CompTIA A+ Core 2 220-1202 (220-1202) — Questions 301–375

Why this answer

How to eliminate wrong answers

Option A is wrong because 'stat' shows detailed file metadata (inode, timestamps, etc.) but does not display permissions and ownership in a concise, human-readable format like 'ls -l'. Option C is wrong because 'file' determines the file type (e.g., ELF binary, script) but does not show permissions or ownership. Option D is wrong because 'chmod' is used to change permissions, not to view them; running it without a mode argument will produce an error.

Why this answer

How to eliminate wrong answers

Option A is wrong because `chmod o+r` adds read permission for 'others' (users not the owner and not in the group), not for the group 'developers'. Option B is wrong because `chmod 644` sets permissions to `-rw-r--r--`, which gives read access to both group and others, but it also removes any existing special permissions (like setuid/setgid) and does not specifically target only the group; it is overly broad and changes the owner's permissions unnecessarily. Option D is wrong because `chown :developers /opt/app/data` changes the group ownership of the file to 'developers', but it does not change the file's permissions; the file still has `-rw-------`, so even after changing the group, members of 'developers' still cannot read the file because no group read permission is set.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling private browsing mode only prevents the browser from storing history, cookies, and form data; it does not restrict extension installation. Option C is wrong because setting the browser homepage to a company-approved site only controls the default startup page, not the ability to install extensions. Option D is wrong because installing an ad-blocker extension does not enforce a restriction; it is itself an extension and does not prevent other extensions from being installed.

Why this answer

How to eliminate wrong answers

Option A is wrong because thrift stores typically lack the certification to handle hazardous e-waste; selling CRTs for reuse may still lead to improper disposal later and does not guarantee responsible end-of-life management. Option B is wrong because breaking the glass tubes releases toxic lead dust and phosphor powder, creating an immediate health hazard and violating RCRA rules against land disposal of hazardous waste. Option D is wrong because school art departments are not equipped to safely handle or dispose of leaded glass; using CRTs for art projects still results in eventual improper disposal and potential environmental contamination.

Why this answer

How to eliminate wrong answers

Option A is wrong because Keychain Access manages passwords, certificates, and secure notes, not application permissions for hardware like the camera or microphone. Option C is wrong because Console displays system logs and diagnostic messages, not privacy settings or permission states. Option D is wrong because while the 'tccutil' command can reset privacy permissions via Terminal, it is not designed to simply check or view current permissions; it requires administrative privileges and is used for bulk resets, not verification.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `ping -t` continuously sends ICMP Echo Requests to the target; it only confirms reachability or loss, but does not show the route or identify which hop is failing. Option C is wrong because `nslookup` is a DNS query tool that resolves a domain name to an IP address; it does not test network path or routing. Option D is wrong because `netstat -an` displays active network connections, listening ports, and protocol statistics on the local machine; it provides no information about the path packets take to a remote server.

Why this answer

How to eliminate wrong answers

Option A is wrong because replying with a detailed technical explanation, while factually accurate, is likely to be perceived as defensive and condescending, escalating the conflict rather than resolving the user's emotional concern; professionalism requires empathy over technical correctness. Option B is wrong because ignoring the email is a form of avoidance that neglects the user's complaint, potentially damaging the technician's reputation and the IT department's credibility, and it fails to address any underlying issue that may have arisen from the fix or subsequent changes. Option D is wrong because forwarding the email to the user's manager to complain about the user's tone is unprofessional, violates confidentiality, and shifts blame instead of focusing on problem resolution; it undermines the technician's role as a service provider and could create unnecessary workplace conflict.

Why this answer

How to eliminate wrong answers

Option A is wrong because Guest Mode and parental controls do not hide the Play Store or prevent installation of new apps; they only limit certain actions and can be bypassed by the user. Option C is wrong because Safe Mode is a diagnostic mode that disables third-party apps, not a configuration tool for permanently hiding the Play Store or restricting app installations. Option D is wrong because simply removing the Google account and disabling the Play Store via Settings > Apps does not prevent the user from re-enabling the Play Store or installing apps from other sources; it is a reversible user-level setting, not a locked-down configuration.

Why this answer

How to eliminate wrong answers

Option A is wrong because WEP is fundamentally broken and can be cracked in minutes using tools like aircrack-ng, regardless of key length; a complex 128-bit key does not fix the underlying RC4 cipher weaknesses. Option B is wrong because replacing functional printers is an unnecessary cost and not a network configuration solution; the question asks how to maintain security while keeping the printers functional. Option D is wrong because mixed mode (WEP + WPA2) on a single SSID forces all clients to use the lowest common denominator security, allowing attackers to downgrade modern clients to WEP and compromise the entire network.

