Courseiva

CompTIA A+ Core 2 220-1202 (220-1202) — Questions 301–375

495 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 7

Page 6
301
MCQmedium

A user needs to connect to a work VPN but cannot find the VPN settings in the network tray. You need to guide them to the correct location to add a VPN connection. Where in Windows Settings would you direct them?

A.Network & Internet > Status
B.Network & Internet > Ethernet
C.Network & Internet > VPN
D.Network & Internet > Proxy
AnswerC

The "Network & Internet > VPN" section is the correct and dedicated interface within Windows settings for managing Virtual Private Network connections. This page allows users to add new VPN profiles, configure essential connection details such as the VPN server address, select the appropriate VPN type (e.g., IKEv2, L2TP/IPsec), specify authentication methods, and then initiate or disconnect from these secure tunnels. It provides the comprehensive controls necessary for establishing secure remote access to a private network.

Why this answer

The VPN settings in Windows are located under Network & Internet > VPN. This is the dedicated section where users can add, configure, and manage VPN connections, including setting up a new VPN profile with the server address, authentication method, and protocol (e.g., IKEv2, SSTP, or L2TP/IPsec). The network tray only shows existing connections; to add a new VPN, you must navigate to this specific settings page.

Exam trap

The trap here is that candidates may confuse the network tray's quick-access VPN list with the actual settings location, or assume VPN configuration is under Status or Ethernet due to its association with network connectivity, but Windows isolates VPN setup under a dedicated VPN page.

How to eliminate wrong answers

Option A is wrong because Network & Internet > Status displays the current network status, data usage, and network properties, but does not provide options to add or configure VPN connections. Option B is wrong because Network & Internet > Ethernet is used for managing wired Ethernet adapter settings, such as IP configuration and DNS, and has no VPN-related functionality. Option D is wrong because Network & Internet > Proxy is for configuring proxy server settings (e.g., automatic or manual proxy setup), which is unrelated to VPN connection management.

Full explanation →
302
MCQmedium

A technician is setting up a new workstation in a cubicle. The user complains of eye strain and glare from the overhead lights. Which environmental adjustment should the technician recommend first?

A.Replace the overhead fluorescent tubes with LED bulbs.
B.Apply a matte screen filter to the monitor.
C.Rotate the monitor 90 degrees so the light hits the side of the screen.
D.Increase the monitor's brightness to overpower the glare.
AnswerC

Rotating the monitor 90 degrees effectively changes the angle at which the overhead light strikes the screen, directing the reflected glare away from the user's line of sight. Glare occurs when a light source's reflection is directly visible, so repositioning the display perpendicular to the light source minimizes this direct reflection. This is a fundamental, zero-cost ergonomic adjustment that directly addresses the root cause of reflective glare.

Why this answer

Glare from overhead lighting is a common cause of eye strain. The simplest and most effective fix is to reposition the monitor so that the light source is perpendicular to the screen, reducing direct glare.

Full explanation →
303
MCQmedium

During a security audit, you discover that a supply closet containing spare hard drives has a door that can be opened with a standard paperclip. What is the most appropriate recommendation to address this vulnerability?

A.Replace the door with a solid-core door and install a deadbolt.
B.Install a privacy filter on the closet door window.
C.Upgrade the lock to a tamper-resistant electronic lock.
D.Place a sign on the door warning of security cameras.
AnswerC

Upgrading to a tamper-resistant electronic lock directly addresses the 'paperclip vulnerability' by replacing or augmenting the susceptible mechanical components with secure electronic mechanisms. These locks often utilize digital authentication methods (e.g., keypads, RFID, biometrics) and are engineered to resist manipulation and bypass attempts that exploit traditional lock-picking techniques. This solution provides a robust physical security control specifically designed to prevent unauthorized access through lock compromise.

Why this answer

The vulnerability is a weak physical lock that can be bypassed with a simple tool. Upgrading to a tamper-resistant electronic lock, such as one with a keypad or biometric reader, significantly increases the difficulty of unauthorized entry. This directly addresses the core issue of inadequate access control for sensitive assets like spare hard drives.

Exam trap

CompTIA A+ often tests the distinction between deterrent controls (signs, cameras) and preventive controls (locks, access control systems), leading candidates to choose a visible but ineffective option like a warning sign instead of a technical fix.

How to eliminate wrong answers

Option A is wrong because replacing the door and installing a deadbolt is an over-engineered solution that does not specifically address the lock vulnerability; a deadbolt can still be picked or bypassed with a paperclip if the lock cylinder is weak. Option B is wrong because a privacy filter on the window only prevents visual observation, not physical access, and does nothing to secure the door lock. Option D is wrong because a warning sign is a deterrent, not a physical control; it does not prevent an attacker from using a paperclip to open the door.

Full explanation →
304
MCQmedium

A user reports that their Windows 10 PC displays a 'Low Disk Space' warning on the C: drive. You want to use a built-in tool to delete temporary files and empty the Recycle Bin. Which Settings page should you open?

A.System > Storage
B.System > About
C.Apps > Apps & features
D.Update & Security > Windows Update
AnswerA

The "System > Storage" section in Windows 10 Settings is the correct location for managing disk space. It provides a comprehensive overview of how storage is being utilized by different content categories, such as apps, temporary files, and documents. Crucially, this page offers direct access to initiate Storage Sense for automatic cleanup or to manually review and delete temporary files, system logs, and previous Windows installation files, directly addressing the need to free up disk space.

Why this answer

The 'Low Disk Space' warning on the C: drive can be resolved by using the built-in Storage Sense or the manual 'Free up space now' feature, both accessible under System > Storage. This page provides tools to delete temporary files, empty the Recycle Bin, and remove other unnecessary data to reclaim disk space without third-party software.

Exam trap

The trap here is that candidates may confuse the 'System > About' page (which shows system info) with the 'System > Storage' page (which manages disk space), or think that 'Apps & features' can delete temporary files, when it only uninstalls applications.

How to eliminate wrong answers

Option B (System > About) is wrong because it displays system information such as device specifications, Windows edition, and OS build, but does not include any tools for disk cleanup or file management. Option C (Apps > Apps & features) is wrong because it allows users to uninstall or manage installed applications, but does not provide direct access to delete temporary files or empty the Recycle Bin. Option D (Update & Security > Windows Update) is wrong because it manages Windows updates and recovery options, not temporary file cleanup or Recycle Bin management.

Full explanation →
305
MCQeasy

A customer reports that after a recent software update, their accounting application crashes every time they try to generate a report. The technician checks the change log and finds no record of any update being approved for that application. What should the technician do first?

A.Restore the application from the last known good backup.
B.Document the unauthorized change and escalate it to the change advisory board.
C.Uninstall the update and reinstall the previous version of the application.
D.Contact the software vendor to request a patch for the crash.
AnswerB

Documenting the unauthorized change and escalating it to the Change Advisory Board (CAB) is the correct initial step according to CompTIA A+ and ITIL best practices. This ensures that the unapproved modification is formally recorded, allowing for proper review, impact assessment, and a structured decision-making process before any corrective actions are implemented. This approach maintains accountability, reinforces change control policies, and helps prevent similar incidents in the future by addressing the process failure.

Why this answer

The technician found an unauthorized change (the update) with no approval record. The first step in change management is to document and escalate the unauthorized change to the Change Advisory Board (CAB) to assess impact, determine root cause, and authorize remediation. Restoring or reinstalling without CAB approval could violate change control policies and introduce additional risks.

Exam trap

CompTIA often tests the distinction between technical troubleshooting and process compliance, trapping candidates who jump to a technical fix (restore, uninstall, or patch) instead of following the documented change management procedure.

How to eliminate wrong answers

Option A is wrong because restoring from backup without first documenting and escalating the unauthorized change bypasses the change management process and could reintroduce the same issue if the backup also contains the unauthorized update. Option C is wrong because uninstalling the update and reinstalling the previous version is a technical action that should only be performed after the CAB has reviewed and approved the remediation plan, as it may affect other dependencies or compliance. Option D is wrong because contacting the vendor for a patch assumes the crash is a known software defect, but the root cause is an unauthorized change that must be addressed through change management first, not a vendor-supported fix.

Full explanation →
306
MCQmedium

A company is upgrading its network switches and has 10 old switches that still work. The local school district has requested donations of working equipment. What should the technician do?

A.Throw the switches in the company dumpster.
B.Donate the switches to the school district.
C.Send the switches to a recycler even though they work.
D.Keep the switches in storage indefinitely.
AnswerB

Donation is the best option because it reuses functional equipment and benefits the community.

Why this answer

Donating the switches to the school district aligns with the principle of reuse, which is the most environmentally responsible option before recycling or disposal. The switches are still functional, so extending their lifecycle reduces e-waste and benefits the community. This practice supports the waste hierarchy: reduce, reuse, recycle.

Exam trap

CompTIA often tests the distinction between recycling and reuse, where candidates mistakenly choose recycling as the 'green' option, but the exam emphasizes that reuse is always preferable for still-functional equipment.

How to eliminate wrong answers

Option A is wrong because throwing functional switches in a dumpster violates environmental regulations and contributes to e-waste, which can leach hazardous materials like lead and mercury into the soil. Option C is wrong because sending working switches directly to a recycler bypasses the preferred option of reuse, which is more environmentally sustainable and energy-efficient than recycling. Option D is wrong because keeping the switches in storage indefinitely wastes potential utility and space, and does not align with responsible asset disposition or environmental stewardship.

Full explanation →
307
MCQmedium

During a security audit, a technician discovers that an employee used a hammer to destroy several old hard drives. The drives are now in pieces, but the organization's policy mandates 'secure data destruction' for compliance. Which additional step should the technician take?

A.Document the destruction and consider it complete.
B.Use a degausser on the remaining pieces.
C.Visually inspect the platters for scratches and breaks, then shred any intact platters.
D.Run a data recovery tool on the pieces to see if data remains.
AnswerC

Visually inspecting the platters is a crucial step to confirm that the data-bearing surfaces have been sufficiently damaged, such as by deep scratches or complete breakage. If any platters remain intact or only partially compromised, data recovery could still be possible. Shredding any remaining intact platters ensures complete physical destruction, rendering data unrecoverable and providing undeniable proof of destruction, which is essential for meeting stringent security and compliance standards.

Why this answer

To verify the destruction by inspecting the platters for visible damage and ensuring they are not intact. Hammering may leave platters partially readable. This question tests the concept of verification in data destruction, as physical methods must be confirmed effective.

Full explanation →
308
MCQmedium

A company's security policy mandates that all USB flash drives must be encrypted before use. A user inserts a new USB drive and wants to encrypt it on a Windows 10 Pro workstation. Which built-in tool should be used?

A.Use EFS (Encrypting File System) on the USB drive.
B.Enable BitLocker To Go on the USB drive.
C.Format the drive as exFAT and set a password.
D.Use the cipher command to encrypt the drive.
AnswerB

Enabling BitLocker To Go on the USB drive is the most appropriate solution for encrypting removable media to meet a company's security policy. BitLocker To Go provides full-disk encryption specifically designed for portable storage devices, ensuring all data on the drive is encrypted at rest. It is a robust, built-in feature of Windows Pro and Enterprise editions, offering strong protection and requiring a password or smart card for access, even if the drive is lost or stolen.

Why this answer

BitLocker To Go is the built-in Windows 10 Pro feature specifically designed to encrypt removable drives such as USB flash drives. It uses AES encryption to protect the entire volume, and the drive can be accessed only with a password, smart card, or recovery key. This directly satisfies the company's mandate for encrypting USB drives before use.

Exam trap

CompTIA often tests the distinction between EFS (file-level encryption) and BitLocker (full-volume encryption), and the trap here is that candidates mistakenly choose EFS because they associate 'encryption' with file-level protection, not realizing that EFS cannot encrypt an entire removable drive and is not designed for USB flash drives.

How to eliminate wrong answers

Option A is wrong because EFS (Encrypting File System) encrypts individual files and folders on NTFS volumes, but it does not encrypt entire removable drives and is not supported on USB flash drives formatted with FAT32 or exFAT. Option C is wrong because formatting as exFAT and setting a password is not a built-in Windows encryption feature; exFAT does not natively support password-based encryption, and any such password would be implemented by third-party software, not Windows. Option D is wrong because the cipher command is used to manage EFS encryption on NTFS volumes and to overwrite deleted data; it cannot encrypt an entire USB drive or enable BitLocker To Go.

Full explanation →
309
MCQeasy

A user reports that their Windows 10 laptop shows a 'Your license will expire soon' watermark on the desktop. They recently replaced the motherboard. Which Control Panel applet should you use to re-activate Windows?

A.Device Manager
B.System
C.User Accounts
D.Network and Sharing Center
AnswerB

The 'System' section, accessible via Control Panel or the Settings app in Windows 10, is the definitive location for viewing the operating system's core information. Here, users can find details about their Windows edition, processor, installed RAM, and crucially, the Windows activation status. It provides direct links to change the product key, activate Windows using a digital license, or troubleshoot activation issues, making it the correct utility for this task.

Why this answer

The System applet (also known as 'System Properties' or 'About' in Settings) is the correct Control Panel location to view and manage Windows activation status. After replacing the motherboard, Windows 10 detects a significant hardware change and may require re-activation. The System applet provides a 'Change product key' or 'Activate Windows' link to enter a new or existing license key, or to use the activation troubleshooter to re-activate with a digital license tied to a Microsoft account.

Exam trap

CompTIA often tests the misconception that Device Manager is used for activation because it deals with hardware changes, but Device Manager only manages drivers, not licensing.

