA A+ exams often test the distinction between malware prevention (UAC prompts) and other security features like isolation (Application Guard) or encryption (BitLocker), leading candidates to choose a more advanced-sounding option that does not address the specific threat of bundled software installations.

How to eliminate wrong answers

Option A is wrong because Windows Defender Application Guard is designed to isolate untrusted web browsing sessions in a Hyper-V container, not to block bundled software installations or prompt user consent during local application setup. Option C is wrong because Windows Firewall with advanced logging only records network traffic events for analysis; it does not prevent or alert on software installation attempts. Option D is wrong because BitLocker drive encryption protects data confidentiality if the device is lost or stolen, but it does not prevent malware from being installed or executed on the system.

Full explanation →
261
MCQeasy

A customer reports that their computer is running very slowly after they installed a new screensaver. The technician suspects the screensaver may be consuming excessive resources. Which of the following is the most professional way to address this?

A.Tell the customer that the screensaver is likely the problem and they should uninstall it.
B.Explain that you will check the system resources to identify the cause of the slowness.
C.Blame the screensaver and suggest the customer stop using decorative software.
D.Ignore the screensaver and run a full virus scan.
AnswerB

This is the most appropriate and professional response as it outlines a logical and systematic diagnostic approach. Checking system resources, such as CPU utilization, RAM usage, disk I/O, and network activity, is fundamental to identifying bottlenecks that cause general system slowness. This approach demonstrates a commitment to evidence-based troubleshooting and sets realistic expectations with the customer, indicating that a thorough investigation will be conducted to pinpoint the root cause before implementing solutions.

Why this answer

It demonstrates a professional, systematic troubleshooting approach. Instead of prematurely blaming the screensaver, the technician will use Task Manager (or Resource Monitor) to verify if the screensaver process is consuming excessive CPU, memory, or disk resources. This aligns with CompTIA's troubleshooting methodology: identify the problem by gathering data before forming a conclusion.

Exam trap

CompTIA often tests the candidate's ability to choose a professional, evidence-based response over a quick-fix or blame-oriented answer, trapping those who assume the reported change is definitely the root cause without verification.

How to eliminate wrong answers

Option A is wrong because it jumps to a conclusion without verifying the cause, which is unprofessional and could lead to unnecessary software removal if the slowness is due to another issue like a background update or malware. Option C is wrong because it blames the screensaver without evidence, which damages customer trust and violates professional communication standards. Option D is wrong because ignoring the reported change (the screensaver) and running a full virus scan is inefficient; it wastes time and may miss the actual cause if the screensaver is indeed the problem.

Full explanation →
262
MCQeasy

A customer reports that their Android phone's screen is unresponsive to touch after a drop. They can still hear notifications and see the display. Which built-in tool should you use to test the touchscreen functionality without relying on third-party apps?

A.Safe Mode
B.Developer Options
C.Diagnostics Mode (e.g., *#0*#)
D.Factory Reset
AnswerC

Many Android manufacturers embed a hidden Diagnostics Mode, often accessible via specific dialer codes like *#0*#, which provides a suite of hardware tests. This mode allows technicians to systematically check various components, including the touchscreen for dead zones or unresponsive areas, the display for pixel issues, and sensors like the accelerometer or gyroscope. It is the ideal tool for precisely verifying if a reported screen issue stems from a hardware malfunction rather than a software glitch.

Why this answer

This question tests knowledge of Android's built-in diagnostic tools. The correct answer is the 'Diagnostics' or 'Test' mode, often accessed via the dialer code or settings, which allows hardware testing without third-party apps. This is a standard feature for verifying touchscreen integrity after physical damage.

Full explanation →
263
MCQmedium

A technician is updating the documentation for a network printer that was moved to a different floor. The technician updates the asset tag in the inventory system. Which additional documentation should the technician also update to ensure accurate records?

A.The user manual for the printer
B.The network diagram showing device locations and connections
C.The company’s acceptable use policy
D.The printer’s warranty information
AnswerB

The network diagram is a critical piece of documentation that visually represents the physical and logical topology of a network, including the precise location of devices, their connections to switches, routers, and other infrastructure components, and often their assigned IP addresses or VLANs. When a device like a printer is moved, the diagram must be updated to reflect its new physical placement, the specific network port it now utilizes, and any associated cabling changes, ensuring accurate records for troubleshooting, security audits, and future network planning. This ensures technicians can quickly locate and manage the device.

Why this answer

When a network printer is moved to a different floor, its physical location and network connectivity change. The network diagram is the authoritative document that records device locations, switch ports, IP addresses, and cabling paths. Updating it ensures that troubleshooting, asset tracking, and future moves remain accurate, directly supporting change management and documentation best practices.

Exam trap

CompTIA often tests the distinction between operational documentation (network diagrams, rack layouts, IP address management) and administrative or policy documents (user manuals, warranties, acceptable use policies) to see if candidates understand which records are directly impacted by a physical move.

How to eliminate wrong answers

Option A is wrong because the user manual is a generic reference document that does not change when a device is relocated; it contains operational instructions, not location or connectivity records. Option C is wrong because the acceptable use policy governs how employees may use company resources, not the physical or logical placement of hardware. Option D is wrong because warranty information is tied to the device's serial number and purchase date, not its physical location; moving the printer does not affect warranty terms.

Full explanation →
264
MCQmedium

A customer complains that their computer emits a strong chemical smell and is unusually hot. After inspection, you find the power supply is failing and leaking a brown, oily substance. How should you handle the power supply disposal?

A.Place the power supply in a standard trash bag and throw it in the dumpster.
B.Put the power supply in an anti-static bag, seal it, and label it as hazardous e-waste.
C.Clean the power supply with isopropyl alcohol and then recycle it normally.
D.Disassemble the power supply to remove the leaking capacitor and then dispose of the rest.
AnswerB

This is the correct and safest procedure for handling a compromised power supply. An anti-static bag provides a protective barrier, containing any further leakage of potentially corrosive or toxic capacitor electrolytes and preventing contamination of the surrounding environment. Sealing and clearly labeling it as hazardous e-waste ensures that specialized recycling facilities can process it according to environmental regulations, safely neutralizing or reclaiming its components.

Why this answer

A failing power supply leaking a brown, oily substance (typically from swollen or ruptured capacitors) is classified as hazardous e-waste due to toxic materials like lead, cadmium, and electrolyte fluids. Placing it in an anti-static bag prevents short circuits during transport, and labeling it as hazardous ensures proper disposal per environmental regulations such as the Resource Conservation and Recovery Act (RCRA) or local e-waste directives.

Exam trap

CompTIA often tests the misconception that cleaning or disassembling e-waste makes it safe for normal disposal, when in fact any leaking or damaged power supply must be treated as hazardous e-waste and never opened by a technician.

How to eliminate wrong answers

Option A is wrong because throwing the power supply in a standard trash bag and dumpster violates environmental regulations; the leaking chemicals can contaminate soil and groundwater, and the power supply contains heavy metals that require special handling. Option C is wrong because cleaning with isopropyl alcohol does not neutralize the toxic electrolyte or render the unit safe for normal recycling; the power supply still contains hazardous components that must be processed through certified e-waste facilities. Option D is wrong because disassembling a leaking, potentially charged power supply poses a high risk of electric shock, chemical exposure, and further leakage; technicians should never open a failing PSU—disposal must be handled as a sealed unit.

Full explanation →
265
MCQmedium

After a recent Windows update, a user's printer stopped working. You suspect the update changed the default print spooler service startup type. Which Control Panel tool should you use to verify and correct the service startup type?

A.Device Manager
B.Printers & scanners
C.Administrative Tools > Services
D.System > Advanced system settings
AnswerC

The "Services" snap-in, accessible via Administrative Tools or directly through `services.msc`, is the definitive utility for managing all Windows services. It provides a comprehensive list of services, their current status (running, stopped), and their configured startup type (Automatic, Manual, Disabled). To resolve a printer issue caused by the Print Spooler service not starting, an administrator would navigate here to locate the "Print Spooler" service, ensure its startup type is set to "Automatic," and then manually start it if it is not already running.

Why this answer

The Print Spooler service is a Windows service that manages print jobs sent to the printer. Its startup type (e.g., Automatic, Manual, Disabled) is configured in the Services console, which is accessed via Administrative Tools > Services. Device Manager and Printers & scanners do not provide service startup type settings, and System > Advanced system settings deals with performance and user profiles, not services.