Why this answer

How to eliminate wrong answers

Option A is wrong because the outgoing mail server (SMTP) settings are responsible for sending emails, which the employee can already do successfully, so checking SMTP would not resolve the receive issue. Option C is wrong because incorrect date and time settings can cause SSL/TLS certificate validation failures for both sending and receiving, but the employee can send emails, indicating that the device's time is likely correct or at least not the primary cause of the receive-only failure. Option D is wrong because a VPN configuration issue would typically affect all network traffic or specific app connectivity, not selectively block incoming email while allowing outgoing email; email protocols operate independently of VPN unless the VPN is misconfigured to block specific ports.

Why this answer

How to eliminate wrong answers

Option A is wrong because System File Checker (sfc /scannow) scans and repairs protected system files, but it does not interact with or rebuild the BCD store, which is a separate boot configuration database. Option B is wrong because Diskpart is a disk partitioning tool used to manage volumes and partitions, not to repair boot configuration data; it cannot rebuild the BCD store. Option D is wrong because CHKDSK checks the file system for integrity and fixes logical disk errors, but it has no mechanism to rebuild or repair the BCD store, which is stored in a hidden system partition.

Why this answer

How to eliminate wrong answers

Option A is wrong because increased bandwidth usage is a performance concern, not a direct security risk, and unauthorized remote tools may actually use less bandwidth than approved ones. Option C is wrong because compatibility issues with the operating system are a functional problem, not a security risk, and the employee's claim of needing access to a legacy application suggests compatibility was achieved, not a risk. Option D is wrong because increased licensing costs are a financial or compliance issue, not a security risk, and unauthorized tools typically avoid licensing fees altogether.

Why this answer

How to eliminate wrong answers

Option A is wrong because a network topology diagram shows how devices are connected on the network (e.g., switches, routers, IP subnets), not the internal hardware components of a server like a RAID controller. Option B is wrong because the change management log records the approval and timeline of changes (e.g., who authorized the replacement, when it occurred), but it does not serve as a quick-reference for the new hardware configuration. Option D is wrong because a knowledge base article for RAID troubleshooting provides generic guidance on resolving RAID issues, not the specific hardware details of this particular server's RAID controller.

Why this answer

How to eliminate wrong answers

Option A is wrong because telling the employee their router is 'probably cheap and needs replacement' is dismissive, insulting, and fails to diagnose the actual issue; it assumes hardware fault without evidence and can damage trust, making the employee less cooperative. Option C is wrong because asking a non-technical employee to run a command prompt command without explanation (e.g., 'ipconfig /flushdns' or 'ping 8.8.8.8') creates confusion and anxiety, and the employee may misinterpret or incorrectly execute the command, leading to wasted time or further issues. Option D is wrong because escalating to a senior technician without attempting any troubleshooting abdicates the technician's responsibility and fails to leverage the opportunity to resolve the issue with basic communication and guidance, which is inefficient and unprofessional.

Why this answer

How to eliminate wrong answers

Option A is wrong because Airplane Mode disables all cellular radios, which would also prevent data and calls from working; since data and calls are functioning, Airplane Mode is not the cause. Option C is wrong because the Phone app handles voice calls and its cache is unrelated to SMS message routing or reception; clearing it would not resolve a missing default SMS app issue. Option D is wrong because Google Play Protect scans apps for malware but does not control SMS routing or permissions; disabling it would not fix the SMS delivery problem and could actually reduce security.

Why this answer

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee a working decryption key, funds criminal activity, and may mark the organization as a willing payer for future attacks. Option C is wrong because running an antivirus scan while the machine is still networked allows the ransomware to continue encrypting files and potentially spread to other hosts — containment must come first. Option D is wrong because restoring from backup before isolating the threat can result in re-infection if the ransomware payload or persistence mechanism is still active on the network.

Why this answer

How to eliminate wrong answers

Option B is wrong because Event Viewer logs Windows Update service events (e.g., source 'WindowsUpdateClient') but does not present a consolidated, human-readable update history with KB numbers and install status — it is a diagnostic log, not an update inventory. Option C is wrong because System Information (msinfo32) reports hardware, OS build, and component details but does not list individual installed updates or their history. Option D is wrong because Reliability Monitor tracks system stability events, application crashes, and driver failures over time; it does not enumerate installed Windows updates.