How to eliminate wrong answers

Option A (Device Manager) is wrong because it is used to manage hardware drivers and devices, not to handle Windows licensing or activation. Option C (User Accounts) is wrong because it manages user profiles, passwords, and credentials, not the operating system's license activation. Option D (Network and Sharing Center) is wrong because it configures network adapters, sharing settings, and internet connections, none of which are involved in the Windows activation process.

Full explanation →
310
MCQeasy

A small business owner asks you to configure their office computers so that employees cannot install unauthorized browser extensions. Which policy setting should you implement?

A.Disable the browser's developer mode in the settings.
B.Set the browser to always use private browsing mode.
C.Use Group Policy to block extension installation and whitelist approved extensions.
D.Install a pop-up blocker on each computer.
AnswerC

Utilizing Group Policy (GPO) provides a robust, centralized management solution for Windows environments, allowing administrators to precisely control browser settings across multiple machines. By configuring specific GPO settings, an administrator can enforce policies that block all extension installations by default, while simultaneously whitelisting only approved extensions necessary for business operations. This method ensures consistent security and compliance by preventing unauthorized software from being introduced into the browser environment.

Why this answer

Group Policy allows centralized management of browser settings in a domain environment. By configuring the 'Configure the list of force-installed extensions' and 'Block external extensions' policies, an administrator can whitelist approved extensions and prevent users from installing any others. This directly addresses the requirement to block unauthorized browser extensions.

Exam trap

CompTIA often tests the distinction between user-configurable browser settings (like disabling developer mode or enabling private browsing) and centrally enforced Group Policy settings that cannot be overridden by the user.

How to eliminate wrong answers

Option A is wrong because disabling developer mode only prevents access to developer tools and does not block extension installation; extensions can still be installed via the Chrome Web Store or other methods. Option B is wrong because private browsing mode (Incognito) does not restrict extension installation; it only prevents browsing history from being saved locally. Option D is wrong because a pop-up blocker only suppresses unwanted pop-up windows and has no effect on the installation or management of browser extensions.

Full explanation →
311
MCQeasy

A user is unable to install a new app on their Android tablet because the device claims there is 'insufficient storage,' even though they have deleted several large files. What is the most likely reason for this error?

A.The device's SD card is corrupted.
B.The app is incompatible with the Android version.
C.The deleted files are still in the recycle bin or trash folder, taking up space.
D.The tablet's battery is too low to complete the installation.
AnswerC

Many contemporary Android versions and third-party file management applications incorporate a "recycle bin" or "trash" feature, akin to desktop operating systems. When files are initially "deleted," they are often moved to this temporary holding area instead of being permanently erased from storage immediately. These files continue to occupy valuable storage space until the recycle bin is manually emptied, which is a critical step to truly free up the necessary space for new application installations.

Why this answer

On Android devices, deleted files are moved to a recycle bin or trash folder (e.g., in the Files by Google app or the Gallery app's trash), not permanently erased. The system still counts these files as occupied storage until the trash is emptied, so even after deleting large files, the available space remains unchanged, causing the 'insufficient storage' error during app installation.

Exam trap

CompTIA often tests the misconception that deleting files immediately frees up space, ignoring the recycle bin/trash mechanism that is standard on modern Android devices.

How to eliminate wrong answers

Option A is wrong because a corrupted SD card would typically cause read/write errors or the card to be unmountable, not a specific 'insufficient storage' message; the error is about space, not card integrity. Option B is wrong because app incompatibility with the Android version usually triggers a 'not compatible' or 'app not installed' error, not a storage-related message. Option D is wrong because low battery prevents installation due to power-saving policies, but the error message would be about battery level, not storage space.

Full explanation →
312
MCQmedium

A technician is tasked with disposing of a large batch of optical discs (CD-Rs and DVD-Rs) that contain archived customer records. The company policy requires data to be unrecoverable. Which disposal method is most appropriate?

A.Use a degausser to demagnetize the discs.
B.Overwrite the discs with a disk-wiping tool.
C.Shred the discs using an industrial cross-cut shredder.
D.Perform a quick format on the discs.
AnswerC

Shredding optical discs with an industrial cross-cut shredder is a highly effective and secure method for data destruction. This process physically breaks the disc into numerous small, irregular fragments, completely destroying the data layer where information is stored as pits and lands. The cross-cut action ensures that no large contiguous sections of the data track remain intact, making any attempt at data recovery practically impossible and extremely cost-prohibitive. This method provides irreversible physical destruction.

Why this answer

Industrial cross-cut shredding physically destroys the optical discs (CD-Rs and DVD-Rs), rendering the data unrecoverable. Unlike magnetic media, optical discs store data as physical pits in a dye layer, so degaussing or overwriting is ineffective. Shredding ensures compliance with data destruction policies requiring unrecoverable data.

Exam trap

The trap here is that candidates confuse optical discs with magnetic media and assume degaussing or overwriting works, but the CompTIA A+ exam tests the fundamental difference that optical storage is physically permanent and requires physical destruction.

How to eliminate wrong answers

Option A is wrong because degaussers work by disrupting magnetic fields on magnetic media (e.g., hard drives, tapes), but optical discs like CD-Rs and DVD-Rs store data optically, not magnetically, so demagnetization has no effect. Option B is wrong because overwriting with a disk-wiping tool is designed for rewritable media (e.g., CD-RW, DVD-RW) and cannot alter the read-only dye layer of CD-Rs or DVD-Rs; the data remains physically intact. Option D is wrong because a quick format only removes the file system index, leaving the actual data on the disc fully recoverable with forensic tools.

Full explanation →
313
MCQhard

A security audit reveals that a company's remote access solution uses a VPN with pre-shared keys (PSK) for authentication. The auditor recommends upgrading to certificate-based authentication. Which of the following is the primary security advantage of certificate-based authentication over PSK?

A.Certificates are easier to configure and manage than PSK.
B.Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users.
C.Certificates eliminate the need for a VPN server.
D.Certificates are faster than PSK for establishing VPN connections.
AnswerB

Certificate-based authentication provides robust mutual authentication, where both the client and the VPN server verify each other's identities using digital certificates issued by a trusted Certificate Authority. Each certificate is unique to a specific device or user, meaning that if one device's certificate is compromised, only that single certificate needs to be revoked. This prevents a widespread security breach that would occur if a shared pre-shared key (PSK) were compromised, which would affect all users.

Why this answer

Certificate-based authentication provides mutual authentication, meaning both the VPN client and server verify each other's identity using digital certificates issued by a trusted Certificate Authority (CA). Unlike PSK, which is a shared secret that can be leaked and reused across all devices, each certificate is unique per device, so compromise of one certificate does not expose the entire VPN infrastructure. This significantly reduces the blast radius of a security breach and aligns with the principle of least privilege.

Exam trap

CompTIA often tests the misconception that certificates are 'easier' or 'faster' than PSK, when in reality the primary security advantage is mutual authentication and per-device uniqueness, not operational simplicity or performance.

How to eliminate wrong answers

Option A is wrong because certificates are generally more complex to configure and manage than PSK, requiring a PKI infrastructure, CA servers, and certificate lifecycle management, whereas PSK is a simple shared string. Option C is wrong because certificates do not eliminate the need for a VPN server; the VPN server is still required to terminate the tunnel and enforce policies, regardless of the authentication method. Option D is wrong because certificate-based authentication often introduces additional latency due to certificate validation, CRL checks, and OCSP lookups, making it typically slower than PSK for establishing VPN connections.

Full explanation →
314
MCQmedium

A technician is replacing the thermal paste on a CPU. After cleaning the old paste, the technician accidentally touches the CPU contacts with bare fingers. What is the primary concern?

A.The CPU may be damaged by electrostatic discharge (ESD).
B.The CPU may overheat due to improper thermal paste application.
C.The CPU contacts may become contaminated with oils from the skin.
D.The CPU may be physically damaged by the pressure of the touch.
AnswerC

Human skin naturally produces oils, salts, and other residues that can easily transfer to the delicate electrical contacts of a CPU when touched with bare fingers. These contaminants can create an insulating layer, impeding proper electrical conductivity between the CPU and its socket. Over time, these residues can also lead to corrosion of the metallic contacts, resulting in intermittent connections, system instability, or complete failure of the CPU or motherboard.

Why this answer

Touching the CPU contacts with bare fingers transfers natural oils and contaminants from the skin onto the gold-plated contact pads. These oils can cause corrosion over time or create an insulating layer that impedes proper electrical connectivity, leading to intermittent failures or permanent damage. The primary concern is contamination, not ESD, overheating, or physical pressure.

Exam trap

CompTIA often tests the distinction between immediate ESD damage and long-term contamination risks, trapping candidates who assume any physical contact with components must be an ESD concern rather than recognizing the specific hazard of skin oils on electrical contacts.

How to eliminate wrong answers

Option A is wrong because while ESD is a general risk when handling components, the question specifies that the technician touched the contacts after cleaning, and the primary concern from skin contact is oil contamination, not ESD (which is mitigated by grounding). Option B is wrong because improper thermal paste application affects heat transfer from the IHS to the cooler, not the CPU contacts; touching contacts does not directly cause overheating. Option D is wrong because the pressure from a light touch is negligible and far below the force required to physically damage the CPU contacts or substrate.

Full explanation →
315
MCQmedium

A small business has a shared Windows 10 workstation that multiple employees use. They want to ensure that each user's desktop settings, files, and application data are completely isolated and that users cannot access each other's data. Which feature should you configure to achieve this?

A.Enable the built-in Guest account for all users.
B.Create standard local user accounts and set NTFS permissions on each user's profile folder.
C.Join the computer to a domain and use roaming profiles.
D.Enable BitLocker on the system drive.
AnswerB

Creating standard local user accounts ensures each user has a distinct profile, preventing them from making system-wide changes that could affect other users or the operating system's stability. Crucially, setting explicit NTFS permissions on each user's profile folder (e.g., C:\Users\<username>) restricts access so that only the respective user and administrators can read or modify their data. This combination effectively isolates each user's files and settings, providing the necessary data privacy on a shared workstation.

Why this answer

Standard local user accounts with NTFS permissions provide isolation by default; each user has their own profile folder with restricted permissions. The other options either don't enforce isolation (guest account) or are for different purposes (domain, BitLocker).

Full explanation →
316
MCQhard

A security incident is reported: an employee's company-issued Android phone is displaying persistent pop-up ads, even when no browser is open. The employee admits to side-loading a game from an unknown website. What is the most likely cause and best immediate action?

A.The phone has a virus; perform a factory reset immediately.
B.The side-loaded app is adware; boot into safe mode and uninstall it.
C.The browser is infected; clear the browser cache and data.
D.The phone's firmware is compromised; reflash the stock ROM.
AnswerB

Side-loaded applications, especially from untrusted sources, are a common vector for adware and other potentially unwanted programs on Android devices. Booting an Android device into safe mode temporarily disables all third-party applications, preventing the adware from running and interfering with its removal. This allows the user to safely navigate to the device's application settings and uninstall the malicious side-loaded app without it actively resisting or re-installing itself.

Why this answer

The persistent pop-up ads, even without a browser open, indicate adware behavior typical of malicious apps. Since the employee side-loaded a game from an unknown website, the most likely cause is that the side-loaded app contains adware. Booting into safe mode (which disables third-party apps) and uninstalling the suspicious app is the best immediate action because it removes the adware without data loss, unlike a factory reset.

Exam trap

CompTIA often tests the distinction between adware and a general virus, and the trap here is that candidates may jump to a factory reset (Option A) without considering the less destructive safe-mode uninstall, or they may incorrectly attribute the pop-ups to the browser (Option C) when the behavior occurs system-wide.

How to eliminate wrong answers

Option A is wrong because a 'virus' is a broad term; the specific symptom of pop-up ads points to adware, not a general virus, and a factory reset is an overly drastic first step that wipes all data unnecessarily. Option C is wrong because the pop-ups occur even when no browser is open, indicating the issue is not browser-based; clearing browser cache and data would not affect a system-level adware app. Option D is wrong because firmware compromise is rare and typically requires persistent root-level access; side-loading a game does not typically flash firmware, and reflashing the stock ROM is a last-resort measure that would wipe the device and is not the best immediate action.

Full explanation →
317
MCQmedium

A technician is troubleshooting an iPhone that fails to activate after a software update. The phone displays 'Activation Error' and the SIM card is known to be working. Which of the following steps should the technician perform FIRST?

A.Replace the SIM card with a new one.
B.Restore the iPhone using iTunes or Finder.
C.Check Apple's System Status page for activation server outages.
D.Reset the iPhone's network settings.
AnswerC

Checking Apple's System Status page is the most logical and efficient first step because iPhone activation fundamentally relies on communication with Apple's dedicated activation servers. If these servers are experiencing an outage or maintenance, no iPhone, regardless of its local condition, will be able to complete the activation process. Verifying server status quickly confirms whether the problem is external to the device, saving significant troubleshooting time and effort.

Why this answer

The 'Activation Error' after a software update typically indicates that the iPhone cannot reach Apple's activation servers to verify its eligibility. Since the SIM card is known to be working, the most logical first step is to check Apple's System Status page to rule out a server-side outage, which is a common cause of activation failures and can be resolved without any device-side intervention.

Exam trap

CompTIA often tests the candidate's ability to prioritize simple, non-invasive checks (like server status) over more disruptive troubleshooting steps, and the trap here is that many candidates jump to restoring the device or replacing hardware without first verifying external dependencies.