Exam trap

The trap here is that candidates often confuse Device Manager (for driver issues) with the Services console, not realizing that the startup type of a service is managed exclusively through the Services snap-in, not through hardware or printer-specific settings.

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware drivers and device properties, not Windows service startup types. Option B is wrong because Printers & scanners is for adding, removing, and configuring printer devices, not for changing the spooler service startup type. Option D is wrong because System > Advanced system settings provides access to performance options, user profiles, and startup and recovery settings, not service management.

Full explanation →
266
MCQhard

A company laptop was stolen, and the IT department needs to ensure that the data on the device cannot be accessed. The laptop had BitLocker enabled, but the drive was unlocked when stolen. What additional security measure could have prevented data access in this scenario?

A.Enable Windows Defender Firewall
B.Configure BitLocker with a startup PIN
C.Use a strong user password
D.Enable System Restore
AnswerB

Configuring BitLocker with a startup PIN provides robust full disk encryption, ensuring that all data on the drive is unreadable without the correct authentication. The startup PIN acts as a pre-boot authentication factor, requiring the user to enter it before the operating system can even begin to load and before the encryption keys are released by the Trusted Platform Module (TPM). This prevents unauthorized access to data even if the drive is removed and placed into another computer or if the device is booted from an external medium.

Why this answer

BitLocker with a startup PIN requires the user to enter a PIN before the OS loads, even if the drive was previously unlocked. Since the laptop was stolen while unlocked, the PIN would have prevented the drive from being decrypted after a reboot or power loss, protecting the data from unauthorized access.

Exam trap

CompTIA often tests the misconception that a strong user password or firewall is sufficient to protect data on a stolen device, but the key point is that BitLocker's pre-boot authentication (like a startup PIN) is the only measure that protects data when the drive is unlocked at the time of theft.

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall controls network traffic and does not encrypt or protect data at rest on the drive; it cannot prevent access to data if the drive is physically stolen. Option C is wrong because a strong user password protects the user account at the OS level, but if the drive is already unlocked (as in this scenario), the password does not encrypt the data—an attacker could bypass the login screen by booting from external media or accessing the drive directly. Option D is wrong because System Restore creates restore points for system files and settings, not encryption; it has no mechanism to prevent data access from a stolen, unlocked drive.

Full explanation →
267
MCQeasy

A user reports that their Windows 10 desktop is running very slowly, especially when opening multiple applications. They have 8 GB of RAM and a traditional hard drive. Task Manager shows that memory usage is consistently at 90% or higher. Which component is most likely the bottleneck and what is the best upgrade?

A.The CPU is the bottleneck; upgrade to a faster processor.
B.The hard drive is the bottleneck; upgrade to an SSD.
C.The RAM is the bottleneck; add more RAM.
D.The graphics card is the bottleneck; upgrade to a dedicated GPU.
AnswerC

Insufficient Random Access Memory (RAM) forces the operating system to frequently move data between physical RAM and the much slower virtual memory (paging file) located on the storage drive. This constant swapping of data, often referred to as 'thrashing,' drastically reduces overall system performance and responsiveness, making applications feel sluggish and causing delays. Adding more physical RAM directly alleviates this by providing more fast memory for active processes, thereby minimizing the system's reliance on the significantly slower virtual memory.

Why this answer

High memory usage (90%+) with 8 GB of RAM indicates that the system is running out of physical memory, causing it to use the hard drive as virtual memory, which is very slow. The best upgrade is to add more RAM to reduce reliance on the slow hard drive paging.

Full explanation →
268
MCQmedium

A small business is deploying Windows 11 to 20 new workstations. During the setup, you need to ensure that each computer receives a unique computer name and joins the domain automatically. Which Windows deployment tool should you use to automate this process?

A.Windows System Image Manager (Windows SIM)
B.Windows Deployment Services (WDS)
C.Microsoft Deployment Toolkit (MDT)
D.Sysprep
AnswerB

Windows Deployment Services (WDS) is the correct choice for network-based deployment of Windows operating systems, especially in scenarios involving multiple machines. WDS enables PXE booting, allowing client computers to start the installation process over the network without local media. It serves Windows images (WIM files) and can integrate seamlessly with answer files (unattend.xml) to automate post-installation tasks such as computer naming, joining an Active Directory domain, and installing drivers, making it highly efficient for deploying Windows 11 to 20 machines.

Why this answer

Windows Deployment Services (WDS) is the correct tool because it is designed to deploy Windows operating systems over a network using Preboot Execution Environment (PXE) boot. It can be configured with answer files to automatically assign unique computer names (via naming policies or a prestaged computer accounts in Active Directory) and join the domain without manual intervention, making it ideal for deploying 20 workstations simultaneously.

Exam trap

The trap here is that candidates often confuse MDT as a standalone deployment tool, but MDT requires a deployment mechanism like WDS or bootable media to initiate the network boot, whereas WDS directly handles PXE boot and can automate domain join and naming without MDT.

How to eliminate wrong answers

Option A is wrong because Windows System Image Manager (Windows SIM) is used to create and manage unattended answer files (Unattend.xml), not to perform network-based deployments or automate domain join and naming during deployment. Option C is wrong because Microsoft Deployment Toolkit (MDT) is a deployment solution that can automate domain join and naming, but it is not a deployment tool itself; it relies on WDS or other media for network boot and is typically used for more complex task sequences, not for simple automated domain join and naming. Option D is wrong because Sysprep is a system preparation tool used to generalize a Windows image (remove unique identifiers like SID and computer name) so it can be imaged to multiple computers; it does not automate domain join or assign unique names during deployment.

Full explanation →
269
MCQmedium

During a Windows 10 deployment, you need to ensure that a specific Group Policy setting is applied to a computer before any user logs on. Which policy processing mode should you configure?

A.Loopback processing mode
B.Computer Configuration
C.User Configuration
D.Administrative Templates
AnswerB

Policies defined under Computer Configuration are processed during the system's startup phase, well before any user authentication or logon script execution occurs. This ensures that these settings, which typically include security policies, system services, and machine-specific configurations, are fully applied and active at the login screen and for all subsequent user sessions. Consequently, any critical settings required prior to the first user login are reliably enforced system-wide.

Why this answer

Computer Configuration policies in Group Policy apply to the computer itself and take effect at boot, before user logon. User Configuration policies apply only after a user logs on. To ensure a setting is applied before any user logs on, it must be placed under Computer Configuration.

Full explanation →
270
MCQmedium

A technician needs to write a script that runs a specific command only if a Windows service is running. If the service is stopped, the script should start it first. Which scripting method is most appropriate?

A.Use a for loop to iterate over all services.
B.Use an if-else statement to check the service status.
C.Use a switch statement with multiple conditions.
D.Use a try-catch block to handle errors if the command fails.
AnswerB

An 'if-else' statement is the most appropriate control structure for evaluating a specific condition, such as whether a service's status is 'Running' or 'Stopped'. It enables the script to execute one block of commands if the condition is true and a different block if it's false. This direct conditional logic perfectly addresses the need to check a service's state and then perform specific actions based on that binary outcome.

Why this answer

An if-else statement is the most appropriate scripting method to check the status of a specific Windows service and conditionally execute a command or start the service. In PowerShell, you can use `Get-Service` to retrieve the service status and then an if-else block to evaluate whether the `Status` property equals 'Running'. This provides clear, linear logic that directly matches the requirement without unnecessary complexity.

Exam trap

CompTIA often tests the distinction between conditional logic (if-else) and error handling (try-catch), leading candidates to mistakenly choose try-catch because they think it can 'handle' a stopped service, but it cannot evaluate the service state before the command runs.

How to eliminate wrong answers

Option A is wrong because a for loop that iterates over all services is inefficient and unnecessary; the requirement is to check only one specific service, not all services. Option C is wrong because a switch statement is designed for multiple discrete value matches, not for a simple binary check of a service status (running vs. stopped), and it would overcomplicate the logic. Option D is wrong because a try-catch block handles runtime errors (e.g., service not found or access denied) but does not provide conditional logic to check the service status before deciding whether to start it.

Full explanation →
271
MCQmedium

A technician is configuring a new Windows 10 workstation for a user who is visually impaired. The user needs the screen magnifier to start automatically when they log in, and they want high-contrast themes. Which Control Panel tool should the technician use to enable these accessibility features?