Why this answer

How to eliminate wrong answers

Option A is wrong because a dead battery would show a black screen without the spinning gear icon, and the device would respond to a charger by displaying a low-battery indicator; the gear icon indicates the OS is partially active. Option C is wrong because DFU mode and restore via Finder is a more drastic step that erases all data and should only be attempted after simpler recovery methods like force restart fail; it is not the first step. Option D is wrong because a damaged display would typically show physical cracks, discoloration, or no image at all, not a spinning gear icon, and the device would still respond to button presses or sounds.

Why this answer

How to eliminate wrong answers

Option A is wrong because `net localgroup Administrators UnauthorizedUser /delete` removes the user from the Administrators group, not the user account itself; the account remains on the system. Option C is wrong because `wmic useraccount where name='UnauthorizedUser' delete` is a valid command for deleting a user account via WMI, but the question specifically asks for a command that removes the account, and `net user /delete` is the more direct and commonly tested CLI method; however, the primary reason it is not the best answer is that the exam expects `net user` for this task, and `wmic` is deprecated in newer Windows versions. Option D is wrong because `gpresult /r` displays Resultant Set of Policy (RSoP) data for Group Policy, not user account management.

Why this answer

How to eliminate wrong answers

Option A is wrong because a VPN with a client requires installing and configuring VPN client software on the contractor's device, which violates the 'without installing any client software' requirement. Option B is wrong because Remote Desktop Protocol (RDP) requires a client application (such as Microsoft Remote Desktop Client) to be installed on the accessing device, and it provides full desktop access rather than access to a specific web application. Option D is wrong because SSH is a protocol for secure command-line access to remote systems, typically requiring an SSH client (like PuTTY or OpenSSH) to be installed, and it does not natively provide web application access without additional tunneling or port forwarding.

Why this answer

How to eliminate wrong answers

Option A is wrong because a revoked certificate would trigger a different warning (e.g., 'certificate revoked') and is not caused by an incorrect system date; revocation is checked via CRL or OCSP, not local clock. Option B is wrong because a corrupted certificate store would cause failures across many sites, not just one, and the date issue is a specific, isolated cause. Option D is wrong because a malicious proxy would typically present a different certificate or cause a different error (e.g., name mismatch or untrusted root), not a date-related warning, and the technician already found the date is incorrect.

Why this answer

How to eliminate wrong answers

Option A is wrong because a factory reset is a drastic, last-resort measure that wipes all user data and settings; it is not appropriate for a software-level issue like a corrupted Play Store cache, which can be resolved with a targeted app data clear. Option C is wrong because uninstalling large apps to free up more storage addresses a genuine lack of space, but the device already shows 2GB free, which should be sufficient for most app downloads; the problem is a false storage detection, not actual insufficient capacity. Option D is wrong because checking for a system update is a general maintenance step that does not directly fix a corrupted Play Store cache or data; while updates can resolve bugs, the immediate symptom of a false storage error is best addressed by clearing the app's local data first.

Why this answer

How to eliminate wrong answers

Option A is wrong because frequent password changes do not prevent pass-the-hash attacks; the attacker uses the hash of the current password, and changing passwords every 30 days does not protect the hash stored in memory during an active session. Option B is wrong because network segmentation and firewall rules can limit lateral movement but do not prevent the extraction or reuse of password hashes from a compromised host; the attacker can still move within the allowed segment. Option D is wrong because disabling NTLM authentication entirely is often impractical due to legacy application dependencies, and pass-the-hash attacks can also target Kerberos tickets (pass-the-ticket), so this measure is not comprehensive and may break critical services.

Why this answer

How to eliminate wrong answers

Option A is wrong because replacing a battery while the UPS is still plugged in exposes the technician to high DC voltage (typically 12V–48V) and the risk of short circuits or electric shock, and the continued charging current could accelerate thermal runaway. Option C is wrong because resetting the UPS by pressing the power button does not address the underlying overheating battery; it may briefly silence the alarm but will not stop the chemical reaction causing the burning smell, and could even restart charging. Option D is wrong because spraying a UPS with a fire extinguisher, especially a CO2 or dry chemical type, can damage sensitive electronics, create a conductive residue, and is not the correct first response; the priority is to disconnect power and ventilate, not to apply an extinguisher to a device that is not yet on fire.

Why this answer

How to eliminate wrong answers

Option A is wrong because throwing e-waste in a dumpster is illegal in many jurisdictions due to hazardous materials like lead, mercury, and cadmium found in NICs and electronic components; it also violates environmental responsibility even without a formal policy. Option B is wrong because storing items indefinitely in a closet is not a sustainable solution and can lead to safety hazards, space issues, and potential regulatory non-compliance if the items contain hazardous materials. Option D is wrong because selling e-waste online to a recycler without management approval and without vetting the recycler's compliance with environmental regulations could expose the company to liability and data security risks, as NICs may retain network configuration data.