How to eliminate wrong answers

Option A is wrong because the SIM card is already confirmed to be working, so replacing it would be unnecessary and would not address a server-side activation issue. Option B is wrong because restoring the iPhone using iTunes or Finder is a more drastic step that should be taken only after confirming that Apple's activation servers are online; a restore could also fail if the servers are down. Option D is wrong because resetting network settings would not help if the activation servers themselves are unavailable; this step is more appropriate for connectivity issues unrelated to server outages.

Full explanation →
318
MCQmedium

A user's laptop running Windows 10 Pro connects to the corporate Wi-Fi but cannot access internal resources. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The laptop's wireless profile is configured correctly. Other users in the same office can access resources. What is the most likely cause?

A.The laptop's wireless adapter is faulty.
B.The user's domain account is locked or the password has expired.
C.The access point is broadcasting on a congested channel.
D.The laptop has an incorrect IP address from DHCP.
AnswerB

In an enterprise environment, Wi-Fi authentication often leverages 802.1X, which typically uses protocols like PEAP-MSCHAPv2 to validate user credentials against a central directory service, such as Active Directory. If the user's domain account is locked or their password has expired, the authentication server (e.g., a RADIUS server) will reject the authentication request. This prevents the user from gaining full network access and obtaining a valid IP address, even if the laptop successfully associates with the access point's signal.

Why this answer

The user can connect to Wi-Fi but cannot access internal resources, and other users are unaffected. Since the wireless profile is correct and WPA2-Enterprise uses PEAP-MSCHAPv2 for authentication, the most likely cause is that the user's domain account is locked or the password has expired. This would prevent successful authentication against the RADIUS server, blocking access to internal resources even though the client associates with the access point.

Exam trap

The 220-1202 exam often tests the distinction between Layer 2 association and Layer 3 authentication; the trap here is that candidates assume a successful Wi-Fi connection implies full network access, overlooking that WPA2-Enterprise requires valid domain credentials for RADIUS-based authentication to grant access to internal resources.

How to eliminate wrong answers

Option A is wrong because a faulty wireless adapter would typically prevent association or cause intermittent connectivity, not allow a successful connection to the Wi-Fi network while blocking internal resource access. Option C is wrong because a congested channel would affect all users in the area, not just one user, and would manifest as poor performance or disconnections, not a complete inability to access internal resources. Option D is wrong because an incorrect IP address from DHCP would prevent network communication entirely, but the user can connect to the Wi-Fi and likely obtain an IP address; the issue is at the authentication layer, not the IP layer.

Full explanation →
319
MCQmedium

A technician is tasked with replacing a faulty power supply in a desktop computer that is part of a critical patient record system at a clinic. Before starting, the technician reviews the change management policy. Which step should the technician perform first?

A.Power off the workstation and disconnect all cables
B.Submit a change request to the change advisory board (CAB)
C.Back up the patient records to an external drive
D.Notify the clinic staff that the system will be offline
AnswerB

Submitting a change request to the Change Advisory Board (CAB) is the correct initial step in a formal IT change management process. This ensures that the proposed replacement of a faulty component is properly documented, reviewed for potential risks and impacts, and scheduled to minimize disruption. The CAB's approval provides the necessary authorization and coordination before any physical work or further planning commences.

Why this answer

The change management policy requires that any modification to a system handling critical patient records must first be formally approved via a change request submitted to the Change Advisory Board (CAB). This ensures that risks are assessed, downtime is scheduled, and compliance with healthcare data regulations (e.g., HIPAA) is maintained before any physical work begins.

Exam trap

CompTIA often tests the misconception that immediate physical safety steps (like powering off) or data backup should come first, but the exam emphasizes that change management approval is the mandatory initial step in any planned maintenance on a critical system.

How to eliminate wrong answers

Option A is wrong because powering off and disconnecting cables before obtaining change approval violates the change management process, potentially causing unauthorized downtime and data access risks. Option C is wrong because backing up patient records is a data protection step that should be performed after the change is approved, not before; the technician must first secure authorization to proceed. Option D is wrong because notifying clinic staff of an outage without prior CAB approval could disrupt critical operations and bypass the formal communication and scheduling protocols required by the change management policy.

Full explanation →
320
MCQmedium

A small business owner wants to prevent employees from installing any software on their Windows 10 workstations without administrator approval. Which Control Panel or Settings feature should you configure to enforce this restriction?

A.Windows Defender Firewall
B.User Accounts > Change User Account Control settings
C.System > Advanced system settings > Performance
D.Ease of Access > Make the keyboard easier to use
AnswerB

User Account Control (UAC) is a critical security feature in Windows designed to prevent unauthorized changes to the operating system. By setting UAC to 'Always notify' or a similar elevated level, any attempt to install software, modify system files, or alter settings that require administrative privileges will trigger a prompt. This prompt requires an administrator's explicit consent, effectively blocking standard users from installing applications without approval.

Why this answer

User Account Control (UAC) settings, accessed via User Accounts in Control Panel, allow you to control when and how users are prompted for permission before making system changes, including software installations. By setting UAC to the highest level, you ensure that any installation attempt triggers an administrator approval prompt, effectively preventing unauthorized software installations on Windows 10 workstations.

Exam trap

The trap here is that candidates often confuse Windows Defender Firewall with general security controls, mistakenly thinking it can block software installations, when in fact it only filters network traffic and has no mechanism to prevent local software execution.

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall is designed to control inbound and outbound network traffic based on rules, not to manage software installation permissions or user privilege elevation. Option C is wrong because System > Advanced system settings > Performance configures visual effects, processor scheduling, and virtual memory, which have no bearing on software installation restrictions. Option D is wrong because Ease of Access > Make the keyboard easier to use provides accessibility features like Sticky Keys and Filter Keys, which do not enforce software installation policies.

Full explanation →
321
MCQhard

A user reports that their computer is sending out a large amount of network traffic even when they are not using the internet. The antivirus detects a file named 'expl0rer.exe' in the startup folder. What type of malware is most likely causing this behavior?

A.Spyware
B.Botnet
C.Virus
D.Trojan
AnswerB

A botnet infection turns a user's computer into a "bot" or "zombie" machine, remotely controlled by an attacker. These bots are then used to participate in coordinated malicious activities, such as Distributed Denial of Service (DDoS) attacks, sending spam emails, or cryptocurrency mining. These activities inherently generate significant and sustained outbound network traffic as the compromised machine actively engages in these operations, making it the most fitting answer for a computer 'sending out' a lot of data.

Why this answer

The file name 'expl0rer.exe' mimics the legitimate 'explorer.exe' but uses a zero in place of the 'o', a common obfuscation technique. The symptom of high outbound network traffic without user activity, combined with the file's presence in the startup folder, strongly indicates the computer is part of a botnet. Botnet malware connects to a command-and-control (C2) server to receive instructions, often used for DDoS attacks or spam relays, which generates constant network activity.

Exam trap

The trap here is that candidates may confuse 'botnet' with 'trojan' because both can be installed stealthily, but the question's emphasis on sustained network activity is the key differentiator for botnet behavior.

How to eliminate wrong answers

Option A is wrong because spyware primarily focuses on stealthily collecting personal information (e.g., keystrokes, browsing habits) and typically does not generate large volumes of outbound traffic unless exfiltrating data, which is not the primary symptom here. Option C is wrong because a virus requires a host file to attach to and usually spreads by infecting other files, not by placing a standalone executable in the startup folder; the high network traffic is more characteristic of C2 communication than viral replication. Option D is wrong because a Trojan disguises itself as legitimate software to trick users into installing it, but the key behavior of sustained, high-volume outbound traffic is a hallmark of botnet activity, not a typical Trojan payload.

Full explanation →
322
MCQeasy

A small business is upgrading its workstations and needs to dispose of 20 old hard drives that contain confidential payroll records. The company wants the lowest-cost method that ensures data cannot be recovered. Which disposal method should be recommended?

A.Use a degausser on each drive.
B.Perform a standard format on each drive.
C.Drill holes through the platters of each drive.
D.Reformat the drives and install a fresh OS.
AnswerC

Drilling holes directly through the platters of a hard disk drive causes irreversible physical damage to the magnetic surfaces where data is stored. This action physically destroys the integrity of the data tracks and sectors, rendering the data unreadable and unrecoverable by any means, including specialized forensic techniques. It is a highly effective and very low-cost method for secure data destruction, especially for a small business on a budget.

Why this answer

Drilling holes through the platters physically destroys the magnetic surfaces, making data recovery impossible without specialized cleanroom equipment. This is the lowest-cost method that guarantees destruction because it directly damages the storage medium beyond repair, unlike degaussing which may not work on modern SSDs or high-coercivity drives.

Exam trap

CompTIA A+ often tests the misconception that a standard format or OS reinstall permanently erases data, when in fact only a secure wipe (e.g., overwriting with zeros multiple times) or physical destruction ensures data is unrecoverable.

How to eliminate wrong answers

Option A is wrong because degaussers are expensive and may not effectively erase data from modern high-coercivity hard drives or SSDs, and they can damage the drive's electronics without guaranteeing complete data destruction. Option B is wrong because a standard format only removes the file system pointers, leaving the actual data intact on the platters, which can be easily recovered with data recovery software. Option D is wrong because reformatting and installing a fresh OS similarly only overwrites the file system metadata, not the underlying data, and does not prevent recovery using forensic tools.

Full explanation →
323
MCQeasy

A technician is tasked with disposing of several old CRT monitors from a client's office. What is the correct disposal method for these monitors?

A.Place them in the regular office trash for pickup.
B.Sell them to a scrap metal dealer.
C.Take them to a certified e-waste recycling facility.
D.Disassemble them and recycle the plastic and metal separately.
AnswerC

Taking old CRT monitors to a certified e-waste recycling facility is the correct and legally compliant method for disposal. These facilities possess the specialized equipment, trained personnel, and regulatory permits required to safely de-manufacture CRTs. They meticulously separate hazardous materials, such as leaded glass, mercury-containing components, and other heavy metals, ensuring they are processed or disposed of in an environmentally sound manner, preventing contamination and promoting material recovery.

Why this answer

CRT monitors contain hazardous materials such as lead, phosphor, and other heavy metals that pose environmental and health risks. Certified e-waste recycling facilities are equipped to safely dismantle and process these components in compliance with environmental regulations like the EPA's Resource Conservation and Recovery Act (RCRA). Option C is the correct disposal method because it ensures legal and environmentally responsible handling of e-waste.

Exam trap

CompTIA often tests the misconception that disassembling e-waste for recycling is acceptable for a technician, but the trap is that without proper training and equipment, disassembly of CRTs is dangerous and non-compliant with safety procedures.

How to eliminate wrong answers

Option A is wrong because placing CRT monitors in regular office trash violates hazardous waste disposal laws and can lead to environmental contamination from lead and other toxins. Option B is wrong because scrap metal dealers typically lack the certification and equipment to safely handle hazardous CRT components, and selling them may result in illegal export or improper disposal. Option D is wrong because disassembling CRT monitors without proper training and equipment can expose the technician to high-voltage capacitors, implosion risks, and toxic dust, and it is not a recommended or compliant disposal method for individuals without specialized certification.

Full explanation →
324
MCQhard

A technician is tasked with migrating a physical server running a legacy OS that does not support virtualization drivers. The technician needs to ensure the OS can boot and run in a virtual machine. Which of the following steps is most critical before performing the physical-to-virtual (P2V) conversion?

A.Increase the physical server's RAM before conversion
B.Ensure the legacy OS has the latest service pack installed
C.Use a P2V tool that can inject the correct HAL and storage drivers for the hypervisor
D.Create a full backup of the physical server
AnswerC

This is the critical step for a successful P2V migration, especially for legacy operating systems. A specialized P2V tool can inject the appropriate Hardware Abstraction Layer (HAL) and virtualized storage drivers directly into the captured disk image before the first boot on the hypervisor. This ensures the operating system can correctly identify and interact with the virtualized hardware components, such as the virtual disk controller, enabling it to boot successfully without encountering blue screens or boot device errors. Without these injected drivers, the OS would attempt to load drivers for the original physical hardware, leading to a boot failure.

Why this answer

Legacy OSes often lack drivers for virtualized hardware, so using a P2V tool that can inject the necessary HAL and storage drivers during conversion is essential. Without this, the VM will likely blue screen on boot. This tests advanced knowledge of P2V migration challenges and driver injection.

Full explanation →
325
MCQmedium

A technician is documenting a configuration change to a firewall rule that allows remote access for a new employee. The technician must ensure the documentation is clear for future audits. Which of the following is the most critical piece of information to include?

A.The exact date and time the rule was added.
B.The IP address of the new employee's remote location.
C.The business justification for the rule.
D.The name of the technician who made the change.
AnswerC

The business justification provides the critical "why" behind any configuration change, linking the technical action directly to an organizational need, policy, or problem resolution. This explanation is paramount for audit compliance, demonstrating adherence to security policies, and facilitating future reviews or troubleshooting by clearly articulating the intended purpose and expected outcome of the modification. It ensures the change aligns with strategic objectives and operational requirements.

Why this answer

Change management documentation must include the business justification to demonstrate that the change was authorized and necessary. Without a clear reason, auditors cannot verify that the firewall rule complies with organizational security policy or regulatory requirements. The business justification provides the context needed to distinguish legitimate changes from unauthorized or malicious modifications.

Exam trap

CompTIA often tests the principle that operational details (who, when, where) are less critical than the business justification in change management documentation, tempting candidates to choose the most concrete or easily recorded detail instead of the most audit-relevant one.

How to eliminate wrong answers

Option A is wrong because while the date and time are useful for tracking, they are not the most critical piece; auditors need the 'why' behind the change, not just the 'when'. Option B is wrong because the remote employee's IP address may be dynamic or subject to change, and including it without the business justification does not prove the rule was authorized; the justification is what validates the rule's purpose. Option D is wrong because the technician's name is secondary to the business justification; knowing who made the change is less important than understanding why the change was made, and auditors focus on authorization and necessity, not just attribution.