A.System > Advanced system settings
B.Ease of Access Center
C.Personalization
D.Display
AnswerB

The Ease of Access Center, now often integrated into the broader Accessibility settings in Windows 10, is the dedicated control panel for configuring features that assist users with various needs. This centralized hub provides direct access to essential accessibility tools, including Magnifier for screen enlargement, Narrator for screen reading, the On-Screen Keyboard for alternative input, and high-contrast themes to improve text visibility. These options are specifically grouped here to enhance usability and support for individuals with visual, auditory, or motor impairments.

Why this answer

The Ease of Access Center in Windows 10 is the dedicated Control Panel tool for configuring accessibility features, including Magnifier and high-contrast themes. It provides settings to enable Magnifier to start automatically at login and to apply high-contrast themes system-wide, directly addressing the user's needs.

Exam trap

CompTIA often tests the distinction between the Ease of Access Center and the Personalization or Display settings, trapping candidates who assume high-contrast themes are only in Personalization or that Magnifier auto-start is a Display setting.

How to eliminate wrong answers

Option A is wrong because System > Advanced system settings is used for performance options, user profiles, and startup and recovery settings, not for accessibility features like Magnifier or high-contrast themes. Option C is wrong because Personalization allows changing themes and colors, but it does not provide the option to set Magnifier to start automatically at login; high-contrast themes can be applied there, but the automatic startup of Magnifier is exclusive to the Ease of Access Center. Option D is wrong because Display settings manage screen resolution, orientation, and multiple displays, but do not include accessibility features such as Magnifier auto-start or high-contrast theme configuration.

Full explanation →
272
MCQeasy

A small business wants to reduce its environmental footprint by properly managing old computer equipment. They ask which components must be handled separately due to hazardous materials. What should you identify?

A.LCD monitors
B.CRT monitors
C.Keyboard and mouse
D.Ethernet cables
AnswerB

CRT (Cathode Ray Tube) monitors are a primary concern for environmental footprint reduction due to their significant content of hazardous materials. The glass in the CRT funnel and neck contains a substantial amount of lead, often several pounds per unit, which is highly toxic and can leach into soil and groundwater if improperly disposed of in landfills. Additionally, CRTs may contain cadmium, mercury, and phosphors, all of which necessitate specialized recycling processes to safely extract and neutralize these substances, preventing severe environmental contamination.

Why this answer

CRT monitors contain leaded glass in the cathode ray tube and significant amounts of lead in the solder and phosphor coating, making them hazardous electronic waste that must be handled separately under regulations like the EPA's RCRA and the EU's WEEE Directive. Unlike LCDs, which may contain mercury in backlights but are often managed differently, CRTs require specialized recycling to prevent lead leaching into groundwater.

Exam trap

CompTIA often tests the distinction between CRT and LCD monitors, trapping candidates who assume all monitors are equally hazardous, when in fact CRTs are uniquely regulated due to lead content while LCDs are generally treated as standard e-waste unless mercury backlights are present.

How to eliminate wrong answers

Option A is wrong because LCD monitors may contain small amounts of mercury in cold-cathode fluorescent lamp (CCFL) backlights, but they are not universally classified as requiring separate hazardous handling in the same way as CRTs; many jurisdictions allow them in general e-waste streams if mercury is removed. Option C is wrong because keyboards and mice are typically non-hazardous electronic waste composed of plastic and low-voltage circuitry, with no regulated hazardous materials like lead, mercury, or cadmium. Option D is wrong because Ethernet cables are copper or fiber optic cabling with no hazardous materials; they are recyclable as standard e-waste or scrap metal.

Full explanation →
273
MCQmedium

A user reports that after a recent Windows update, they can no longer install a legacy application that requires write access to the Program Files folder. The user is a local administrator. What Windows security setting is most likely blocking the installation?

A.BitLocker Drive Encryption
B.User Account Control (UAC)
C.Windows Defender Firewall
D.Group Policy Software Restrictions
AnswerB

User Account Control (UAC) is a core Windows security feature designed to prevent unauthorized changes to the operating system by requiring explicit consent for actions that could affect system integrity. When a user, even an administrator, attempts to install software or make system-level changes, UAC prompts for elevation, displaying a "permission denied" or "administrator privileges required" message if elevation is not granted. A recent Windows update could have tightened UAC policies or reset them to a more secure default, causing previously unprompted installations to now trigger UAC.

Why this answer

User Account Control (UAC) is the Windows security feature that prompts for consent or credentials before allowing actions that require administrative privileges, even for local administrators. By default, UAC virtualizes write attempts to protected system locations like Program Files, redirecting them to a per-user virtual store, which can cause legacy applications that expect direct write access to fail. Disabling UAC or running the installer with explicit administrative rights (e.g., right-click 'Run as administrator') typically resolves the issue.

Exam trap

CompTIA often tests the misconception that local administrators always run with full administrative privileges, but UAC's default behavior means even admins operate with a filtered token until they explicitly elevate, causing legacy installers to fail when they attempt to write to protected folders like Program Files.

How to eliminate wrong answers

Option A is wrong because BitLocker Drive Encryption provides full-disk encryption to protect data at rest and does not block write access to the Program Files folder; it operates at the disk level, not the file system permission level. Option C is wrong because Windows Defender Firewall controls network traffic based on rules and does not restrict local file system write operations. Option D is wrong because Group Policy Software Restrictions can block installation of specific software based on path, hash, or certificate rules, but the scenario describes a generic inability to write to Program Files after an update, which is a classic symptom of UAC virtualization behavior, not a targeted restriction policy.

Full explanation →
274
MCQeasy

A user reports that their corporate email app on an Android device is not syncing. They can browse the internet and use other apps normally. The account was working yesterday. What should you check first?

A.Perform a factory reset of the device.
B.Verify the account username and password in the email app.
C.Replace the device's SIM card.
D.Reinstall the operating system.
AnswerB

Verifying the account username and password within the corporate email application is a primary and often overlooked troubleshooting step. Even if the user believes the credentials are correct, a recent password change on the server, a typo during initial setup, or an expired session token can prevent successful authentication and data synchronization. This simple check directly addresses the most common cause of email access issues without impacting other device functions, making it the most efficient first step.

Why this answer

The most common cause of a previously working email account suddenly failing to sync is an authentication issue, such as a changed password or expired credentials. Since other internet services work, the network connectivity is fine, so the problem is isolated to the email app's authentication. Verifying the username and password in the app's account settings is the quickest, least disruptive first step before escalating to more drastic measures.

Exam trap

The trap here is that candidates may assume a network or hardware issue (SIM card) because the email 'isn't syncing,' but the question explicitly states other apps work, isolating the problem to the email app's configuration or authentication.

How to eliminate wrong answers

Option A is wrong because performing a factory reset is a destructive, last-resort step that would erase all user data and settings, and it is not justified when the issue is isolated to a single app and the device otherwise functions normally. Option C is wrong because replacing the SIM card would only affect cellular network authentication and provisioning, not the email app's credentials or connectivity over Wi-Fi or mobile data; since other apps work, the SIM is not the cause. Option D is wrong because reinstalling the operating system is an extreme measure that would wipe the entire device and is completely unnecessary for a single app's sync failure that likely stems from a simple credential mismatch.

Full explanation →
275
MCQmedium

A user's iPad will not rotate the screen when turned sideways, even though the rotation lock is off in the Control Center. The screen remains in portrait mode. What should you check next?

A.Check if the app has its own orientation lock setting.
B.Check the physical mute/orientation lock switch on the side of the iPad.
C.Perform a hard reset of the iPad.
D.Update the iPadOS to the latest version.
AnswerB

On some iPad models, the side switch can be set to lock rotation; if it's engaged, it overrides the Control Center setting.

Why this answer

Many iPad models (particularly older ones like iPad 2 through iPad 4, and some iPad mini models) include a physical switch on the side edge that can be configured to act as a mute/orientation lock toggle. Even if the software rotation lock in Control Center is off, this hardware switch can independently lock the screen orientation, overriding the software setting. Checking this physical switch is the logical next step before attempting more invasive troubleshooting.

Exam trap

CompTIA often tests the distinction between software-based and hardware-based controls, and the trap here is that candidates assume the Control Center rotation lock is the only mechanism for locking orientation, overlooking the independent physical switch that can override it.