Why this answer

How to eliminate wrong answers

Option A is wrong because cloud providers do not delete files due to inactivity unless specified in terms of service, and the account is active. Option B is wrong because the account is verified as active, implying it is licensed. Option D is wrong because a full hard drive would prevent syncing and likely generate error messages, not cause files to be missing without indication.

Why this answer

How to eliminate wrong answers

Option A is wrong because MAC address filtering is not a form of authentication and can be easily spoofed; it does not use certificates. Option B is wrong because WPA3-Personal still uses a shared passphrase (SAE handshake), not certificate-based authentication; it is the Personal mode, not Enterprise. Option D is wrong because changing encryption from AES to TKIP would weaken security and does not introduce certificate-based authentication; TKIP is deprecated and not compatible with 802.1X in this context.

Why this answer

How to eliminate wrong answers

Option A is wrong because a privacy screen only prevents visual eavesdropping (shoulder surfing) and does nothing to stop physical access or tampering with the terminal hardware. Option C is wrong because requiring a smart card to power on the terminal controls logical access to the operating system but does not prevent an attacker from physically opening the casing to install a skimmer or modify hardware. Option D is wrong because a password-protected screensaver is a logical access control that locks the screen after inactivity, but it does not prevent physical tampering with the terminal's internals when the device is powered off or the screen is locked.

Why this answer

How to eliminate wrong answers

Option A is wrong because resetting browser settings may temporarily suppress pop-ups but does not remove the malware that is generating them, so the behavior will return. Option C is wrong because disabling JavaScript breaks legitimate websites and does not address the root cause — the malicious program will still be present and may use other vectors. Option D is wrong because clearing cache and cookies only removes stored browsing data; it has no effect on installed malware or malicious extensions.

Why this answer

How to eliminate wrong answers

Option A is wrong because RoHS compliance only restricts the use of specific hazardous substances in manufacturing; it does not render the unit non-hazardous for disposal, and placing it in regular trash violates e-waste regulations. Option C is wrong because selling a failed power supply as scrap metal is not a standard disposal method and may expose the technician to liability if the unit contains hazardous components that are not properly handled. Option D is wrong because storing a failed power supply indefinitely is impractical, takes up space, and does not comply with environmental policies that require proper recycling or disposal of e-waste.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'Screen saver timeout' policy controls how long before the screensaver starts, but if the screensaver itself is not enabled, the timeout is irrelevant. Option B is wrong because 'Password protect the screensaver' only controls whether the screensaver requires a password on resume; it does not determine whether the screensaver activates. Option D is wrong because the 'Turn off the display' power setting controls monitor power, not screensaver activation; the display may turn off while the screensaver never runs.

Why this answer

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan in normal mode still operates within the compromised Windows environment, where the fileless malware can actively hide its processes or memory artifacts from the scanner. Option B is wrong because the Windows Malicious Software Removal Tool (MSRT) is a signature-based tool that targets persistent malware on disk, not memory-resident fileless threats, and Safe Mode does not prevent the malware from running if it loads via a legitimate service or driver. Option D is wrong because restoring from a backup taken before the infection would remove the malware only if the backup predates the infection, but this approach is reactive and may not be feasible if no clean backup exists; it also does not address the immediate need to remove the active memory-resident malware without data loss.

Why this answer

How to eliminate wrong answers

Option A is wrong because touching a CPU heatsink on a system that has been running hot risks serious burns and ESD damage, and it does not address the root cause. Option C is wrong because spraying compressed air into a running system can push dust deeper, cause fan overspin, create static discharge, and expose the technician to moving parts. Option D is wrong because replacing the PSU is a guess that does not match the symptoms (loud fan, hot chassis) and ignores the actual likely cause of dust or fan failure.

Why this answer

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing usually involves fraudulent emails or websites that impersonate legitimate entities to steal credentials or financial data, not pop-ups offering free software. Option C (Pretexting) is wrong because pretexting involves fabricating a scenario or identity to gain trust and extract information, not offering a free download. Option D (Shoulder surfing) is wrong because shoulder surfing is the direct observation of a user's screen or keyboard to capture sensitive data, such as passwords, and does not involve pop-ups or downloads.