Full explanation →
326
MCQmedium

A customer reports that their Windows 11 PC is displaying a 'Low Disk Space' warning on the C: drive. You need to quickly free up space by removing temporary files and system cache. Which administrative tool should you use?

A.Defragment and Optimize Drives to consolidate free space.
B.Disk Cleanup to delete temporary files and system cache.
C.Computer Management > Disk Management to shrink the volume.
D.Event Viewer to clear application logs.
AnswerB

Disk Cleanup is the primary Windows utility designed to safely remove various types of unnecessary files that accumulate over time, directly freeing up significant disk space. This includes temporary internet files, system error memory dump files, Recycle Bin contents, temporary application files, and system cache files. By targeting these non-essential data elements, it effectively reclaims storage without impacting system functionality or user data.

Why this answer

Disk Cleanup (cleanmgr.exe) is the built-in tool for removing temporary files, system cache, and other unnecessary data. Storage Sense can automate this, but Disk Cleanup is the direct tool for manual cleanup. The other options do not clean temporary files.

Full explanation →
327
MCQmedium

During a software deployment, you need to create a script that runs automatically every time a user logs into their Windows 10 domain-joined computer. Which tool should you use to configure this task?

A.Task Scheduler
B.Group Policy Management Console
C.Local Group Policy Editor
D.Windows PowerShell ISE
AnswerA

Task Scheduler is the most appropriate Windows utility for creating a scheduled task that automatically executes a script for any user upon logon. It provides granular control over triggers, allowing for specific conditions like "At log on" for any user or a specific user, and can run with various privilege levels. This flexibility makes it ideal for reliably deploying per-user scripts that need to run during a software deployment, ensuring consistent execution.

Why this answer

Task Scheduler is the correct tool because it allows you to create a task that triggers on a specific event, such as user logon. You can set the trigger to 'At log on' for any user or a specific user, and the task will run automatically each time the user logs into the Windows 10 domain-joined computer. This is the native Windows mechanism for scheduling scripts or programs to run at logon without requiring additional configuration.

Exam trap

CompTIA often tests the distinction between tools that configure local machine behavior (Task Scheduler) versus tools that manage domain-wide policies (Group Policy Management Console), leading candidates to mistakenly choose GPMC for a local logon script task.

How to eliminate wrong answers

Option B (Group Policy Management Console) is wrong because it is used to manage Group Policy Objects (GPOs) across an Active Directory domain, not to schedule a local script to run at user logon; while you could deploy a logon script via GPO, the question specifies configuring the task directly on the computer, not centrally deploying it. Option C (Local Group Policy Editor) is wrong because it edits local Group Policy settings on a single machine, but it does not provide a direct way to schedule a script to run at logon; you would need to assign a logon script via the 'Scripts (Logon/Logoff)' policy, which is less flexible than Task Scheduler and does not allow event-based triggers like 'At logon' with specific conditions. Option D (Windows PowerShell ISE) is wrong because it is an integrated scripting environment for writing and debugging PowerShell scripts, not a tool for scheduling tasks; you would still need to use Task Scheduler or another scheduler to run the script automatically at logon.

Full explanation →
328
MCQmedium

A technician is troubleshooting a computer that displays a fake security alert claiming the system is infected and urging the user to call a toll-free number. The alert cannot be closed and appears on top of all other windows. What is the best removal approach?

A.End the process 'svchost.exe' in Task Manager.
B.Restart the computer and press F8 to boot into Safe Mode with Networking, then run a malware scan.
C.Call the toll-free number to get help removing the alert.
D.Use System Restore to revert to a previous restore point.
AnswerB

Restarting the computer into Safe Mode with Networking is the most effective initial step for malware removal. Safe Mode loads only the essential drivers and services, preventing most malware, including scareware, from executing and interfering with cleanup efforts. The 'with Networking' option is crucial as it allows the system to access network resources, enabling the technician to update antivirus definitions, download necessary removal tools, and perform a comprehensive scan without the malware actively running.

Why this answer

This is a tech support scam, a form of scareware that uses a persistent pop-up. Booting into Safe Mode with Networking allows the technician to run an anti-malware scan without the rogue process interfering. Safe Mode loads only essential drivers, preventing the scareware from starting.

Full explanation →
329
MCQhard

A company's security policy requires that all laptops returned by employees be sanitized before redeployment. A technician uses a degausser on a laptop's SSD. What is the likely outcome?

A.The SSD is completely erased and ready for reuse.
B.The SSD is physically destroyed and unusable.
C.The SSD is unaffected and still contains data.
D.The laptop's BIOS is reset.
AnswerB

Degaussing can damage the SSD's controller and make the drive inoperable, but it does not guarantee data erasure.

Why this answer

A degausser generates a powerful magnetic field to erase data from magnetic media. SSDs (Solid State Drives) store data in NAND flash memory cells, which are not magnetic. The intense magnetic field from a degausser induces high currents in the SSD's internal circuitry, physically destroying the controller and memory chips, rendering the drive completely unusable.

Exam trap

The trap here is that candidates assume degaussing works on all storage devices, but CompTIA tests the distinction between magnetic media (HDDs) and solid-state media (SSDs), where degaussing physically destroys SSDs rather than erasing them.

How to eliminate wrong answers

Option A is wrong because degaussing an SSD does not perform a logical erase; it physically destroys the drive's electronics, making it impossible to reuse. Option C is wrong because the degausser's magnetic field induces destructive currents in the SSD's non-magnetic NAND flash, physically damaging the components and making data retrieval impossible. Option D is wrong because degaussing targets the storage drive, not the motherboard or BIOS chip; the BIOS remains unaffected unless the degausser is strong enough to damage other nearby components, but the primary outcome is SSD destruction.

Full explanation →
330
MCQmedium

A company uses a Remote Desktop Gateway to allow employees to access internal desktops from the internet. Users report that they can connect to the gateway but cannot see any available desktops in the list. Which of the following is the most likely cause?

A.The Remote Desktop Gateway service is not running on the server.
B.The users are not members of the correct Active Directory group that is allowed to access specific desktops.
C.The desktops are powered off or disconnected from the network.
D.The user's RDP client is outdated and cannot display the list.
AnswerB

Remote Desktop Gateway utilizes Connection Authorization Policies (CAPs) and Resource Authorization Policies (RAPs) to manage access. CAPs determine who can connect to the gateway, while RAPs specify which internal network resources (desktops or servers) those authorized users are permitted to access. If users can connect to the gateway but cannot see or access specific desktops, it strongly indicates they are not members of the Active Directory group defined in the relevant RAP that grants permission to those particular resources.

Why this answer

The Remote Desktop Gateway (RD Gateway) acts as a proxy, allowing external RDP connections to internal desktops. When users can connect to the gateway itself but see no desktops, it typically indicates an authorization failure: the RD Gateway uses Resource Authorization Policies (RAPs) to control which desktops a user can access. If the user is not a member of the Active Directory group specified in the RAP, the gateway will deny the list of available desktops, even though the gateway connection succeeds.

Exam trap

CompTIA often tests the distinction between gateway connectivity (CAP) and resource visibility (RAP), tempting candidates to choose generic network or client issues when the real problem is authorization policy misconfiguration.

How to eliminate wrong answers

Option A is wrong because if the RD Gateway service were not running, users would not be able to connect to the gateway at all; the symptom here is a successful connection but no desktop list. Option C is wrong because powered-off or disconnected desktops would still appear in the list (though they might show as unavailable); the RD Gateway does not filter the list based on desktop power state. Option D is wrong because an outdated RDP client might cause display or feature issues, but it would not prevent the gateway from returning the list of desktops; the list is generated server-side based on RAPs.

Full explanation →
331
MCQhard

A technician is writing a Python script to automate the cleanup of user profiles on a Windows server. The script must iterate through all user profile folders in 'C:\Users', check the last modified date, and delete profiles older than 90 days. Which scripting concept is essential for this task?

A.Error handling with try-except
B.A for loop to iterate over folders
C.A while loop with a counter
D.A function to calculate date difference
AnswerB

A "for" loop is the most appropriate and Pythonic construct for iterating over a known collection of items, such as a list of folders obtained from a directory listing. It provides a clear and concise way to process each folder sequentially, executing a block of code for every item until the collection is exhausted. This direct iteration over an iterable object is fundamental to systematically examining and acting upon each folder, making it essential for the task.

Why this answer

This question tests understanding of loops, conditionals, and file system operations in a scripting language. A 'for' loop is needed to iterate through each folder, combined with an 'if' statement to check the date condition. Without a loop, the script would only process one folder.

Error handling is important but not the core concept for iteration.

Full explanation →
332
MCQmedium

A user reports that a script they run daily now fails with 'Permission denied' even though they haven't changed any permissions. The script is located in /usr/local/bin/script.sh and has permissions -rwxr-xr-x. The user is in the 'users' group. What is the most likely issue?

A.The script's shebang line is incorrect.
B.The /usr/local/bin partition is mounted with the noexec option.
C.The user does not have read permission on the script.
D.The script has been replaced with a directory.
AnswerB

When a filesystem is mounted with the `noexec` option, the operating system kernel explicitly prevents the execution of any binaries or scripts located on that partition, regardless of their individual file permissions. Even if a script has the execute bit set (e.g., `chmod +x script.sh`), attempting to run it from a `noexec`-mounted filesystem will result in a "Permission denied" error. This security feature is designed to prevent the execution of potentially malicious code from certain partitions.

Why this answer

The script has execute permissions for the user (rwxr-xr-x), so the 'Permission denied' error is not due to missing execute bits. The most likely cause is that the /usr/local/bin filesystem is mounted with the 'noexec' option, which prevents execution of any binary or script regardless of its permission bits. This is a common administrative security measure that blocks execution from specific partitions, and it would cause the script to fail with 'Permission denied' even though the file permissions appear correct.

Exam trap

This question tests the distinction between file permission bits and filesystem mount options, trapping candidates who focus only on chmod or ownership changes when the real issue is a system-wide execution restriction like 'noexec'.

How to eliminate wrong answers

Option A is wrong because an incorrect shebang line would typically cause a 'command not found' or 'bad interpreter' error, not a 'Permission denied' error. Option C is wrong because the script's permissions are -rwxr-xr-x, which grants read permission to the owner, group, and others, so the user in the 'users' group does have read access. Option D is wrong because if the script were replaced with a directory, the error would be 'Is a directory' or similar, not 'Permission denied'.

Full explanation →
333
MCQmedium

A technician is configuring a new workstation for a customer who is concerned about energy consumption. Which setting should the technician enable to reduce power usage when the computer is idle?

A.Disable the screensaver and set the display to turn off after 30 minutes.
B.Enable hibernation mode after 1 hour of inactivity.
C.Enable sleep mode after 15 minutes of inactivity.
D.Set the power plan to 'High performance' to reduce power draw.
AnswerC

Enabling sleep mode after 15 minutes of inactivity is the optimal choice for reducing power consumption while maintaining quick system responsiveness. In sleep (S3) mode, the system significantly reduces power to most components, but keeps the RAM powered to retain the current session data. This allows the workstation to resume operation almost instantly, making it ideal for short periods of user absence.

Why this answer

Enabling sleep mode after 15 minutes of inactivity places the computer into a low-power state (S3 sleep, Suspend-to-RAM) where the CPU is powered down but RAM retains data, allowing a quick wake-up. This directly reduces energy consumption during idle periods more effectively than simply turning off the display, as it cuts power to the processor, drives, and most peripherals.

Exam trap

The trap here is that candidates often confuse 'turning off the display' with full system power saving, or they assume that a longer idle timer (like 1 hour for hibernation) is better than a shorter one (15 minutes for sleep), not realizing that sleep mode engages much sooner and thus saves more energy over typical idle periods.

How to eliminate wrong answers

Option A is wrong because disabling the screensaver and setting the display to turn off only reduces power to the monitor; the rest of the system (CPU, RAM, drives) remains fully active, consuming significant power. Option B is wrong because hibernation mode (S4 state) saves the system state to disk and completely powers off, but after 1 hour it is less aggressive than sleep after 15 minutes, meaning the system wastes more energy during the first 45 minutes of idle time. Option D is wrong because the 'High performance' power plan maximizes CPU speed and prevents power-saving features, actually increasing power draw rather than reducing it.

Full explanation →
334
MCQeasy

A small business wants to ensure that only authorized employees can access the file server from their laptops. Each laptop has a unique MAC address. Which security measure should be implemented on the network switch?

A.Disable SSID broadcast
B.Enable WPA3 encryption
C.Configure MAC filtering
D.Change the default admin password
AnswerC

Configuring MAC (Media Access Control) filtering on the wireless access point or router establishes an access control list (ACL) based on the unique hardware addresses of network interface cards. Only devices whose MAC addresses are explicitly added to this approved list will be permitted to associate with the wireless network and gain access. This method directly addresses the requirement to ensure that only specific, authorized devices can connect, effectively blocking any device with an unlisted MAC address.

Why this answer

MAC filtering on a network switch allows the administrator to create an access control list (ACL) that permits or denies traffic based on the source MAC address. By configuring the switch to allow only the MAC addresses of authorized employee laptops, the small business can restrict file server access to those specific devices, even if they connect via a wired Ethernet port.

Exam trap

The trap here is that candidates confuse wireless security features (SSID, WPA3) with wired network access controls, or they mistakenly think changing the admin password restricts user access to network resources rather than just protecting the switch itself.