How to eliminate wrong answers

Option A is wrong because while some apps (e.g., video players) have their own orientation lock settings, the question states the screen remains in portrait mode system-wide, not just within a single app, so an app-specific lock would not affect the entire iPad interface. Option C is wrong because performing a hard reset (force restart) is a generic troubleshooting step that would not resolve a hardware switch being engaged; it would only temporarily clear memory and restart processes, not change the physical switch state. Option D is wrong because updating iPadOS addresses software bugs and compatibility issues, but a physical orientation lock switch is a hardware-level control that operates independently of the OS version; an update would not disengage a physical switch.

Full explanation →
276
MCQmedium

A user reports that their Windows 10 PC fails to boot and displays a 'Boot Configuration Data is missing' error. You need to repair the boot configuration using the Windows Recovery Environment. Which administrative tool should you run from the command prompt in the recovery environment?

A.sfc /scannow
B.bootrec /rebuildbcd
C.DISM /Online /Cleanup-Image /RestoreHealth
D.chkdsk /f
AnswerB

The `bootrec /rebuildbcd` command is specifically engineered to scan all disks for compatible Windows installations and then create a new Boot Configuration Data (BCD) store. This process effectively reconstructs the critical boot information that Windows uses to start up, resolving common boot-related issues such as "Boot BCD missing" or "Boot BCD corrupt" errors. It is the primary tool for repairing a damaged or missing BCD, making the system bootable again by correctly identifying the OS location.

Why this answer

The 'Boot Configuration Data is missing' error indicates that the BCD store, which contains boot-time configuration parameters, is corrupted or missing. The `bootrec /rebuildbcd` command scans all disks for Windows installations and allows you to rebuild the BCD store from scratch, directly addressing the missing or corrupt boot configuration data.

Exam trap

The 220-1202 exam often tests the distinction between file-level repair tools (sfc, DISM) and boot-level repair tools (bootrec), so the trap here is that candidates confuse 'system file corruption' with 'boot configuration corruption' and choose sfc or DISM instead of the correct bootrec command.

How to eliminate wrong answers

Option A is wrong because `sfc /scannow` (System File Checker) scans and repairs protected system files, but it does not rebuild the Boot Configuration Data store, which is a separate boot-critical component. Option C is wrong because `DISM /Online /Cleanup-Image /RestoreHealth` repairs the Windows system image and component store corruption, but it requires the OS to be online and cannot be used from the Windows Recovery Environment command prompt to fix a missing BCD. Option D is wrong because `chkdsk /f` checks the file system for logical and physical errors on the disk, but it does not create or repair the boot configuration data store.

Full explanation →
277
MCQhard

After resolving a user's issue, the user says, "Thank you, you're a lifesaver!" and offers the technician a $50 gift card as a token of appreciation. Company policy strictly prohibits accepting gifts over $20. How should the technician respond?

A."I appreciate that, but our policy doesn't allow me to accept gifts over $20. Thank you for the thought, though."
B."Thank you! That's very kind. I'll accept it, but please don't tell anyone."
C."I can't accept this. Please don't offer gifts to IT staff."
D."You can give it to my manager if you want, but I can't take it directly."
AnswerA

This response demonstrates exemplary professional conduct by politely declining the gift while clearly referencing company policy. It maintains a positive customer relationship by expressing appreciation for the gesture ("I appreciate that... Thank you for the thought") and educates the user on the established ethical guidelines regarding gratuities. Adhering to the $20 limit specified by policy ensures integrity and prevents potential conflicts of interest or perceptions of favoritism.

Why this answer

It politely declines the gift while citing the specific company policy limit of $20, which aligns with professional conduct and ethical guidelines. This response maintains trust and integrity without offending the user, as required by the CompTIA A+ 220-1202 exam objectives on professionalism and communication.

Exam trap

CompTIA often tests the candidate's ability to balance professionalism with customer appreciation, trapping those who choose a response that either violates policy (B, D) or damages the relationship (C) instead of a polite, policy-compliant refusal (A).

How to eliminate wrong answers

Option B is wrong because accepting the gift and asking the user to keep it secret violates company policy and ethical standards, potentially leading to disciplinary action or loss of trust. Option C is wrong because it is overly abrupt and dismissive, failing to acknowledge the user's gratitude and potentially damaging the customer relationship; a polite refusal is more appropriate. Option D is wrong because redirecting the gift to a manager still involves accepting a prohibited item indirectly, which does not comply with the policy and could be seen as an attempt to circumvent the rules.

Full explanation →
278
MCQhard

A network administrator is investigating a security incident where an attacker captured the 4-way handshake of a WPA2-PSK network and successfully cracked the passphrase. Which protocol change would most effectively prevent this type of attack in the future?

A.Switch to WPA2-Enterprise with 802.1X and a RADIUS server.
B.Increase the WPA2-PSK passphrase length to 63 characters.
C.Upgrade to WPA3-SAE.
D.Enable MAC address filtering on the access point.
AnswerC

Upgrading to WPA3-SAE (Simultaneous Authentication of Equals) directly addresses and eliminates the possibility of offline dictionary attacks against the Wi-Fi passphrase. WPA3-SAE utilizes a robust key exchange protocol, often referred to as 'Dragonfly,' which ensures that each authentication attempt is unique and interactive. This design prevents an attacker from capturing a handshake and performing precomputed, offline brute-force or dictionary attacks, even if the password is weak, by making each guess an interactive process that cannot be precomputed.

Why this answer

WPA3-SAE (Simultaneous Authentication of Equals) replaces the WPA2-PSK 4-way handshake with a protocol that uses a Diffie-Hellman key exchange, making it resistant to offline dictionary attacks. Even if an attacker captures the SAE handshake, they cannot crack the passphrase offline because the key exchange provides forward secrecy and prevents brute-force attempts without interacting with the network.

Exam trap

The 220-1202 exam often tests the misconception that simply strengthening WPA2-PSK (e.g., longer passphrase) or adding MAC filtering is sufficient, when the core vulnerability is the offline-crackable 4-way handshake itself, which only WPA3-SAE fundamentally addresses.

How to eliminate wrong answers

Option A is wrong because switching to WPA2-Enterprise with 802.1X and a RADIUS server still uses the same 4-way handshake for key derivation; the handshake can still be captured and, if the RADIUS server uses a weak password or certificate, offline attacks remain possible. Option B is wrong because increasing the WPA2-PSK passphrase length to 63 characters only makes cracking harder but does not change the fundamental vulnerability: the 4-way handshake can still be captured and subjected to offline dictionary or brute-force attacks given enough time and resources. Option D is wrong because MAC address filtering is a trivial security measure that can be easily bypassed by spoofing an allowed MAC address; it does not prevent handshake capture or cracking of the passphrase.

Full explanation →
279
MCQmedium

A technician is configuring a new Windows 10 workstation for a user who requires access to files stored on an encrypted USB drive. The drive uses BitLocker To Go. What must the technician do to ensure the user can access the drive on this computer?

A.Enable BitLocker on the workstation's internal drive
B.Provide the user with the drive's password or recovery key
C.Format the USB drive to NTFS
D.Install the BitLocker Drive Encryption feature from Control Panel
AnswerB

To access data on a BitLocker-protected external drive, the user *must* provide the correct password or the 48-digit recovery key associated with that specific encrypted volume. BitLocker To Go, designed for removable drives, requires this authentication step to decrypt the data and mount the drive for use, ensuring data confidentiality even if the physical drive is lost or stolen. Without these credentials, the drive remains inaccessible, regardless of the workstation's configuration.

Why this answer

BitLocker To Go encrypts removable drives with a password or recovery key. To access the drive on a new Windows 10 workstation, the technician must provide the user with the drive's password or recovery key, as the drive is already encrypted and requires authentication at mount time. No additional configuration is needed on the workstation beyond entering the correct credentials.

Exam trap

The trap here is that candidates may think additional software or feature installation is required, but BitLocker To Go is a built-in capability of Windows 10 Pro/Enterprise that only needs the correct authentication credential to unlock the drive.

How to eliminate wrong answers

Option A is wrong because enabling BitLocker on the workstation's internal drive is unrelated to accessing an already-encrypted BitLocker To Go USB drive; the internal drive encryption does not affect removable drive access. Option C is wrong because formatting the USB drive to NTFS would erase all data and remove the existing BitLocker encryption, which is counterproductive since the user needs to access existing encrypted files. Option D is wrong because the BitLocker Drive Encryption feature is already included in Windows 10 Pro and Enterprise editions; it does not need to be installed separately, and the technician only needs to provide the password or recovery key.