Why this answer

How to eliminate wrong answers

Option A is wrong because a zero-day vulnerability is an unknown, unpatched flaw in software code that allows an attacker to compromise a system without user interaction; here, the browser itself was not exploited—the user willingly installed the extension. Option B is wrong because an insecure direct object reference (IDOR) vulnerability involves exposing a direct reference to an internal object (like a file or database record) without proper access control, which is unrelated to tricking a user into installing a malicious extension. Option D is wrong because a cross-site request forgery (CSRF) attack forces an authenticated user to execute unwanted actions on a web application where they are logged in, typically via a crafted link or form; this scenario involves no forged requests—the user actively clicked a fake prompt.

Why this answer

How to eliminate wrong answers

Option A is wrong because unplugging the server from the UPS simulates a power failure but does not test the battery's ability to provide backup power; it only tests the UPS's transfer to battery mode, which can cause unnecessary wear on the battery and risk data loss if the server shuts down improperly. Option C is wrong because disconnecting the UPS from mains power and letting the battery drain completely subjects the battery to a deep discharge cycle, which significantly reduces its lifespan and is not environmentally sound due to increased waste and energy loss. Option D is wrong because replacing the UPS battery every month is wasteful, costly, and environmentally harmful, as batteries contain hazardous materials and should only be replaced when their capacity degrades below acceptable thresholds.

Why this answer

How to eliminate wrong answers

Option A is wrong because attempting to unplug a sparking PC while the rack is unstable puts the technician at risk of electric shock or arc flash, and the spark may indicate a live short that could ignite flammable materials. Option C is wrong because using a fire extinguisher on a sparking PC before evacuating and assessing the situation wastes critical time and may not address the underlying electrical hazard; the spark could be from a capacitor or power supply that could reignite. Option D is wrong because stabilizing the rack with a pallet is a secondary action that should only be performed after the area is safe and the immediate electrical hazard is controlled; it does not address the sparking PC or the risk of fire.

Why this answer

How to eliminate wrong answers

Option A is wrong because Secure Boot ensures that only trusted bootloaders and drivers are loaded during startup, but it does not block the installation of a driver after the OS is running; the error occurs post-boot. Option B is wrong because User Account Control (UAC) controls administrative consent for software changes, not driver signature enforcement; UAC prompts for elevation but does not block unsigned drivers specifically. Option D is wrong because running Windows Update to find a signed driver assumes a signed driver exists for the device, but the user needs to use the drive immediately, and the error indicates the current driver is problematic; this is a long-term fix, not a direct solution to the installation block.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because reinstalling the OS from scratch is an overly drastic step that is unnecessary when the rootkit has already been removed and the issue is limited to file corruption; it would also waste time and user data. Option C is wrong because disabling System Restore and deleting restore points removes potentially useful recovery snapshots but does not repair the corrupted system files causing instability. Option D is wrong because disk cleanup only removes temporary files and frees disk space, which has no effect on corrupted system files or system stability.

Why this answer

How to eliminate wrong answers

Option A is wrong because System Restore reverts system files and settings to a previous restore point, but it does not specifically repair the BCD; it may not resolve a missing bootmgr if the BCD is corrupted. Option C is wrong because Device Manager is used to manage hardware drivers, not boot configuration; updating a disk driver would not fix a missing bootmgr. Option D is wrong because Local Security Policy is for security settings, not boot configuration repair.

Why this answer

How to eliminate wrong answers

Option A is wrong because updating the browser version patches security vulnerabilities but does not remove already-installed malicious extensions or undo their configuration changes. Option C is wrong because unstable internet connections or DNS errors cause timeouts or failure to load pages, not persistent redirects to a specific unfamiliar search engine or pop-up ads when no tabs are open. Option D is wrong because a full browser cache may slow performance or cause stale content to display, but it cannot generate pop-up ads or redirects to an unknown search engine; those actions require active code execution, not cached data.

Why this answer

How to eliminate wrong answers

Option A is wrong because proceeding with an unapproved firmware update and documenting afterward bypasses the CAB and leaves no rollback, violating change control. Option C is wrong because forcing old firmware onto new hardware may be incompatible or unsupported and does not address the missing rollback plan. Option D is wrong because implementing the switch first and filing a separate change request afterward is retroactive change management, which defeats the purpose of the CAB.