How to eliminate wrong answers

Option A is wrong because disabling SSID broadcast is a wireless security measure that hides the network name from beacon frames; it does not control access on a wired switch and does not authenticate individual laptops. Option B is wrong because WPA3 encryption is a Wi-Fi security protocol for wireless networks, not a feature that can be configured on a wired Ethernet switch to filter traffic by MAC address. Option D is wrong because changing the default admin password protects the switch's management interface from unauthorized configuration changes, but it does not enforce per-device access control to the file server.

Full explanation →
335
MCQhard

A technician is deploying laptops for a sales team that works remotely from coffee shops and client sites. The laptops contain sensitive customer data. Which physical security control is most practical for these mobile devices?

A.Install a laptop tracking software
B.Use a biometric fingerprint reader on the laptop
C.Require a smart card for login
D.Attach a cable lock to the laptop
AnswerD

Attaching a cable lock to the laptop is a direct physical security control designed to deter theft by anchoring the device to an immovable object, such as a desk or table. This physical tether significantly increases the effort and time required for a thief to remove the laptop, making it a less attractive target for opportunistic theft. It provides a tangible barrier against unauthorized physical removal, directly addressing the need for physical theft prevention.

Why this answer

A cable lock is the most practical physical security control for mobile devices used in public spaces because it physically secures the laptop to a fixed object, preventing theft. Unlike software or authentication measures, a cable lock directly addresses the risk of the device being physically taken, which is the primary threat when working in coffee shops or client sites.

Exam trap

The A+ exam often tests the distinction between physical security controls (like cable locks) and logical/authentication controls (like biometrics or smart cards), so the trap here is confusing authentication methods with physical theft prevention.

How to eliminate wrong answers

Option A is wrong because laptop tracking software is a reactive measure that helps locate a stolen device after the fact, but it does not prevent the initial theft or protect sensitive data in the moment. Option B is wrong because a biometric fingerprint reader provides authentication security, not physical security; it can be bypassed if the device is stolen and the attacker uses other methods to access data. Option C is wrong because requiring a smart card for login is an authentication control that protects access to the operating system, but it does not prevent the physical theft of the laptop itself.

Full explanation →
336
MCQeasy

A small business owner wants to restrict app installations on company Macs to only the Mac App Store to prevent employees from downloading unapproved software. Which macOS security feature should you configure?

A.FileVault
B.System Integrity Protection (SIP)
C.Gatekeeper
D.Parental Controls
AnswerC

Gatekeeper is a macOS security feature that enforces policies regarding the installation and execution of applications downloaded from the internet. It allows administrators to configure which sources are permitted for app installations, offering options such as "App Store," "App Store and identified developers," or "Anywhere." By verifying the digital signature of applications against Apple's developer ID certificates, Gatekeeper effectively prevents the execution of unsigned or untrusted software, directly addressing the need to restrict app installations.

Why this answer

Gatekeeper controls where apps can be installed from. Setting it to 'App Store' restricts installations to only Mac App Store apps, meeting the business requirement.

Full explanation →
337
MCQhard

A technician is preparing to deploy a security patch to 50 workstations. The change request has been approved, and the patch has been tested on a pilot group. During the deployment, five workstations fail to install the patch. What should the technician do next according to change management best practices?

A.Continue deploying to the remaining workstations and troubleshoot the failures later
B.Halt the deployment and execute the rollback plan for the failed workstations
C.Force the patch to install using administrative tools
D.Submit a new change request for the failed workstations
AnswerB

Halting the deployment and executing the pre-defined rollback plan for affected workstations is the correct and most responsible course of action. This immediately mitigates further risk by preventing additional systems from being compromised and restores failed systems to a known stable state. It adheres to established change management protocols, allowing for proper investigation of the failure cause without compounding the problem.

Why this answer

According to change management best practices, when a deployment encounters failures, the immediate priority is to halt the deployment to prevent further issues and then execute the rollback plan to restore the failed workstations to their previous known-good state. This ensures stability and minimizes disruption, as the rollback plan was already defined and approved as part of the change request. Continuing or forcing the patch could lead to system instability or security vulnerabilities.

Exam trap

CompTIA often tests the misconception that troubleshooting can be deferred or that a new change request is required for each failure, when in fact the approved change request already covers rollback procedures for failed deployments.

How to eliminate wrong answers

Option A is wrong because continuing the deployment while ignoring failures violates the change management principle of risk mitigation; it could propagate errors or leave systems in an inconsistent state, making later troubleshooting more complex. Option C is wrong because forcing the patch installation with administrative tools bypasses the tested deployment process and could cause system corruption or incompatibility, especially if the failures indicate a deeper issue like driver conflicts or missing dependencies. Option D is wrong because submitting a new change request for only five workstations is unnecessary and inefficient; the existing approved change request already includes a rollback plan for handling failures, and a new request would delay resolution without adding value.

Full explanation →
338
MCQeasy

During a routine security audit, a technician discovers that a server was patched out of the approved maintenance window. The patch was applied by a junior admin who was not authorized. What is the most important step to include in the incident documentation?

A.The name of the junior admin who applied the patch.
B.The reason the patch was applied outside the maintenance window.
C.The exact time the patch was applied.
D.The patch's version number and source.
AnswerB

The justification for applying a patch outside the designated maintenance window is paramount for proper change management and risk assessment. This documentation allows the Change Advisory Board (CAB) or security team to evaluate the urgency and necessity of the emergency change, ensuring that procedural deviations are understood, approved retroactively if warranted, and that appropriate controls are in place to minimize future occurrences. It directly addresses the procedural breach identified by the audit.

Why this answer

The most important step in incident documentation is to capture the reason the patch was applied outside the approved maintenance window. This directly addresses the root cause of the unauthorized change, which is critical for post-incident review, process improvement, and preventing recurrence. Without the reason, the documentation fails to support a meaningful root cause analysis (RCA) and corrective action planning.

Exam trap

CompTIA often tests the distinction between documenting what happened versus why it happened, and the trap here is that candidates focus on technical details (time, version, person) instead of the root cause reason that drives corrective action.

How to eliminate wrong answers

Option A is wrong because while the name of the junior admin may be noted for accountability, it is not the most important element for understanding the incident's cause and preventing future occurrences. Option C is wrong because the exact time, though useful for timeline reconstruction, does not explain why the change was made outside policy. Option D is wrong because the patch version and source are technical details that help identify the change but do not address the procedural violation or its underlying motivation.

Full explanation →
339
MCQeasy

A school IT administrator needs to remotely lock a lost MacBook and display a custom message with contact information. The MacBook is enrolled in the school’s MDM and has an internet connection. Which macOS feature should they use?

A.Remote Desktop
B.Find My Mac
C.FileVault
D.Terminal command 'sudo pmset'
AnswerB

Find My Mac is the correct solution as it is an integrated Apple service designed specifically for locating and securing lost or stolen macOS devices. When enabled, it leverages iCloud to allow an administrator to remotely lock the device with a passcode, display a custom message on the lock screen, play a sound, or even erase all data to protect sensitive information. This functionality relies on the device having an active internet connection and being linked to an iCloud account, providing essential anti-theft and data protection features.

Why this answer

Find My Mac is the correct feature because it is specifically designed to locate, lock, and display a custom message on a lost Apple device that is enrolled in MDM and connected to the internet. It leverages Apple's Activation Lock and MDM integration to remotely lock the Mac and present a contact message on the Lock screen, fulfilling the administrator's requirement without needing physical access.

Exam trap

The A+ exam often tests the distinction between remote management tools (like Remote Desktop) and dedicated lost-device recovery features (like Find My Mac). Candidates may mistakenly assume that any remote access tool can perform the lock-and-message function, but only Find My Mac provides the specific lost-mode lock with custom message display.

How to eliminate wrong answers

Option A is wrong because Remote Desktop is a screen-sharing and remote management tool that requires the Mac to be online and accessible via VNC, but it cannot remotely lock the device or display a custom message on the Lock screen; it is not designed for lost-device scenarios. Option C is wrong because FileVault provides full-disk encryption to protect data at rest, but it does not include any remote lock or message-display capability; it is a security feature, not a lost-device recovery tool. Option D is wrong because the Terminal command 'sudo pmset' is used to manage power management settings (e.g., sleep, wake, power-saving) and has no function for locking the device or displaying a custom message; it is a common misconception that a command-line tool can substitute for Find My Mac.

Full explanation →
340
MCQmedium

A technician is configuring a kiosk computer that will be used by the public to access a specific website. The technician wants to prevent users from navigating to other sites or changing browser settings. Which browser feature should be enabled?

A.Enable private browsing mode.
B.Enable parental controls.
C.Enable kiosk mode.
D.Disable the address bar via group policy.
AnswerC

Enabling kiosk mode is the most appropriate solution for configuring a dedicated kiosk computer. This specialized operating mode locks down the device, typically running a single application in full-screen, preventing users from accessing the desktop, other applications, or system settings. It restricts navigation to only approved content within the designated application, effectively securing the system against unauthorized use and ensuring the intended user experience.

Why this answer

Kiosk mode locks the browser to a specific site or set of sites, hides the address bar, and disables settings access. This is ideal for public terminals. Other options like private browsing or parental controls do not provide the same level of restriction.

Full explanation →
341
MCQeasy

A company is considering moving its email system from an on-premises Exchange server to a cloud-based solution. Which cloud service model would best fit this migration?

A.IaaS (Infrastructure as a Service)
B.PaaS (Platform as a Service)
C.SaaS (Software as a Service)
D.DaaS (Desktop as a Service)
AnswerC

SaaS (Software as a Service) provides fully managed, ready-to-use software applications delivered over the internet on a subscription basis. With SaaS, the cloud provider manages all aspects of the application, including infrastructure, platform, and software maintenance, updates, and security. For an email system, this means the company simply consumes the email service, eliminating the need for any on-premises servers or management of the email application itself, making it the ideal choice for offloading email infrastructure.

Why this answer

SaaS (Software as a Service) is the correct model because it delivers fully functional email applications (e.g., Microsoft 365 Exchange Online) over the internet, eliminating the need for the company to manage the underlying infrastructure, platform, or software. The cloud provider handles all maintenance, updates, and availability, making it ideal for migrating an existing email system without re-architecting the application itself.

Exam trap

The trap here is that candidates often confuse PaaS with SaaS, thinking that 'platform' includes email services, but PaaS requires the customer to deploy and manage the application code, whereas SaaS provides the complete, ready-to-use application.

How to eliminate wrong answers

Option A is wrong because IaaS provides virtualized computing resources (VMs, storage, networking) but requires the company to still install, configure, and manage the Exchange server software and its operating system, which defeats the purpose of a simple migration. Option B is wrong because PaaS offers a development and deployment platform (e.g., runtime environment, database middleware) but does not include pre-built email applications; the company would need to develop or deploy its own email software on the platform. Option D is wrong because DaaS delivers virtual desktops to end-users, not email services; it is designed for remote desktop access, not for replacing an on-premises email server.

Full explanation →
342
MCQhard

A user reports that their Windows 11 laptop's battery drains quickly even when idle. They have already checked for background apps and power-hungry processes. Which single Settings page can you use to generate a detailed battery usage report showing which apps and hardware have consumed the most power over the last 24 hours?

A.Settings > System > Power & battery > Battery saver
B.Settings > System > Power & battery > Battery usage
C.Control Panel > Power Options > Edit Plan Settings
D.Settings > Privacy & security > Diagnostics & feedback
AnswerB

The 'Battery usage' section within Windows 11's Power & battery settings is precisely where a user can find a detailed historical report of their laptop's battery consumption. This interface provides a graphical representation and a list breakdown of which applications, system components, and hardware (like the display) have consumed battery power over the last 24 hours or 7 days. This comprehensive data is invaluable for identifying power-hungry processes and diagnosing rapid battery drain.

Why this answer

The correct tool is 'Battery usage' under Settings > System > Power & battery. This page provides a graph and detailed list of app and hardware power consumption, which can help identify the cause of rapid drain.

Full explanation →
343
MCQeasy

A small business owner reports that after upgrading their wireless router to a newer model, their older laptops running Windows 7 cannot connect to the Wi-Fi network. The new router is configured with WPA3-Personal. Which of the following is the most likely reason for the connectivity failure?

A.The router's SSID is hidden.
B.The laptops' wireless adapters do not support WPA3.
C.The router is broadcasting on a 5 GHz band only.
D.The laptops have incorrect DNS settings.
AnswerB

WPA3 is a newer security standard; older hardware and drivers often lack support, forcing a fallback to WPA2 or causing connection failures.

Why this answer

WPA3-Personal is a newer wireless security protocol that requires hardware support in the wireless adapter. Older laptops running Windows 7 typically have legacy wireless adapters that only support WPA2 or earlier protocols. Since the router is configured to use WPA3 only, the laptops' adapters cannot negotiate a connection, resulting in failure.

Exam trap

CompTIA often tests the misconception that older Windows 7 laptops can connect to any Wi-Fi network as long as they have the password, but the trap here is that WPA3 requires both hardware and driver-level support, which legacy adapters lack.

How to eliminate wrong answers

Option A is wrong because a hidden SSID does not prevent connection; clients can still connect if they know the SSID and have compatible security settings. Option C is wrong because even if the router broadcasts only on 5 GHz, many older Windows 7 laptops support 5 GHz if they have dual-band adapters; the primary issue is the security protocol mismatch, not the frequency band. Option D is wrong because incorrect DNS settings would prevent name resolution but not the initial Wi-Fi association and authentication; the laptops cannot even connect to the network, indicating a lower-layer issue.