Full explanation →
280
MCQhard

A user complains that their Windows 10 computer is running slowly and they see frequent pop-ups from an unknown program. After running a full antivirus scan, nothing is detected. Which Windows security feature should you use to investigate and remove potentially unwanted software?

A.Windows Defender Firewall
B.Windows Defender Offline Scan
C.System Restore
D.User Account Control (UAC)
AnswerB

Windows Defender Offline Scan is a specialized security feature designed to run outside the active Windows operating system environment, typically from a bootable recovery partition or USB drive. This isolation allows it to detect and remove deeply embedded or persistent malware, such as rootkits or boot sector viruses, that might evade detection by standard antivirus scans running within a compromised OS. By operating in a clean state, it prevents malware from actively interfering with the scanning and removal process, making it highly effective for stubborn infections.

Why this answer

Windows Defender Offline Scan boots from a trusted environment to detect and remove persistent malware that standard scans miss. It is ideal for rootkits or stubborn infections that hide from a live OS.

Full explanation →
281
MCQmedium

A security incident occurs when an unauthorized user gains access to a server because a technician left a default password unchanged after a system rebuild. The rebuild was documented, but the password change was not. What documentation failure does this highlight?

A.The change log did not include a rollback plan.
B.The change log did not list the specific configuration changes made.
C.The change request was not approved by the change advisory board.
D.The technician did not perform a post-implementation review.
AnswerB

A comprehensive change log is absolutely fundamental for maintaining system security, integrity, and accountability within an IT environment. Omitting specific configuration details, such as a password update, creates a critical security vulnerability by leaving an undocumented credential or 'backdoor.' This lack of transparency directly enables unauthorized access because the change cannot be tracked, audited, or properly managed by authorized personnel.

Why this answer

The documentation failure is that the change log did not list the specific configuration changes made. In this scenario, the system rebuild was documented, but the critical detail of changing the default password was omitted. Proper change management requires that every configuration change, including password updates, be explicitly recorded in the change log to ensure accountability and traceability.

Without this record, the security incident occurred due to an undocumented deviation from security best practices.

Exam trap

CompTIA often tests the distinction between a change log's requirement to list specific changes versus broader change management processes like approval or review, leading candidates to confuse a documentation failure with a procedural one.

How to eliminate wrong answers

Option A is wrong because a rollback plan is not the primary issue here; the failure is the omission of the password change from the documentation, not the absence of a procedure to revert changes. Option C is wrong because the question does not indicate that the change request lacked approval from the change advisory board (CAB); the issue is the incomplete documentation of the change itself. Option D is wrong because a post-implementation review (PIR) would occur after the change is completed, but the core failure is that the password change was never recorded in the change log, which is a documentation failure that precedes any review.

Full explanation →
282
MCQhard

A company’s change management policy states that all changes must be reviewed by the CAB. An urgent security vulnerability is discovered that requires an immediate patch to a critical database server. The CAB is not available for 24 hours. What is the best course of action?

A.Wait for the CAB to meet and approve the change
B.Apply the patch immediately and document it as an emergency change
C.Apply the patch but do not document it to avoid policy violation
D.Disconnect the server from the network until the CAB meets
AnswerB

Applying the patch immediately and documenting it as an emergency change is the correct procedure for critical vulnerabilities. Emergency change processes are specifically designed for situations requiring immediate action to prevent or mitigate severe business impact or security threats. This approach allows for rapid deployment of the fix, followed by retrospective documentation and approval, ensuring both prompt risk mitigation and adherence to change management governance.

Why this answer

The change management policy includes an emergency change process for urgent security vulnerabilities. Applying the patch immediately and documenting it as an emergency change aligns with ITIL best practices and the company's policy, ensuring the vulnerability is mitigated without delay while maintaining compliance through post-implementation review.

Exam trap

CompTIA often tests the misconception that all changes must wait for CAB approval, ignoring the emergency change process explicitly defined in ITIL and many corporate policies.

How to eliminate wrong answers

Option A is wrong because waiting 24 hours for the CAB leaves the critical database server exposed to the security vulnerability, which could lead to data breach or system compromise. Option C is wrong because applying the patch without documentation violates the change management policy and creates an audit trail gap, potentially leading to compliance issues and inability to track changes. Option D is wrong because disconnecting the server from the network disrupts business operations and does not resolve the vulnerability; the patch must still be applied, and the server remains vulnerable when reconnected.

Full explanation →
283
MCQhard

During a remote troubleshooting session, a technician uses a tool that allows them to view the user's screen and control the mouse and keyboard. The user reports that the session is extremely laggy, with noticeable delay between the technician's actions and the screen update. Which of the following is the most likely cause of this lag?

A.The remote desktop software is using an outdated encryption protocol.
B.The user's computer has insufficient RAM to handle remote desktop sessions.
C.The network connection between the technician and the user has high latency or low bandwidth.
D.The technician's computer is running a different operating system than the user's.
AnswerC

Remote desktop protocols rely on constant, low-latency communication to provide a responsive user experience. High latency, measured by round-trip time (RTT), directly translates to a noticeable delay between the technician's input (mouse clicks, keystrokes) and the corresponding visual update on their screen. Conversely, low bandwidth restricts the amount of screen data that can be transmitted per second, resulting in a choppy, pixelated, or slow-to-refresh display, both of which are perceived as significant lag.

Why this answer

The lag described is a classic symptom of network latency or insufficient bandwidth, which directly impacts the responsiveness of remote desktop protocols like RDP or VNC. These protocols transmit screen updates and input events in real time; high latency delays the round-trip of packets, while low bandwidth can cause frame drops or compression artifacts, resulting in the noticeable delay between the technician's actions and the screen update.

Exam trap

CompTIA often tests the concept that remote desktop lag is primarily a network issue (latency/bandwidth), not a hardware or OS compatibility problem, and the trap here is that candidates may incorrectly attribute the lag to the user's local hardware (RAM) or encryption overhead instead of recognizing the network as the most likely culprit.

How to eliminate wrong answers

Option A is wrong because outdated encryption protocols (e.g., SSL 3.0 vs. TLS 1.2) affect security, not responsiveness; they may add negligible overhead but are not the primary cause of severe lag. Option B is wrong because insufficient RAM on the user's computer would typically cause local application crashes, swapping, or slow local performance, not a specific delay between remote input and screen updates; remote desktop protocols are more sensitive to CPU and network than to RAM.

Option D is wrong because different operating systems between technician and user are handled transparently by cross-platform remote desktop tools (e.g., RDP client on Windows connecting to Linux via xrdp); the OS mismatch does not inherently introduce lag.

Full explanation →
284
MCQeasy

A customer says that when they click a link in an email, it opens a website that looks exactly like their bank's login page, but the URL starts with 'http://' instead of 'https://'. What is the most likely security concern?

A.The website is using an expired SSL certificate.
B.The user's browser is infected with adware.
C.The email contains a phishing link.
D.The user's DNS server has been compromised.
AnswerC

Phishing attacks are a form of social engineering where attackers send fraudulent communications, often emails, to trick individuals into revealing sensitive information. The combination of a deceptive email link leading to a website that visually mimics a legitimate service but uses an insecure HTTP connection is a hallmark of a phishing attempt. This method aims to steal credentials by presenting a convincing, yet fake, login portal.

Why this answer

The absence of HTTPS and the lookalike page strongly indicate a phishing attempt. Phishing sites often mimic legitimate sites to steal credentials, and the lack of encryption is a red flag. Users should never enter credentials on non-HTTPS pages, especially from email links.

Full explanation →
285
MCQhard

An organization uses Windows 10 and wants to prevent users from installing unauthorized software. They have configured Software Restriction Policies via Group Policy. However, a user bypassed the policy by renaming the executable. What additional measure should be taken to enforce the restriction?

A.Enable Windows Defender Real-time Protection
B.Use AppLocker with publisher rules
C.Set User Account Control to Always Notify
D.Enable BitLocker
AnswerB

AppLocker with publisher rules provides robust application control by allowing only digitally signed software from trusted publishers to execute. These rules validate an application's digital signature and certificate chain, ensuring its authenticity and integrity, making it highly resistant to circumvention by simply renaming or relocating executable files. This method effectively prevents the execution of unauthorized software that lacks a valid, approved digital signature, regardless of its file name or path.

Why this answer

AppLocker with publisher rules is the correct additional measure because Software Restriction Policies (SRP) can be bypassed by renaming executables, as SRP relies on file path or hash rules. AppLocker's publisher rules use digital signatures to identify software, making it immune to filename changes. This provides a more robust enforcement mechanism for preventing unauthorized software installation.