Why this answer

How to eliminate wrong answers

Option A is wrong because performance issues like slower browsing or crashes are operational annoyances, not the primary security risk; outdated Flash may cause instability, but the core concern is exploitation. Option B is wrong because inability to view content is a compatibility issue, not a security risk; while some sites may require newer Flash, the audit focuses on vulnerabilities, not functionality. Option D is wrong because modern browsers (e.g., Chrome, Edge) may block or disable outdated Flash by default, but this is a mitigation, not the risk itself; the risk exists before the browser takes action.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'profiles' command in Terminal is used for installing, removing, or managing configuration profiles on a single device, not for deploying to multiple devices in bulk without additional scripting or MDM infrastructure. Option C is wrong because System Preferences > Profiles is a user interface for viewing or manually installing profiles on a single Mac, not a tool for deploying profiles to multiple devices. Option D is wrong because Remote Desktop is primarily for remote control, screen sharing, and software distribution, but it lacks native support for creating or deploying configuration profiles; it would require manual profile installation on each device.

Why this answer

How to eliminate wrong answers

Option A is wrong because throwing the battery in regular trash violates hazardous waste disposal laws and can lead to fires in landfills or recycling facilities due to lithium's reactivity with moisture and other materials. Option C is wrong because burning a lithium-ion battery can cause a violent thermal runaway reaction, releasing toxic fumes and potentially causing an explosion. Option D is wrong because storing a battery in a metal container does not neutralize the chemical hazard; it only contains the risk temporarily, and the battery remains dangerous until properly recycled.

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Defender Application Guard is designed to isolate untrusted web browsing sessions in a Hyper-V container, not to block bundled software installations or prompt user consent during local application setup. Option C is wrong because Windows Firewall with advanced logging only records network traffic events for analysis; it does not prevent or alert on software installation attempts. Option D is wrong because BitLocker drive encryption protects data confidentiality if the device is lost or stolen, but it does not prevent malware from being installed or executed on the system.

Why this answer

How to eliminate wrong answers

Option A is wrong because it jumps to a conclusion without verifying the cause, which is unprofessional and could lead to unnecessary software removal if the slowness is due to another issue like a background update or malware. Option C is wrong because it blames the screensaver without evidence, which damages customer trust and violates professional communication standards. Option D is wrong because ignoring the reported change (the screensaver) and running a full virus scan is inefficient; it wastes time and may miss the actual cause if the screensaver is indeed the problem.

Why this answer

How to eliminate wrong answers

Option A is wrong because `grep -r 'Password' /etc` performs a case-sensitive search, which would miss files containing 'password', 'PASSWORD', etc. Option C is wrong because `find /etc -name '*Password*'` searches for filenames containing 'Password', not file contents. Option D is wrong because `locate Password | grep /etc` uses the `locate` database to find files with 'Password' in their path, then filters for `/etc`, but this searches filenames, not file contents, and is case-sensitive by default.

Why this answer

How to eliminate wrong answers

Option B is wrong because `vssadmin list shadows` only lists existing Volume Shadow Copies (snapshots) but does not perform a restoration; it is a query command, not a recovery action. Option C is wrong because `wbadmin start recovery` is used for restoring from a Windows Server Backup, not for System Restore points, and requires a preconfigured backup set, which is not the scenario here. Option D is wrong because `bootrec /fixboot` repairs the boot sector or boot configuration data (BCD) and has no ability to restore system files or revert to a restore point; it addresses boot failures, not ransomware file encryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because a turnstile with a biometric reader allows one person to pass at a time but does not create a secure holding area with interlocking doors; it cannot prevent a second person from following closely behind (tailgating) and does not enforce authentication before a second door opens. Option B is wrong because a security guard with a logbook relies on human observation and manual logging, which is prone to error, does not provide automated interlocking door control, and cannot guarantee that only one authenticated person enters at a time. Option D is wrong because a cipher lock with a door alarm provides only a single door with a keypad code and an alarm, lacking the two-door interlock mechanism and the multi-factor authentication (smart card + biometric) required to ensure one-person entry and authentication before the second door opens.

Why this answer

How to eliminate wrong answers

Option A is wrong because Safe Mode only disables third-party apps to troubleshoot software conflicts; it does not provide any hardware test for the touchscreen and would not confirm digitizer damage. Option B is wrong because Developer Options exposes debugging and USB/UI tweaks (like pointer location overlays) but is not a hardware diagnostic suite and requires the touchscreen to already work to navigate. Option D is wrong because a Factory Reset wipes user data and reinstalls the OS — it is a destructive last-resort troubleshooting step, not a diagnostic tool, and would not test the digitizer.