Full explanation →
344
MCQhard

A user reports that Windows automatically installs a generic driver for a new graphics card that causes display issues. You need to change Windows settings to prevent automatic driver downloads from Windows Update. Which Control Panel tool allows you to change this behavior?

A.Device Manager
B.System > Advanced system settings > Hardware > Device Installation Settings
C.Programs and Features > Turn Windows features on or off
D.Administrative Tools > Services
AnswerB

System > Advanced system settings > Hardware > Device Installation Settings only controls whether Windows automatically downloads drivers from Windows Update; it does not change driver signing enforcement.

Why this answer

The Device Installation Settings (System > Advanced system settings > Hardware > Device Installation Settings) allow you to choose whether Windows automatically downloads drivers and realistic icons for your devices from Windows Update. Setting this to 'No' prevents automatic driver installations. This does not affect driver signing enforcement, which is configured via bcdedit or advanced startup options.

Full explanation →
345
MCQeasy

A technician is configuring a new Windows 10 workstation for a remote employee who will handle sensitive customer data. Which security feature should be enabled to ensure that if the laptop is lost, the data remains protected?

A.Windows Defender Firewall
B.User Account Control (UAC)
C.BitLocker Drive Encryption
D.Windows Hello for Business
AnswerC

BitLocker Drive Encryption is a full-disk encryption feature integrated into Windows that encrypts the entire volume where the operating system and user data reside. It uses a cryptographic key, often stored in a Trusted Platform Module (TPM) chip or provided by the user, to protect all data at rest. This encryption renders the data unreadable and inaccessible without the correct decryption key, making it the ideal solution for protecting sensitive information if the workstation's drive is lost, stolen, or removed from the system.

Why this answer

BitLocker Drive Encryption (C) is the correct choice because it provides full-disk encryption using AES encryption algorithms, ensuring that if the laptop is lost or stolen, the sensitive customer data remains inaccessible without the recovery key or TPM authentication. This directly addresses the requirement to protect data at rest on a lost device.

Exam trap

CompTIA often tests the distinction between authentication/access control features (like UAC or Windows Hello) and data-at-rest encryption (BitLocker), leading candidates to choose a security feature that protects the system while running rather than protecting data when the device is physically compromised.

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall is a network security feature that monitors and controls incoming/outgoing traffic based on rules, but it does not encrypt data on the drive, so it cannot protect data if the laptop is physically lost. Option B is wrong because User Account Control (UAC) prompts for permission before allowing system-level changes to prevent unauthorized software from making modifications, but it does not encrypt the drive or protect data when the device is offline. Option D is wrong because Windows Hello for Business provides biometric or PIN-based authentication for user sign-in, but it does not encrypt the storage volume, so data remains readable if the drive is removed or the device is accessed via other means.

Full explanation →
346
MCQmedium

A technician is troubleshooting why a smart card reader at a secure entrance fails intermittently. Users can sometimes enter, but other times the reader does not respond. What should the technician check first?

A.Update the smart card reader firmware
B.Replace the smart cards for all users
C.Check the cabling and connections to the reader
D.Reconfigure the access control software
AnswerC

Checking the cabling and connections to the reader is the most logical and effective first step for troubleshooting intermittent connectivity issues. Loose or damaged USB cables, network cables (for networked readers), or power connections can cause a device to repeatedly connect and disconnect. Verifying that all physical connections are secure and undamaged often resolves such sporadic problems quickly, aligning with fundamental hardware troubleshooting methodologies.

Why this answer

Intermittent failures in a smart card reader are most often caused by physical connection issues, such as loose or damaged cabling, rather than software or firmware problems. Checking cabling and connections is the first step in a structured troubleshooting approach because it addresses the most common and easily verifiable cause of intermittent behavior.

Exam trap

The 220-1202 exam often tests the principle of 'starting with the simplest and most likely cause' in troubleshooting scenarios, and the trap here is that candidates jump to firmware or software fixes without first verifying the physical layer.

How to eliminate wrong answers

Option A is wrong because updating firmware is a more advanced step that should only be attempted after verifying physical connections and power; firmware issues typically cause consistent failures, not intermittent ones. Option B is wrong because replacing all smart cards is an expensive and disruptive action that assumes a widespread card failure, which is unlikely when the reader itself is unresponsive and the problem is intermittent. Option D is wrong because reconfiguring access control software would not resolve a hardware-level intermittent connection problem; software misconfiguration usually results in consistent access denials or errors, not random unresponsiveness.

Full explanation →
347
MCQeasy

A user reports that they cannot execute a custom shell script they created in their home directory. The script is owned by the user and has permissions set to 644. Which command should be used to allow the owner to execute the script?

A.chmod 755 script.sh
B.chmod u+x script.sh
C.chmod 644 script.sh
D.chown user:user script.sh
AnswerB

The command "chmod u+x script.sh" is the most appropriate solution as it precisely adds execute permission solely for the file's owner (user). The 'u' specifies the user (owner), and '+x' adds the execute permission without altering any existing read or write permissions for the owner, group, or others. This ensures the user can execute their script while maintaining the existing, potentially restrictive, permissions for other user categories, adhering to the principle of least privilege.

Why this answer

The script has permissions 644, which means the owner has read/write (6) but not execute. To allow the owner to execute the script, you need to add the execute permission for the owner. The command `chmod u+x script.sh` adds execute permission for the user (owner) only, which is the correct and minimal change to resolve the issue.

Exam trap

The trap here is that candidates often choose `chmod 755` (Option A) because it is a common permission set for scripts, but the question specifically asks to allow only the owner to execute, making `chmod u+x` the precise and correct answer.

How to eliminate wrong answers

Option A is wrong because `chmod 755 script.sh` sets permissions to rwxr-xr-x, which grants execute to the owner, group, and others — this is overly permissive and not the minimal fix required. Option C is wrong because `chmod 644 script.sh` sets permissions to rw-r--r--, which is the current state and does not add execute permission, so it would not solve the problem. Option D is wrong because `chown user:user script.sh` changes the owner and group of the file, but the script is already owned by the user; the issue is about permissions, not ownership.

Full explanation →
348
MCQeasy

A customer reports that their Windows 10 computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What type of malware is most likely causing these symptoms?

A.Ransomware
B.Adware
C.Virus
D.Worm
AnswerB

Adware is a type of software that automatically displays or downloads advertising material, often in the form of pop-up windows, banner ads, or redirects, after it is installed on a computer. It frequently bundles with free software and can install unwanted browser toolbars, modify browser settings, and track user browsing habits to serve targeted advertisements. These symptoms precisely match the customer's report of pop-ups and toolbars, as adware's main purpose is to generate revenue through advertising.

Why this answer

Adware displays unwanted advertisements and often installs browser toolbars, slowing down the system. Unlike a virus or worm, adware does not self-replicate, and ransomware would demand payment rather than show ads.

Full explanation →
349
MCQmedium

A user complains that their Android phone's battery drains quickly after installing a new weather app. The phone is warm to the touch even when idle. What should you do to resolve this?

A.Replace the battery immediately.
B.Check battery usage in Settings to see which app is consuming power.
C.Perform a factory reset to remove all apps.
D.Update the phone's operating system to the latest version.
AnswerB

Checking battery usage in Android's Settings provides granular power consumption data, allowing technicians to pinpoint which applications or system processes are consuming the most power. This diagnostic step directly identifies resource-intensive apps, such as a problematic weather application, enabling targeted action like force-stopping, uninstalling, or adjusting app permissions to resolve the drain efficiently.

Why this answer

Battery drain and overheating after app installation indicate a misbehaving app. The best first step is to check battery usage statistics to identify the culprit, then force stop or uninstall that app. This is a standard Android troubleshooting procedure.

Full explanation →
350
MCQeasy

A small business wants to ensure that only authorized employees can access the file server from their laptops. Each laptop has a unique hardware ID. Which logical security method should be implemented to enforce this restriction?

A.Require a complex password for the file server share.
B.Enable MAC address filtering on the network switch or router.
C.Install a host-based firewall on each laptop.
D.Disable the guest account on the file server.
AnswerB

Enabling MAC address filtering on a network switch or router directly addresses the requirement to ensure only authorized laptops can access resources. This method operates at Layer 2 (Data Link Layer) of the OSI model, allowing the network device to inspect the Media Access Control (MAC) address of connecting devices. By creating a whitelist of approved MAC addresses, the switch or router will only permit network connectivity for those specific, authorized laptops, effectively blocking all others.

Why this answer

MAC address filtering on the network switch or router allows the administrator to create an access control list (ACL) that permits only specific hardware MAC addresses to connect to the network. Since each laptop has a unique hardware ID (MAC address), this method directly ties network access to the authorized devices, ensuring only those laptops can reach the file server. This is a logical security control implemented at Layer 2 of the OSI model.

Exam trap

The trap here is that candidates often confuse user authentication (passwords) with device authentication (MAC filtering), assuming that a strong password alone can restrict access to specific hardware, when in fact passwords only verify the user, not the device.

How to eliminate wrong answers

Option A is wrong because requiring a complex password for the file server share authenticates the user, not the device; any user with the password could log in from an unauthorized laptop. Option C is wrong because a host-based firewall on each laptop controls inbound/outbound traffic on that laptop but does not restrict which laptops are allowed to access the file server from the network perspective. Option D is wrong because disabling the guest account on the file server prevents anonymous access but does not enforce device-specific authorization; authorized users could still connect from any laptop.

Full explanation →
351
MCQeasy

A user reports that their computer is infected with a virus and they have been trying to remove it using a free online scanner, but the problem persists. The technician suspects the malware may have disabled the antivirus software. Which safe mode should the technician use to run a full system scan?

A.Safe Mode
B.Safe Mode with Command Prompt
C.Safe Mode with Networking
D.Last Known Good Configuration
AnswerC

Safe Mode with Networking is the optimal choice for malware removal because it loads Windows with a minimal set of drivers and services, effectively preventing most malware from loading and executing. Crucially, this mode enables network connectivity, allowing the technician to download the latest antivirus definition updates, specialized malware removal tools, and access online resources for threat analysis. This combination ensures a clean, isolated environment for effective remediation while providing necessary external resources.

Why this answer

Safe Mode with Networking (C) is correct because it loads only essential drivers and services, including network components, which allows the technician to run a full system scan while the malware is likely inactive. Since the malware may have disabled the antivirus software in normal mode, booting into Safe Mode with Networking ensures the antivirus can run and still access the internet for signature updates or cloud-based scanning.

Exam trap

CompTIA often tests the distinction between Safe Mode and Safe Mode with Networking, where candidates mistakenly choose Safe Mode without realizing that antivirus software often requires network access to download updated signatures for effective malware removal.

How to eliminate wrong answers

Option A is wrong because Safe Mode does not load network drivers, which prevents the antivirus from downloading updated virus definitions or connecting to cloud-based scanning services, potentially leaving the scan incomplete. Option B is wrong because Safe Mode with Command Prompt provides a command-line interface but still lacks networking, so it offers no advantage over Safe Mode for running a full system scan with updated definitions. Option D is wrong because Last Known Good Configuration loads the last set of registry and driver settings that worked, but it does not prevent malware from loading, as malware often persists in user profiles or startup locations unaffected by this option.

Full explanation →
352
MCQmedium

A technician is cleaning a computer that has been infected with a rootkit. After running a standard antivirus scan, the malware is still detected on reboot. Which step should the technician take next to ensure complete removal?

A.Perform a clean installation of Windows.
B.Boot from a rescue disk and run a malware scan.
C.Disable System Restore and run the antivirus again.
D.Run the antivirus in Safe Mode.
AnswerB

Booting from a rescue disk, also known as a bootable antivirus or recovery environment, loads a clean, trusted operating system directly from external media (USB or CD/DVD). This bypasses any malware, especially rootkits, that might be deeply embedded within the compromised installed operating system and actively hiding its presence or interfering with security software. Operating from an uninfected environment allows the malware scanner to access and remove malicious files and registry entries that would otherwise be protected or invisible.

Why this answer

Rootkits are designed to hide from the operating system and standard antivirus tools by intercepting system calls and loading before the OS security components. Booting from a rescue disk (e.g., a Linux live CD or a dedicated antivirus rescue ISO) bypasses the infected OS entirely, allowing the scanner to access the file system without the rootkit actively masking its presence. This ensures the malware cannot interfere with the scan, enabling complete detection and removal.

Exam trap

The trap here is that candidates assume Safe Mode provides a clean environment for malware removal, but rootkits specifically target kernel-level persistence that persists even in Safe Mode, making a boot-time rescue disk the only reliable method.

How to eliminate wrong answers

Option A is wrong because a clean installation of Windows is a last-resort step that is unnecessarily drastic when a targeted boot-time scan can remove the rootkit without data loss. Option C is wrong because disabling System Restore only removes restore points that might contain malware, but it does not address the rootkit's ability to hide from the antivirus while the OS is running. Option D is wrong because Safe Mode still loads essential Windows drivers and services that a rootkit can hook into, allowing it to remain active and evade detection during the scan.

Full explanation →
353
MCQhard

A technician is tasked with securing a legacy web application that only supports HTTP, not HTTPS. The application is critical for internal operations but must be accessible remotely. What is the best way to secure the traffic without modifying the application?

A.Install a self-signed SSL certificate on the server.
B.Use a VPN to access the internal network.
C.Enable HTTP Strict Transport Security (HSTS) on the server.
D.Configure the browser to use a proxy server.
AnswerB

A Virtual Private Network (VPN) establishes an encrypted tunnel between the client and the internal network. All traffic, including unencrypted HTTP requests to the legacy web application, traverses this secure tunnel. This effectively encapsulates and protects the HTTP communication from external eavesdropping and tampering, providing confidentiality and integrity for the data without requiring any modifications to the legacy application or server configuration.