Exam trap

CompTIA often tests the distinction between Software Restriction Policies and AppLocker, where candidates mistakenly think SRP's hash rules are sufficient, but the trap is that renaming bypasses path rules, and hash rules require updates after each software update, whereas AppLocker publisher rules are more resilient.

How to eliminate wrong answers

Option A is wrong because Windows Defender Real-time Protection is an antimalware feature that detects and blocks malicious software, but it does not prevent users from installing or running unauthorized software based on policy rules. Option C is wrong because User Account Control (UAC) set to Always Notify prompts for administrative consent but does not block execution of unauthorized software if the user has administrative rights or bypasses the prompt. Option D is wrong because BitLocker is a full-disk encryption technology that protects data at rest, not a software restriction or execution control mechanism.

Full explanation →
286
MCQeasy

A small business owner wants to ensure that only authorized users can access their iMac. They need to set up separate accounts for three employees, each with a username and password, and restrict one employee from installing software. Which macOS feature should they use to create and manage these user accounts?

A.System Settings > Users & Groups.
B.Terminal with the 'dscl' command.
C.System Information > Software > Installations.
D.Keychain Access to create user passwords.
AnswerA

This is the primary graphical interface in macOS for managing local user accounts and their associated privileges. To restrict an employee from installing software, an administrator would create or modify their account to be a "Standard" user, which inherently prevents system-wide software installations without administrator authentication. Additionally, more granular restrictions on app installation can be configured via Screen Time settings, often accessible or managed in conjunction with user accounts, providing robust control over user capabilities.

Why this answer

The 'Users & Groups' pane in System Settings (macOS Ventura and later) is the native graphical interface for creating, editing, and managing local user accounts, including setting passwords and controlling administrative privileges. It allows the owner to create separate accounts for each employee and restrict one from installing software by setting that account as a 'Standard' user rather than an 'Administrator'.

Exam trap

The trap here is that candidates may confuse the 'Users & Groups' GUI with the command-line 'dscl' tool, thinking both are equally appropriate for a non-technical business owner, but the exam expects you to recognize that the GUI is the correct and intended method for typical user management scenarios.

How to eliminate wrong answers

Option B is wrong because while the 'dscl' command in Terminal can create and manage user accounts, it is a command-line tool intended for advanced administration and scripting, not the recommended or primary method for a small business owner who needs a straightforward GUI. Option C is wrong because 'System Information > Software > Installations' only displays a list of installed software and their installation dates; it cannot create or manage user accounts. Option D is wrong because Keychain Access is used to store and manage passwords, certificates, and secure notes, not to create user accounts or set account-level restrictions.

Full explanation →
287
MCQhard

A technician is asked to install a new accounting application on a user's computer. The user mentions that a coworker told them the software is known to cause conflicts with antivirus programs. What should the technician do?

A.Ignore the user's comment because it is hearsay and proceed with the installation.
B.Research the software's compatibility with the antivirus and test in a sandbox if possible.
C.Disable the antivirus temporarily and install the software.
D.Tell the user that the coworker is mistaken and install the software anyway.
AnswerB

Researching software compatibility with existing antivirus solutions and testing in a sandbox environment is the most professional and thorough approach. This proactive measure ensures that the new accounting software will not conflict with critical security software, preventing system instability, data corruption, or security vulnerabilities. A sandbox provides an isolated testing ground, minimizing risk to the production system before full deployment.

Why this answer

The technician must validate the user's concern through proper research rather than dismissing it. Checking the software's documented compatibility with the specific antivirus program and testing in an isolated sandbox environment prevents potential system instability or security bypasses without risking the production system.

Exam trap

CompTIA often tests the candidate's ability to balance user input with professional verification, trapping those who either dismiss user concerns outright or take risky shortcuts like disabling security software.

How to eliminate wrong answers

Option A is wrong because ignoring the user's comment violates professional due diligence; hearsay can still indicate a real compatibility issue that could cause application crashes or antivirus false positives. Option C is wrong because disabling antivirus temporarily exposes the system to malware during installation and does not resolve the underlying conflict; the software might still malfunction or trigger alerts when antivirus is re-enabled. Option D is wrong because dismissing the coworker's claim without evidence is unprofessional and could lead to a failed installation or system compromise if the conflict is real.

Full explanation →
288
MCQeasy

A user reports that their smartphone cannot connect to the office Wi-Fi, but other devices can. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The technician checks the phone's settings and sees that it is configured for WPA2-PSK. What is the most likely reason for the connection failure?

A.The phone's Wi-Fi antenna is damaged.
B.The phone is using the wrong security protocol.
C.The router's SSID is hidden.
D.The phone's MAC address is filtered.
AnswerB

WPA2-PSK uses a shared key, while WPA2-Enterprise uses 802.1X authentication.

Why this answer

The phone is configured for WPA2-PSK (Pre-Shared Key), but the office network uses WPA2-Enterprise with PEAP-MSCHAPv2. WPA2-Enterprise requires 802.1X authentication with a RADIUS server, using EAP methods like PEAP-MSCHAPv2, while WPA2-PSK uses a single shared passphrase. The mismatch in security protocols prevents the phone from completing the 4-way handshake, causing the connection failure.

Exam trap

CompTIA often tests the distinction between WPA2-PSK and WPA2-Enterprise, trapping candidates who assume all WPA2 configurations are interchangeable or that the issue is a simple connectivity problem like a hidden SSID or MAC filter.

How to eliminate wrong answers

Option A is wrong because a damaged Wi-Fi antenna would prevent connection to any network, not just this specific one, and other devices are connecting successfully. Option C is wrong because a hidden SSID does not affect the security protocol negotiation; the phone would still attempt to connect using the wrong protocol (WPA2-PSK) and fail. Option D is wrong because MAC address filtering would block the phone regardless of the security protocol setting, and the issue is specifically a protocol mismatch, not a MAC-based block.

Full explanation →
289
MCQeasy

A user reports that after a recent Windows update, their computer now boots to a blue screen with the error 'INACCESSIBLE_BOOT_DEVICE'. They need to get back to work quickly. Which Windows recovery tool should you use first to attempt a repair?

A.System Restore
B.Reset this PC
C.Startup Repair
D.Command Prompt (chkdsk /f)
AnswerC

Startup Repair is the most appropriate initial troubleshooting step for boot failures, especially after a Windows update, as it automatically diagnoses and attempts to fix common issues preventing the operating system from loading. It scans for corrupted system files, incorrect Boot Configuration Data (BCD), problematic drivers, and disk errors that might cause stop codes like INACCESSIBLE_BOOT_DEVICE. This automated tool is designed to restore boot functionality without requiring manual intervention in the command line, making it the primary first-response utility.

Why this answer

The 'INACCESSIBLE_BOOT_DEVICE' error often indicates a driver or disk configuration issue caused by an update. The Startup Repair tool in the Windows Recovery Environment (WinRE) can automatically diagnose and fix common boot problems like this. It is the safest and fastest initial step before trying more invasive methods.

Full explanation →
290
MCQeasy

A small business owner wants to ensure that only authorized users can log into their Windows 10 workstations. They need a tool to create and manage user accounts and set password policies. Which administrative tool should you use?

A.Computer Management
B.Local Users and Groups
C.Group Policy Editor
D.Task Scheduler
AnswerB

The Local Users and Groups snap-in (lusrmgr.msc) is the dedicated administrative tool within Windows for managing user accounts and groups on a standalone, non-domain-joined computer. It provides direct functionality to create, modify, and delete local user accounts, assign them to local groups, and configure specific password policies such as password expiration, complexity requirements, and account lockout thresholds. This tool is precisely designed for granular control over local user security settings.

Why this answer

Local Users and Groups (lusrmgr.msc) is the snap-in for managing user accounts, groups, and local security policies on a standalone Windows system. It allows creating, modifying, and deleting users and setting password requirements.

Full explanation →
291
MCQmedium

A user reports that their application crashes with an 'Access Denied' error when trying to write to a specific folder. You have verified the user has Full Control NTFS permissions. Which administrative tool should you use to check for any file encryption or compression that might be blocking the write?