Why this answer

How to eliminate wrong answers

Option A is wrong because User Account Control (UAC) set to highest level only prompts for consent or credentials when system-level changes are attempted; it does not restrict access to the desktop, taskbar, or other system functions, nor does it enforce a single-app environment. Option B is wrong because Local Group Policy – Software Restriction Policies can block or allow specific executables but does not prevent users from accessing the desktop, taskbar, or system UI; it is a software execution control, not a kiosk lockdown mechanism. Option C is wrong because Windows Defender Application Guard is a hardware-isolated container for running untrusted applications (typically Microsoft Edge) to protect the host OS from malware; it does not restrict user access to the desktop or taskbar and is not designed for kiosk single-app scenarios.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the user manual is a generic reference document that does not change when a device is relocated; it contains operational instructions, not location or connectivity records. Option C is wrong because the acceptable use policy governs how employees may use company resources, not the physical or logical placement of hardware. Option D is wrong because warranty information is tied to the device's serial number and purchase date, not its physical location; moving the printer does not affect warranty terms.

Why this answer

How to eliminate wrong answers

Option A is wrong because the principle of least privilege restricts user access rights to only what is necessary for their job functions, not how passwords are stored or shared. Option B is wrong because an account lockout policy defines the number of failed login attempts before an account is temporarily disabled, which is unrelated to the physical exposure of passwords. Option D is wrong because multi-factor authentication (MFA) requires two or more verification factors (e.g., password plus token), but the violation here is the failure to keep the password confidential, not the absence of additional authentication layers.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Turn on Public folder sharing' only enables access to the specific 'Public' folder, not any arbitrary folder the user wants to share, and it still respects password protected sharing if enabled. Option C is wrong because 'Enable 128-bit encryption' is a security setting for file sharing connections (to enforce encryption), but it does not control whether a password is required; it can be used with or without password protected sharing. Option D is wrong because HomeGroup was removed from Windows 10 (version 1803) and later, including Windows 11; it is no longer a valid feature for sharing files on a local network.

Why this answer

How to eliminate wrong answers

Option A is wrong because throwing the power supply in a standard trash bag and dumpster violates environmental regulations; the leaking chemicals can contaminate soil and groundwater, and the power supply contains heavy metals that require special handling. Option C is wrong because cleaning with isopropyl alcohol does not neutralize the toxic electrolyte or render the unit safe for normal recycling; the power supply still contains hazardous components that must be processed through certified e-waste facilities. Option D is wrong because disassembling a leaking, potentially charged power supply poses a high risk of electric shock, chemical exposure, and further leakage; technicians should never open a failing PSU—disposal must be handled as a sealed unit.

Why this answer

How to eliminate wrong answers

Option A is wrong because the user can access other shares on the same server, so an expired password would block all network access, not just one folder. Option B is wrong because adding a user to the local Administrators group grants excessive privileges and is not required for folder access; it would not resolve a missing NTFS permission entry. Option D is wrong because rebooting the server clears cached permissions only temporarily and does not fix the underlying permission configuration; the issue will recur after the reboot.

Why this answer

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware drivers and device properties, not Windows service startup types. Option B is wrong because Printers & scanners is for adding, removing, and configuring printer devices, not for changing the spooler service startup type. Option D is wrong because System > Advanced system settings provides access to performance options, user profiles, and startup and recovery settings, not service management.

Why this answer

How to eliminate wrong answers

Option A is wrong because losing a badge is a secondary concern that can be mitigated by deactivating the lost badge, whereas the open door creates an immediate, ongoing vulnerability. Option B is wrong because while violating badge policy is a compliance issue, the core security concern is the operational bypass of access control, not the policy violation itself. Option D is wrong because the door lock breaking from being forced open is a mechanical maintenance issue, not an immediate security threat—the primary risk is unauthorized entry, not equipment damage.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall controls network traffic and does not encrypt or protect data at rest on the drive; it cannot prevent access to data if the drive is physically stolen. Option C is wrong because a strong user password protects the user account at the OS level, but if the drive is already unlocked (as in this scenario), the password does not encrypt the data—an attacker could bypass the login screen by booting from external media or accessing the drive directly. Option D is wrong because System Restore creates restore points for system files and settings, not encryption; it has no mechanism to prevent data access from a stolen, unlocked drive.

Why this answer

How to eliminate wrong answers

Option A is wrong because the CPU is not identified as the bottleneck; the symptom of high memory usage points to RAM, and a faster processor would not relieve memory pressure. Option B is wrong because while an SSD would improve overall responsiveness, the primary bottleneck indicated by 90%+ memory usage is RAM, and an SSD does not reduce memory consumption. Option D is wrong because graphics card bottlenecks manifest as rendering or gaming performance issues, not slow application opening with high memory utilization.