Why this answer

A VPN creates an encrypted tunnel between the remote user and the internal network, securing all HTTP traffic without any modification to the legacy application. Since the application only supports HTTP, it cannot serve HTTPS natively, and a VPN provides transport-layer encryption (e.g., IPsec or TLS-based VPN) that protects data in transit over untrusted networks.

Exam trap

A common misconception is that installing a certificate or enabling a security header can magically convert an HTTP-only application to HTTPS, when in fact the application must natively support TLS termination to use those features.

How to eliminate wrong answers

Option A is wrong because installing a self-signed SSL certificate on the server does not enable HTTPS; the application itself must support HTTPS to use the certificate, and a legacy HTTP-only application cannot serve HTTPS without code changes. Option C is wrong because HSTS is an HTTP response header that enforces HTTPS connections from browsers, but it requires the server to already support HTTPS, which this legacy application does not. Option D is wrong because configuring the browser to use a proxy server only redirects traffic through an intermediary; it does not encrypt the traffic between the client and the proxy, leaving the HTTP data exposed on the network.

Full explanation →
354
MCQmedium

A company deploys a new remote access solution using a VPN concentrator. After setup, users report that they can connect to the VPN but cannot access internal file servers. Other internal resources like email are accessible. Which of the following is the most likely cause?

A.The VPN client is using an incorrect DNS server
B.The file server is not on the same VLAN as the VPN concentrator
C.The VPN concentrator lacks a route to the file server's subnet
D.The users do not have permission to log on locally to the file server
AnswerC

For VPN clients to access resources on an internal network subnet, the VPN concentrator must have a defined route specifying how to reach that particular subnet. If the concentrator lacks a route to the file server's subnet, it will not know where to forward traffic destined for the file server's IP address. Consequently, packets from the VPN clients will be dropped or sent to an incorrect destination, preventing any successful connection to the file server. This is a fundamental layer 3 networking requirement.

Why this answer

The VPN concentrator must have a route to the file server's subnet to forward traffic from VPN clients. Without this route, packets destined for the file server are dropped, while other resources (like email) remain accessible if their subnets are reachable. This is a classic routing issue in remote access VPN deployments.

Exam trap

CompTIA often tests the misconception that VLAN placement or local permissions are the root cause, when the actual issue is a missing route on the VPN concentrator to the specific subnet.

How to eliminate wrong answers

Option A is wrong because an incorrect DNS server would cause name resolution failures for all internal resources, not selectively block file servers while allowing email access. Option B is wrong because VLAN membership is irrelevant for VPN concentrator routing; the concentrator can route to any subnet regardless of VLAN if a route exists. Option D is wrong because local logon permissions are not required for network file access; file server permissions are based on network shares and user credentials, not local logon rights.

Full explanation →
355
MCQmedium

A company’s change management policy requires all changes to be approved by the Change Advisory Board (CAB) before implementation. A technician applies an emergency security patch to a critical server without CAB approval because the vulnerability is being actively exploited. What should the technician do after applying the patch?

A.Wait for the next CAB meeting to report the change.
B.Document the change and submit an emergency change request for retroactive approval.
C.Revert the patch and wait for CAB approval.
D.Delete the change log entry to avoid accountability.
AnswerB

For emergency changes, the immediate priority is to implement the necessary fix to restore service or mitigate a critical threat. Following this, the correct procedure mandates thoroughly documenting the change, including its rationale, steps taken, and impact, and then promptly submitting an emergency change request to the Change Advisory Board (CAB) for retroactive review and formal approval. This ensures accountability, maintains the integrity of the change management process, and provides a crucial audit trail.

Why this answer

Even in emergency changes, documentation and retroactive approval are required. The technician must document the change and notify the CAB as soon as possible to obtain retroactive approval, ensuring compliance with change management policies.

Full explanation →
356
MCQhard

A technician is troubleshooting an iPhone that repeatedly prompts for the Apple ID password even after entering it correctly. The device is not connected to any corporate MDM. What is the most likely cause?

A.The device is jailbroken and has a tweak interfering with authentication.
B.The Apple ID password was changed recently and not synced to all services.
C.iCloud Keychain is out of sync and needs to be reset by signing out of iCloud and back in.
D.The device has a hardware fault in the secure enclave.
AnswerC

iCloud Keychain securely stores and synchronizes various credentials, including app passwords, Wi-Fi passwords, and authentication tokens across Apple devices. When this keychain becomes desynchronized or corrupted, the device may repeatedly fail to validate authentication requests for iCloud services, leading to persistent password prompts. Signing out and then back into iCloud forces a complete re-authentication and re-establishment of these secure tokens and keychain data, effectively resolving the synchronization issue.

Why this answer

Repeated Apple ID password prompts, even after correct entry, are typically caused by an iCloud Keychain sync conflict. When iCloud Keychain becomes out of sync—often after a password change or device restore—the authentication token chain breaks, forcing the device to re-request the password. Signing out of iCloud and back in resets the local Keychain state and re-establishes a trusted sync relationship with Apple's servers.

Exam trap

CompTIA often tests the misconception that repeated password prompts are always due to a password change or incorrect entry, when in fact iCloud Keychain sync issues are a common cause that requires a sign-out/sign-in cycle to resolve.

How to eliminate wrong answers

Option A is wrong because a jailbroken device with a tweak interfering with authentication would likely cause broader instability or specific app crashes, not a consistent, system-level Apple ID password prompt that persists after correct entry. Option B is wrong because changing the Apple ID password and not syncing to all services would cause authentication failures on services using the old password, not repeated prompts after entering the correct password. Option D is wrong because a hardware fault in the Secure Enclave would manifest as inability to use Touch ID/Face ID or perform cryptographic operations, not as a repeated password prompt that works when entered.

Full explanation →
357
MCQeasy

During a software deployment, a technician needs to ensure that a new web application can run in a sandboxed environment to prevent it from accessing other system resources. Which browser feature should be configured?

A.Enable pop-up blocker.
B.Enable private browsing mode.
C.Enable browser sandboxing.
D.Disable JavaScript.
AnswerC

Enabling browser sandboxing is the correct approach because it creates a highly controlled and isolated environment for web applications or specific browser processes. This isolation mechanism restricts the application's access to critical system resources, such as the file system, network interfaces, and memory outside its designated space. By confining the application, sandboxing prevents potential malicious code from affecting the host operating system or other browser tabs, thereby ensuring secure software deployment.

Why this answer

Browser sandboxing is a security mechanism that isolates the web application's processes from the rest of the system, preventing it from accessing other system resources such as the file system, registry, or other processes. This is commonly implemented in modern browsers (e.g., Chrome's multi-process architecture with a sandbox layer) to contain potential exploits from a compromised web application.

Exam trap

CompTIA often tests the distinction between privacy features (like private browsing) and security features (like sandboxing), leading candidates to confuse 'preventing local storage of data' with 'preventing system resource access.'

How to eliminate wrong answers

Option A is wrong because enabling a pop-up blocker only prevents unwanted pop-up windows from appearing; it does not restrict the web application's access to system resources or provide any sandboxing. Option B is wrong because private browsing mode (e.g., Incognito in Chrome) only prevents the browser from storing local history, cookies, and form data; it does not isolate the application from the underlying operating system or other system resources. Option D is wrong because disabling JavaScript would break most modern web applications, but it does not create a sandboxed environment; it merely removes a scripting capability, leaving other attack vectors (e.g., HTML, CSS, or plugin exploits) uncontained.

Full explanation →
358
MCQmedium

During a network upgrade, a technician needs to run new Ethernet cables through a drop ceiling. What is the most important safety precaution to take?

A.Wear a hard hat to protect against head injuries.
B.Use a non-contact voltage tester to check for live wires.
C.Ensure the area is well-ventilated.
D.Wear anti-static gloves to prevent ESD.
AnswerB

Using a non-contact voltage tester (NCVT) is the most critical safety precaution because it directly addresses the primary hazard of electrocution when working in areas with existing electrical infrastructure. This device allows a technician to detect the presence of alternating current (AC) voltage in wires, conduits, or outlets without making physical contact, thereby identifying energized circuits before any cable installation or manipulation occurs. Verifying the absence of live wires in the cable path is paramount to prevent severe injury or fatality.

Why this answer

The most important safety precaution when running cables through a drop ceiling is to use a non-contact voltage tester to check for live wires. Drop ceilings often conceal electrical wiring, and accidentally cutting or damaging a live wire can cause electrocution, fire, or equipment damage. A non-contact voltage tester allows the technician to detect the presence of AC voltage without making physical contact, ensuring the area is safe before handling cables.

Exam trap

CompTIA often tests the distinction between general safety equipment (like hard hats) and task-specific electrical safety tools, so the trap here is that candidates may choose a hard hat as a 'common sense' safety item, overlooking the more critical step of verifying that no live electrical wires are present in the drop ceiling.

How to eliminate wrong answers

Option A is wrong because while a hard hat provides head protection against accidental bumps or falling objects, it is not the most critical precaution when working near electrical hazards in a drop ceiling; the primary risk is electrical shock, not head injury. Option C is wrong because ventilation is not a primary concern when running Ethernet cables through a drop ceiling; the main hazards are electrical and physical, not airborne contaminants or lack of oxygen. Option D is wrong because anti-static gloves are used to prevent electrostatic discharge (ESD) damage to sensitive electronic components, but they do not protect against the immediate life-threatening risk of contact with live electrical wires in a drop ceiling environment.

Full explanation →
359
MCQhard

A network administrator is configuring a new wireless network for a hospital that requires the highest level of security for patient data. The network must support 802.1X authentication with smart cards. Which combination of security protocols and authentication methods should be used?

A.WPA2-PSK with PEAP-MSCHAPv2.
B.WPA3-Personal with SAE.
C.WPA2-Enterprise with EAP-TLS.
D.WPA3-Enterprise with EAP-TTLS.
AnswerC

WPA2-Enterprise is the appropriate security mode for corporate environments because it leverages the 802.1X framework for robust, centralized authentication against a RADIUS server. EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) is a highly secure EAP method that performs mutual authentication using digital certificates on both the client and the server. This certificate-based authentication is inherently compatible with smart cards, as smart cards securely store the client's private key and certificate, making this the ideal solution for the specified requirements.

Why this answer

WPA2-Enterprise with EAP-TLS provides the highest level of security for a hospital network requiring 802.1X authentication with smart cards. EAP-TLS uses mutual authentication via digital certificates (which can be stored on smart cards), eliminating the risk of credential theft or man-in-the-middle attacks. WPA2-Enterprise is the appropriate underlying encryption framework for this scenario, as it supports the required 802.1X/EAP integration.

Exam trap

The trap here is that candidates often assume WPA3 is always more secure than WPA2, but for enterprise 802.1X with smart cards, WPA2-Enterprise with EAP-TLS is the correct and fully supported combination, while WPA3-Enterprise with EAP-TTLS does not enforce client certificate authentication.

How to eliminate wrong answers

Option A is wrong because WPA2-PSK uses a pre-shared key, which does not support 802.1X authentication or smart cards; PEAP-MSCHAPv2 relies on passwords, not certificates, and is vulnerable to brute-force attacks. Option B is wrong because WPA3-Personal with SAE is designed for password-based authentication in home/small office networks, not for 802.1X enterprise authentication with smart cards. Option D is wrong because while WPA3-Enterprise supports 802.1X, EAP-TTLS typically uses a server-side certificate only and tunnels password-based inner methods (e.g., MSCHAPv2), which does not meet the requirement for smart card (certificate-based) authentication; EAP-TLS is the standard for client certificate authentication.

Full explanation →
360
MCQeasy

A technician is tasked with disposing of several old UPS batteries from a server room. What is the most environmentally responsible method?

A.Place them in the regular dumpster for pickup.
B.Take them to a local battery recycling center.
C.Burn them in an incinerator to recover energy.
D.Store them indefinitely in a sealed container.
AnswerB

Taking lead-acid batteries to a certified recycling center is the correct and environmentally responsible disposal method. These specialized facilities are equipped to safely neutralize the sulfuric acid and extract the lead, plastic, and other components for reuse in new batteries or other products. This process significantly reduces the demand for virgin materials, conserves natural resources, and prevents hazardous waste from entering landfills or polluting ecosystems.

Why this answer

UPS batteries contain hazardous materials such as lead and sulfuric acid, which must be handled through specialized recycling processes to prevent environmental contamination. Local battery recycling centers are equipped to safely extract and reuse these materials, complying with regulations like the Resource Conservation and Recovery Act (RCRA) in the U.S.

Exam trap

CompTIA often tests the misconception that 'recycling' is optional or that 'storing indefinitely' is a safe alternative, when in fact proper disposal through certified recycling centers is legally required for hazardous waste like UPS batteries.

How to eliminate wrong answers

Option A is wrong because placing UPS batteries in a regular dumpster violates environmental regulations (e.g., RCRA) and can lead to soil and water contamination from leaked lead and acid. Option C is wrong because burning UPS batteries in an incinerator releases toxic fumes, including lead oxide and sulfur dioxide, and does not safely recover energy due to the hazardous nature of the materials. Option D is wrong because storing batteries indefinitely in a sealed container is not a disposal method and risks eventual leakage, corrosion, and non-compliance with waste management laws.

Full explanation →
361
MCQmedium

A technician is configuring a new wireless network for a school. The network must support hundreds of student devices simultaneously and provide strong security. The school wants to use a single SSID with individual logins for students. Which security protocol should the technician choose?