A.Computer Management > Shared Folders to view open files.
B.Local Security Policy to check user rights assignments.
C.File Explorer > right-click folder > Properties > Advanced to view encryption and compression attributes.
D.Registry Editor to modify the folder's security descriptor.
AnswerC

Navigating to a folder in File Explorer, right-clicking, selecting "Properties," and then clicking the "Advanced..." button reveals the "Advanced Attributes" dialog. This interface directly displays critical file system attributes, including whether the folder's contents are encrypted using Encrypting File System (EFS) or compressed. These attributes can directly impact application access and functionality, making this the precise location to diagnose such issues.

Why this answer

The 'Access Denied' error despite Full Control NTFS permissions indicates a file-level attribute conflict. File encryption (EFS) or compression attributes are stored in the folder's Advanced Attributes dialog, accessible via File Explorer > Properties > Advanced. These attributes can block write access even when NTFS permissions are permissive, as encryption requires the user's EFS certificate and compression changes the file's physical layout.

Exam trap

The trap here is that candidates assume 'Access Denied' always means insufficient NTFS permissions, so they focus on permission tools (like Shared Folders or Security Policy) instead of checking file attributes like encryption or compression that override permission-based access.

How to eliminate wrong answers

Option A is wrong because Computer Management > Shared Folders > Open Files shows which files are currently locked by network sessions, not encryption or compression attributes; it cannot diagnose attribute-based write blocks. Option B is wrong because Local Security Policy manages user rights assignments (e.g., 'Log on locally', 'Shut down the system'), not file-level encryption or compression settings. Option D is wrong because Registry Editor modifies system-wide security descriptors in the registry, not per-folder encryption or compression attributes; folder attributes are stored in the NTFS master file table (MFT), not the registry.

Full explanation →
292
MCQeasy

A customer is frustrated because every time they plug in a USB flash drive, Windows automatically opens the folder and plays any media files. They want to stop this behavior. Which Control Panel tool should you use to change the default action?

A.File Explorer Options
B.AutoPlay
C.Device Manager
D.Default Programs
AnswerB

AutoPlay is a Windows feature specifically designed to detect the connection of removable media, including USB drives, external hard drives, and optical discs, and then present the user with a choice of predefined actions. These actions can range from opening the device's folder to playing media content or initiating a specific program. Users can customize or completely disable AutoPlay for various device types through the Control Panel or Settings app, directly resolving issues where unwanted automatic actions occur upon device connection.

Why this answer

AutoPlay is the Windows Control Panel tool specifically designed to manage the default behavior when removable media like USB flash drives are connected. By configuring AutoPlay, you can set the system to 'Take no action' instead of automatically opening the folder and playing media files. This directly addresses the customer's frustration by stopping the automatic playback and folder opening.

Exam trap

CompTIA often tests the distinction between AutoPlay (which controls automatic actions upon device insertion) and Default Programs (which controls file type associations), leading candidates to mistakenly choose Default Programs because they confuse 'default action for a device' with 'default program for a file extension'.

How to eliminate wrong answers

Option A is wrong because File Explorer Options (formerly Folder Options) manages folder views, search settings, and file associations for browsing, not the automatic actions triggered by connecting removable media. Option C is wrong because Device Manager is used to manage hardware drivers, update firmware, and troubleshoot device conflicts, not to configure software-level default actions for media insertion. Option D is wrong because Default Programs sets which application opens a specific file type (e.g., .mp3 with VLC), but it does not control the system's automatic response when a device is plugged in, which is the role of AutoPlay.

Full explanation →
293
MCQeasy

A customer reports that their workstation is running slowly after a recent group policy update. The change log indicates the update added new security settings. What is the most appropriate documentation step for the technician to take after resolving the issue?

A.Note the resolution in the change log and close the ticket.
B.Delete the change log entry to avoid confusion.
C.Send an email to the user explaining the fix.
D.Create a new change request to revert the group policy.
AnswerA

Noting the resolution in the change log and closing the ticket is the correct procedure following a successful fix. This action ensures proper documentation of the incident, the steps taken to resolve it, and the final outcome, which is crucial for audit trails, knowledge management, and future troubleshooting. Closing the ticket formally marks the completion of the incident management process, moving it from an active to a resolved status.

Why this answer

After resolving the issue, the technician must document the resolution in the change log to maintain an accurate audit trail of changes and their outcomes. This aligns with change management best practices, ensuring that future technicians can see what was done to fix the problem and avoid repeating the same troubleshooting steps. Closing the ticket after documenting the resolution completes the incident management lifecycle.

Exam trap

The trap here is that candidates may confuse the informal step of notifying the user (Option C) with the formal documentation requirement, or they may think that reverting the policy (Option D) is necessary without first verifying that the issue is fully resolved and documented.

How to eliminate wrong answers

Option B is wrong because deleting the change log entry violates change management policy by destroying the audit trail, making it impossible to track what changes were made and why. Option C is wrong because while notifying the user is courteous, it is not the most appropriate documentation step; the primary documentation requirement is updating the formal change log, not sending an informal email. Option D is wrong because creating a new change request to revert the group policy is premature and unnecessary; the issue has already been resolved, and reverting the policy without analysis could reintroduce security vulnerabilities or break other configurations.

Full explanation →
294
MCQmedium

During a corporate device deployment, a technician configures an iPhone for a new employee. The employee later reports that they cannot receive emails on the native Mail app, but can access the webmail interface in Safari. What is the most likely misconfiguration?

A.The email account password was entered incorrectly.
B.The outgoing mail server (SMTP) settings are wrong.
C.The incoming mail server settings are incorrect.
D.The device's date and time are set incorrectly.
AnswerC

If the incoming mail server settings (such as the POP3 or IMAP server address, port number, or security protocol) are misconfigured in the device's email application, the app will be unable to establish a connection and download new emails. Webmail, conversely, accesses the mailbox directly on the server using a completely different interface and configuration, explaining why it functions correctly while the device's app fails to receive mail. This points directly to a client-side configuration error specific to the receiving mail function.

Why this answer

The user can access webmail via Safari but cannot receive emails in the native Mail app. This indicates the email account credentials are valid and the network connection is working, but the incoming mail server (POP3/IMAP) settings are misconfigured. Incorrect incoming server hostname, port, or SSL/TLS settings would prevent the Mail app from downloading new messages while leaving webmail unaffected.

Exam trap

The trap here is that candidates confuse incoming and outgoing mail server roles, assuming any email problem must be SMTP-related, when the symptom of being able to send but not receive points directly to the incoming server settings.

How to eliminate wrong answers

Option A is wrong because if the password were incorrect, the user would also be unable to log in to webmail, which they can access successfully. Option B is wrong because incorrect SMTP settings would prevent sending emails, not receiving them; the issue is specifically about not receiving emails. Option D is wrong because incorrect date and time would typically cause SSL/TLS certificate validation failures affecting both sending and receiving, and would also impact webmail access over HTTPS, which is working.

Full explanation →
295
MCQmedium

A technician is configuring a new server rack in a shared office space. Which physical security measure should be applied to prevent unauthorized physical access to the servers?

A.Install a door alarm on the office entrance
B.Use rack-mount locks on each server chassis
C.Enable BitLocker on all server drives
D.Configure a strong BIOS password
AnswerB

Rack-mount locks are designed to physically secure individual server chassis within the rack, preventing them from being slid out, removed, or opened without authorization. These specialized locks directly attach to the server's mounting rails or front panel, creating a physical barrier against theft or internal component tampering. This measure provides direct hardware security, making it the most effective option for preventing unauthorized physical access to the server units themselves.

Why this answer

Rack-mount locks provide a direct physical barrier that prevents unauthorized individuals from opening the server chassis and accessing internal components, such as hard drives, memory, or cables. In a shared office space, this is the most effective measure to deter tampering, theft, or accidental damage at the rack level.

Exam trap

The trap here is that candidates often confuse logical security controls (like BitLocker or BIOS passwords) with physical security controls, failing to recognize that only a physical barrier like a lock prevents direct hardware access.

How to eliminate wrong answers

Option A is wrong because a door alarm on the office entrance only alerts to unauthorized entry into the room but does not prevent direct physical access to the server chassis once inside; it is a perimeter control, not a server-level control. Option C is wrong because BitLocker is a full-disk encryption technology that protects data at rest if a drive is removed, but it does not prevent physical access to the server itself or its components. Option D is wrong because a BIOS password controls boot-level access and prevents unauthorized changes to firmware settings, but it does not prevent someone from physically opening the chassis, removing drives, or tampering with hardware.

Full explanation →
296
MCQhard

After a security incident, a Windows 10 workstation is suspected of having malware that prevents the Task Manager and Command Prompt from opening. You need to run a system scan. Which tool can you use from the Windows Recovery Environment (WinRE) to perform an offline antivirus scan?