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows System Image Manager (Windows SIM) is used to create and manage unattended answer files (Unattend.xml), not to perform network-based deployments or automate domain join and naming during deployment. Option C is wrong because Microsoft Deployment Toolkit (MDT) is a deployment solution that can automate domain join and naming, but it is not a deployment tool itself; it relies on WDS or other media for network boot and is typically used for more complex task sequences, not for simple automated domain join and naming. Option D is wrong because Sysprep is a system preparation tool used to generalize a Windows image (remove unique identifiers like SID and computer name) so it can be imaged to multiple computers; it does not automate domain join or assign unique names during deployment.

Why this answer

How to eliminate wrong answers

Option A is wrong because a for loop that iterates over all services is inefficient and unnecessary; the requirement is to check only one specific service, not all services. Option C is wrong because a switch statement is designed for multiple discrete value matches, not for a simple binary check of a service status (running vs. stopped), and it would overcomplicate the logic. Option D is wrong because a try-catch block handles runtime errors (e.g., service not found or access denied) but does not provide conditional logic to check the service status before deciding whether to start it.

Why this answer

How to eliminate wrong answers

Option A is wrong because System > Advanced system settings is used for performance options, user profiles, and startup and recovery settings, not for accessibility features like Magnifier or high-contrast themes. Option C is wrong because Personalization allows changing themes and colors, but it does not provide the option to set Magnifier to start automatically at login; high-contrast themes can be applied there, but the automatic startup of Magnifier is exclusive to the Ease of Access Center. Option D is wrong because Display settings manage screen resolution, orientation, and multiple displays, but do not include accessibility features such as Magnifier auto-start or high-contrast theme configuration.

Why this answer

How to eliminate wrong answers

Option A is wrong because LCD monitors may contain small amounts of mercury in cold-cathode fluorescent lamp (CCFL) backlights, but they are not universally classified as requiring separate hazardous handling in the same way as CRTs; many jurisdictions allow them in general e-waste streams if mercury is removed. Option C is wrong because keyboards and mice are typically non-hazardous electronic waste composed of plastic and low-voltage circuitry, with no regulated hazardous materials like lead, mercury, or cadmium. Option D is wrong because Ethernet cables are copper or fiber optic cabling with no hazardous materials; they are recyclable as standard e-waste or scrap metal.

Why this answer

How to eliminate wrong answers

Option A is wrong because a misconfigured virtual switch would cause network connectivity issues (e.g., dropped packets, inability to reach resources), not generalized slowness across all VMs due to high memory pressure. Option C is wrong because a guest OS driver update might improve device performance or fix specific hardware compatibility issues, but it would not resolve host-level memory exhaustion affecting all VMs simultaneously. Option D is wrong because thin provisioning affects storage space utilization and can lead to performance issues if the datastore runs out of space, but it does not directly cause high host memory utilization or CPU usage; the reported metrics point to memory, not storage.

Why this answer

How to eliminate wrong answers

Option A is wrong because BitLocker Drive Encryption provides full-disk encryption to protect data at rest and does not block write access to the Program Files folder; it operates at the disk level, not the file system permission level. Option C is wrong because Windows Defender Firewall controls network traffic based on rules and does not restrict local file system write operations. Option D is wrong because Group Policy Software Restrictions can block installation of specific software based on path, hash, or certificate rules, but the scenario describes a generic inability to write to Program Files after an update, which is a classic symptom of UAC virtualization behavior, not a targeted restriction policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because Settings > General > iPhone Storage manages storage space, not battery performance or thermal behavior, and would not identify a battery health issue. Option C is wrong because Settings > Privacy > Analytics & Improvements contains diagnostic logs for developers and Apple, not a user-facing tool for immediate battery drain troubleshooting. Option D is wrong because Settings > Display & Brightness controls screen brightness, auto-lock, and True Tone, which affect battery life indirectly but do not diagnose the root cause of unexpected drain or overheating.

Why this answer

How to eliminate wrong answers

Option A is wrong because updating antivirus signatures only adds known malware hashes or patterns, which cannot match the constantly changing code of polymorphic malware; signature-based detection is inherently ineffective against zero-day threats. Option B is wrong because a bootable rescue disk still relies on the same signature database or heuristic engine of the installed antivirus; if the malware evades signature scans, booting from a rescue disk does not change the detection methodology. Option D is wrong because reinstalling the OS from a backup is a recovery measure, not a detection or removal technique; it does not identify or remove the malware and may reintroduce the infection if the backup is compromised.