A.System File Checker (sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows)
B.Windows Memory Diagnostic
C.Microsoft Defender Offline Scan
D.Diskpart
AnswerC

Microsoft Defender Offline Scan is an essential tool for addressing persistent or deeply embedded malware infections, such as rootkits. It reboots the system into a secure, minimal environment, typically Windows Recovery Environment (WinRE), where it can perform a comprehensive scan using the latest virus definitions without loading the potentially compromised Windows operating system. This isolation prevents malware from actively interfering with the scanning process, allowing for more effective detection and removal of sophisticated threats.

Why this answer

Windows Defender Offline (now part of Microsoft Defender Antivirus) can be run from the Windows Recovery Environment to scan for malware without booting the infected OS. This bypasses malware that blocks security tools in the normal Windows environment. It is the appropriate tool for this scenario.

Full explanation →
297
MCQmedium

A help desk ticket states that a user cannot write to a shared directory /data/projects. The directory permissions are drwxr-xr-x and the user is in the 'staff' group. The directory's group owner is 'staff'. What is the most likely cause?

A.The user does not have read permission on the directory.
B.The directory lacks group write permission.
C.The user is not the owner of the directory.
D.The sticky bit is set on the directory.
AnswerB

The 'r-x' permission set for the group on the directory explicitly grants read and execute (traverse) permissions but conspicuously lacks the 'w' (write) permission. For a user to create, delete, or rename files within a directory, they must have write permission on that directory. Since the user is likely a member of the group, and the group lacks the necessary write permission, they are unable to perform write operations within the directory.

Why this answer

The directory permissions are drwxr-xr-x, which means the owner has read, write, and execute (rwx), the group has read and execute (r-x), and others have read and execute (r-x). Since the user is in the 'staff' group and the directory's group owner is 'staff', the user's effective permissions are the group permissions, which lack write (w). Therefore, the user cannot write to the directory.

Option B correctly identifies that the directory lacks group write permission.

Exam trap

The CompTIA A+ exam often tests the misconception that being a member of the group that owns a directory automatically grants write access, but candidates overlook that the group permissions must explicitly include the write bit (w) for the user to write to the directory.

How to eliminate wrong answers

Option A is wrong because the user has read permission via the group's 'r-x' permissions (the 'r' allows listing contents). Option C is wrong because ownership is not required to write to a directory; group write permission would suffice if present. Option D is wrong because the sticky bit (indicated by a 't' in the execute position) is not set in the displayed permissions (drwxr-xr-x), and even if it were, it restricts deletion of files by non-owners, not the ability to write new files.

Full explanation →
298
MCQmedium

A technician is configuring a new Mac mini for a kiosk application. The kiosk should run only a single web browser in full-screen mode, and users should not be able to exit the app or access the desktop. Which macOS feature should be used to enforce this?

A.Enable Guided Access in Accessibility settings
B.Configure a user account with Parental Controls set to allow only the browser app
C.Use the 'Single App Mode' setting in System Settings
D.Set the browser as a Login Item for a standard user
AnswerB

macOS Parental Controls, now integrated into Screen Time settings, allow administrators to precisely manage application access for specific user accounts. By configuring these controls, a technician can restrict a user account to launch and use only a designated application, such as a web browser, preventing access to the desktop, other applications, or system settings. When combined with auto-login for this restricted user and setting the browser as a login item, this effectively creates a robust single-application kiosk environment.

Why this answer

MacOS Parental Controls (now part of Screen Time) can restrict a standard user account to a single app, such as a web browser. When configured to 'Allow only this app,' the system prevents the user from switching apps, accessing the desktop, or exiting the browser, which is exactly what a kiosk requires.

Exam trap

The trap here is that candidates confuse macOS Parental Controls with iOS Guided Access, or assume a nonexistent 'Single App Mode' setting exists in System Settings, leading them to pick A or C.

How to eliminate wrong answers

Option A is wrong because Guided Access is an iOS/iPadOS feature, not available on macOS; it cannot be used to lock a Mac into a single app. Option C is wrong because 'Single App Mode' is not a setting in macOS System Settings; macOS uses Parental Controls or Managed Apple IDs for this purpose, not a dedicated toggle. Option D is wrong because setting the browser as a Login Item only launches it at login, but does not prevent the user from switching to other apps or accessing the desktop.

Full explanation →
299
MCQeasy

A technician is configuring a remote desktop solution for a user who needs to access a Windows 10 Pro workstation from a Linux laptop. Which protocol should the technician ensure is enabled on the Windows machine?

A.VNC
B.RDP
C.SSH
D.Telnet
AnswerB

RDP (Remote Desktop Protocol) is Microsoft's proprietary protocol specifically designed for remote access to Windows desktops. It provides a full graphical user interface (GUI) experience, allowing users to interact with the remote machine as if they were sitting directly in front of it. Its native integration with Windows operating systems makes it the most straightforward and efficient solution for configuring a remote desktop for Windows machines, with robust client software available across various platforms, including Linux.

Why this answer

RDP (Remote Desktop Protocol) is the native protocol used by Windows for remote desktop connections. Windows 10 Pro includes an RDP server that listens on TCP port 3389, allowing clients such as the Microsoft Remote Desktop client on Linux to connect and provide a full graphical desktop experience. The technician must ensure the 'Allow remote connections to this computer' setting is enabled and that the Windows Firewall permits inbound RDP traffic.

Exam trap

CompTIA often tests the distinction between native Windows remote desktop (RDP) and cross-platform or command-line protocols, leading candidates to confuse VNC (which is also graphical but not native to Windows) or SSH (which is secure but not graphical) with the correct answer.

How to eliminate wrong answers

Option A is wrong because VNC (Virtual Network Computing) is a cross-platform remote desktop protocol but is not native to Windows; it requires third-party software on both ends and typically uses RFB (Remote Framebuffer) protocol on port 5900, not the built-in Windows solution. Option C is wrong because SSH (Secure Shell) provides encrypted command-line access and file transfer (using port 22) but does not natively support a full graphical desktop environment on Windows without additional components like X11 forwarding or third-party tools. Option D is wrong because Telnet is an unencrypted, text-only protocol (port 23) that offers no graphical interface and is deprecated due to security vulnerabilities; it is not suitable for remote desktop access.

Full explanation →
300
MCQmedium

During a security audit, you find that several employees have been using the same weak password for their domain accounts. Which remediation should you implement first?

A.Disable the user accounts and require a manager to re-enable them
B.Configure a password policy in Group Policy requiring complexity and minimum length
C.Send a company-wide email reminding users to choose strong passwords
D.Install a third-party password manager for all employees
AnswerB

Implementing a password policy via Group Policy Objects (GPOs) centrally enforces security requirements across all domain-joined user accounts. This technical control mandates specific criteria, such as minimum length, character complexity (e.g., uppercase, lowercase, numbers, symbols), and password history, ensuring that users create and maintain strong, unique passwords consistently throughout the organization, preventing future weak password usage.

Why this answer

The most effective first step to prevent weak passwords is to enforce a strong password policy via Group Policy. This centrally mandates complexity requirements (e.g., uppercase, lowercase, digits, special characters) and a minimum length (typically 8–14 characters), which directly blocks the use of simple, common passwords at the domain level. Unlike awareness campaigns or reactive measures, this technical control proactively enforces security standards across all domain accounts.

Exam trap

CompTIA often tests the distinction between administrative controls (like emails or account disabling) and technical controls (like Group Policy), where candidates mistakenly choose a non-technical, awareness-based option (C) over a policy-enforced technical solution (B).

How to eliminate wrong answers

Option A is wrong because disabling accounts and requiring manager re-enablement is a reactive, disruptive measure that does not address the root cause—employees will likely continue using weak passwords once re-enabled. Option C is wrong because a company-wide email is a non-technical, awareness-only approach that relies on voluntary compliance and does not prevent users from choosing weak passwords; it lacks enforcement. Option D is wrong because installing a third-party password manager, while helpful for password storage and generation, does not enforce a minimum password complexity or length policy on the domain accounts themselves and is a secondary measure, not the first remediation step.

Full explanation →
Page 3

Page 4 of 7

Page 5

All pages

1234567

Practice 220-1202 by domain

Target a specific domain to shore up weak areas.

Operating SystemsSecuritySoftware TroubleshootingOperational Procedures
See all domains with question counts →