A.WPA2-PSK with a long passphrase.
B.WPA2-Enterprise with 802.1X and RADIUS.
C.WPA3-Enterprise with 192-bit encryption.
D.WPA3-Personal with SAE.
AnswerC

WPA3-Enterprise is the most secure and scalable option for a new wireless network requiring individual user authentication and robust data protection. It utilizes 802.1X and a RADIUS server for per-user access control and accountability, preventing unauthorized access and improving auditing. The inclusion of 192-bit encryption, part of the "Suite B" security profile, provides significantly stronger cryptographic protection against modern threats, ensuring the highest level of confidentiality and integrity for sensitive network traffic.

Why this answer

WPA3-Enterprise with 192-bit encryption is the correct choice because it provides the strongest security for a large-scale deployment with individual logins. It uses 802.1X authentication with a RADIUS server, supporting unique credentials for each student, and mandates 192-bit minimum-strength security suite (CNSA Suite) for encryption, offering enhanced protection against brute-force and dictionary attacks compared to WPA2-Enterprise.

Exam trap

CompTIA A+ emphasizes the distinction between 'Enterprise' and 'Personal' modes. The trap here is that candidates see 'WPA2-Enterprise with 802.1X and RADIUS' and assume it is sufficient for high-security individual logins, overlooking that WPA3-Enterprise with 192-bit encryption is the only option that combines individual authentication with the strongest mandated encryption suite.

How to eliminate wrong answers

Option A is wrong because WPA2-PSK uses a pre-shared key that is shared among all users, making it impossible to provide individual logins and vulnerable to passphrase cracking if the key is compromised. Option B is wrong because while WPA2-Enterprise with 802.1X and RADIUS supports individual logins, it relies on older encryption (CCMP/AES) and is susceptible to KRACK attacks and dictionary attacks on weak EAP methods; it does not mandate the 192-bit security suite required for the highest security. Option D is wrong because WPA3-Personal with SAE (Simultaneous Authentication of Equals) provides strong password-based authentication but still uses a single shared password for the SSID, not individual logins for each student.

Full explanation →
362
MCQeasy

A user reports that their Android phone automatically switches from Wi-Fi to cellular data when the Wi-Fi signal is weak, even though they want to stay on Wi-Fi. Which setting should you configure to prevent this behavior?

A.Turn off Bluetooth
B.Disable 'Mobile data always active' in Developer Options
C.Enable Airplane Mode
D.Disable 'Switch to mobile data' in Wi-Fi settings
AnswerD

Disabling the 'Switch to mobile data' (often labeled as 'Wi-Fi Assistant' or 'Smart Network Switch' depending on the Android version and manufacturer) option within the Wi-Fi settings directly addresses the user's reported issue. This feature is specifically designed to automatically transition the device from a weak or unstable Wi-Fi connection to a more reliable cellular data connection to maintain internet access. By deactivating this setting, the Android phone will prioritize staying connected to the Wi-Fi network, even if the signal is poor, preventing the unwanted automatic switch to mobile data.

Why this answer

The 'Switch to mobile data' or 'Smart Network Switch' option in Android Wi-Fi settings automatically transitions to cellular when Wi-Fi is weak. Disabling this keeps the device connected to Wi-Fi, addressing the user's complaint. This is a common mobile OS feature for network management.

Full explanation →
363
MCQeasy

A technician is setting up a wireless network for a home office. The client is concerned about neighbors accessing their internet. The technician enables WPA2-PSK with a strong passphrase. Which additional step should the technician take to ensure the network is as secure as possible?

A.Enable WPS for easy device pairing.
B.Disable SSID broadcast.
C.Disable WPS on the router.
D.Enable MAC address filtering.
AnswerC

Disabling Wi-Fi Protected Setup (WPS) on the router is a crucial security best practice for wireless networks. The WPS protocol, particularly its PIN-based method, is susceptible to brute-force attacks that can rapidly determine the network's WPA/WPA2 passphrase. By deactivating WPS, a technician eliminates this significant attack vector, forcing potential intruders to attempt more resource-intensive and time-consuming methods, such as direct brute-forcing of the WPA2 passphrase, which is far more difficult to achieve.

Why this answer

WPA2-PSK with a strong passphrase already provides robust encryption, but WPS (Wi-Fi Protected Setup) introduces a significant vulnerability. WPS allows devices to connect via an 8-digit PIN, which can be brute-forced in a matter of hours using tools like Reaver, exposing the network to unauthorized access. Disabling WPS eliminates this attack vector, making the network as secure as possible.

Exam trap

CompTIA often tests the misconception that hiding the SSID or using MAC filtering provides meaningful security, when in reality the WPS vulnerability is a far more critical and exploitable flaw that must be addressed first.

How to eliminate wrong answers

Option A is wrong because enabling WPS, even for convenience, creates a backdoor that bypasses the strong WPA2-PSK passphrase; the WPS PIN can be brute-forced offline, compromising the network. Option B is wrong because disabling SSID broadcast only hides the network name from casual scans, but it does not prevent determined attackers from discovering it using packet sniffers (e.g., Wireshark) or tools like Kismet, and it can actually cause connectivity issues for legitimate clients. Option D is wrong because MAC address filtering is a weak security measure; MAC addresses can be easily spoofed using tools like SMAC or by modifying the network adapter settings, so it provides no real protection against a skilled attacker.

Full explanation →
364
MCQeasy

A small business wants to migrate its on-premises file server to a cloud service to reduce hardware maintenance costs. The data must be accessible from any device with an internet connection and should support real-time collaboration. Which cloud service model best meets these requirements?

A.Infrastructure as a Service (IaaS)
B.Platform as a Service (PaaS)
C.Software as a Service (SaaS)
D.Desktop as a Service (DaaS)
AnswerC

Software as a Service (SaaS) delivers fully managed, ready-to-use applications directly to end-users over the internet, eliminating the need for local installation, maintenance, or infrastructure management. For a small business seeking to migrate its file server, a SaaS solution like cloud-based file storage and collaboration suites provides immediate accessibility, real-time collaboration features, and automatic updates, perfectly aligning with the requirement for a turnkey solution without managing any underlying hardware or software.

Why this answer

SaaS (Software as a Service) is the correct choice because it provides a ready-to-use file-sharing and collaboration application (e.g., Microsoft 365 SharePoint, Google Workspace Drive) that is accessed via a web browser or client over the internet. This eliminates the need to manage underlying hardware or platform, directly meeting the requirements for device-agnostic access and real-time collaboration without any infrastructure overhead.

Exam trap

CompTIA often tests the misconception that IaaS is the best choice for any migration away from on-premises hardware, but the trap here is that IaaS still requires the customer to manage the operating system and application stack, whereas SaaS provides a fully managed, collaboration-ready solution that directly meets the access and real-time editing requirements.

How to eliminate wrong answers

Option A is wrong because IaaS (Infrastructure as a Service) provides only virtualized compute, storage, and networking resources (e.g., Amazon EC2, Azure VMs), requiring the business to still deploy, configure, and manage the file server operating system and collaboration software, which does not reduce hardware maintenance costs to the degree needed. Option B is wrong because PaaS (Platform as a Service) offers a runtime environment for custom application development (e.g., AWS Elastic Beanstalk, Google App Engine), not a ready-to-use file server with built-in real-time collaboration features; the business would still need to build or integrate collaboration logic. Option D is wrong because DaaS (Desktop as a Service) delivers virtual desktops (e.g., Windows 365, Amazon WorkSpaces) that require users to connect to a full desktop environment, not a simple file-sharing service, and it does not inherently provide the real-time collaboration capabilities of a SaaS file-sharing application.

Full explanation →
365
MCQmedium

A user reports that their Windows 11 computer is infected with ransomware. Files are encrypted and a ransom note is displayed. The user has a backup from two days ago stored on an external drive that was disconnected after the backup. What is the best course of action to recover the data?

A.Pay the ransom to get the decryption key.
B.Disconnect the computer from the network and restore files from the external backup.
C.Run a full antivirus scan to remove the ransomware and then restore files.
D.Use System Restore to revert the system to a previous state.
AnswerB

Immediately disconnecting the infected computer from the network is critical to prevent the ransomware from spreading to other systems or communicating with its command-and-control server for further instructions or key exfiltration. Once isolated, restoring files from a verified, uninfected external backup is the most reliable and secure method to recover data without succumbing to the ransom demand. This process ensures complete data integrity and system functionality restoration.

Why this answer

Since the backup was stored on a disconnected external drive, it is likely not encrypted by the ransomware. The best action is to disconnect the infected computer from the network to prevent further spread, then restore the files from the clean backup.

Full explanation →
366
MCQeasy

A user reports that their system is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice that their default search engine has changed without their permission. Which type of malware is most likely causing these symptoms?

A.Virus
B.Adware
C.Ransomware
D.Rootkit
AnswerB

Adware is a category of software that automatically displays or downloads advertising material, often in the form of pop-up ads, banner ads, or unsolicited new browser tabs. It frequently modifies web browser settings, such as the homepage or default search engine, to redirect users to advertiser-controlled sites. These symptoms directly align with a user reporting excessive pop-ups and altered search functionality, as adware's primary goal is to generate revenue through advertising impressions.

Why this answer

Adware is designed to display unwanted advertisements and can modify browser settings, causing pop-ups and search engine hijacking. Unlike a virus or worm, adware does not typically replicate itself or require a host file to spread. The symptoms described—pop-ups outside the browser and unauthorized search engine changes—are classic signs of adware infection.

Full explanation →
367
MCQeasy

During a desktop computer deployment, a technician needs to dispose of several used toner cartridges. What is the most environmentally responsible method?

A.Throw them in the regular trash since they are mostly plastic.
B.Recycle them through a certified e-waste recycler or manufacturer take-back program.
C.Burn them in an incinerator to generate energy.
D.Sell them to a scrap metal dealer.
AnswerB

This is the correct and environmentally responsible method for disposing of used toner cartridges. Certified e-waste recyclers possess the specialized equipment and processes to safely separate and recover valuable materials, such as plastics, metals, and residual toner, preventing hazardous substances from entering the environment. Manufacturer take-back programs further facilitate closed-loop recycling, often remanufacturing cartridges to reduce waste and conserve resources, aligning with best practices for sustainable IT asset disposition.

Why this answer

Toner cartridges contain plastic, metal, and residual toner powder, which are hazardous to the environment if landfilled. Certified e-waste recyclers or manufacturer take-back programs ensure proper disassembly, material recovery, and safe disposal of toxic components, complying with regulations like the EPA's Resource Conservation and Recovery Act (RCRA). This method minimizes environmental harm and supports circular economy principles.

Exam trap

The trap here is that candidates assume 'mostly plastic' means safe for regular trash, ignoring that toner powder is a hazardous substance regulated by environmental agencies.

How to eliminate wrong answers

Option A is wrong because throwing toner cartridges in regular trash violates environmental regulations (e.g., RCRA) as residual toner is classified as hazardous waste, and plastics do not biodegrade in landfills. Option C is wrong because burning toner cartridges in an incinerator releases toxic fumes, including dioxins and heavy metals from the toner powder, and is not a standard energy-recovery method for e-waste. Option D is wrong because toner cartridges are not primarily scrap metal; they contain plastic, foam, and toner, making them unsuitable for scrap metal recycling, and a scrap metal dealer would reject them or improperly dispose of non-metal components.

Full explanation →
368
MCQeasy

A customer complains that after a recent Windows update, their default web browser keeps resetting to Microsoft Edge. They want to set Google Chrome as the default. Where in the Settings app would you configure this?

A.Apps > Apps & features
B.Personalization > Start
C.Apps > Default apps
D.Update & Security > Windows Update
AnswerC

The "Apps > Default apps" section in Windows Settings is the precise and intended location for managing and configuring which applications open specific file types, protocols, or perform designated functions like web browsing or email. Users can directly select their preferred default applications for common tasks, such as setting a specific web browser or media player, directly addressing issues where system updates might have inadvertently altered these crucial associations.

Why this answer

The 'Default apps' page under Apps in the Settings app is the specific location where you can change the default web browser from Microsoft Edge to Google Chrome. This setting controls which application handles protocols like HTTP and HTTPS, and it allows you to set Chrome as the default by selecting it from the list of installed browsers.

Exam trap

CompTIA often tests the misconception that 'Apps & features' is the correct location for setting defaults, but candidates must remember that default app configuration is a separate, dedicated section under 'Default apps' within the Apps category.

How to eliminate wrong answers

Option A is wrong because 'Apps & features' is used to manage installed applications (uninstall, modify, or move them) but does not provide any option to set default applications or file associations. Option B is wrong because 'Personalization > Start' controls the appearance and behavior of the Start menu, such as which folders appear and whether to show recently added apps, and has nothing to do with default browser settings. Option D is wrong because 'Update & Security > Windows Update' is solely for managing Windows updates, including checking for, installing, and configuring update settings, and does not include any functionality for configuring default apps.

Full explanation →
369
MCQeasy

A company policy requires that all USB flash drives be encrypted before use. A technician needs to configure a new drive for a manager who will store confidential client data. Which built-in Windows tool should the technician use?

A.EFS (Encrypting File System)
B.BitLocker To Go
C.Windows Defender Firewall
D.Device Manager
AnswerB

BitLocker To Go is the correct solution because it is specifically engineered to provide full-disk encryption for removable data drives, such as USB flash drives. This robust security feature ensures that all data on the drive is encrypted, protecting sensitive information from unauthorized access if the device is lost or stolen. It supports various authentication methods, including passwords or smart cards, making it ideal for enforcing corporate security policies on portable storage devices.

Why this answer

BitLocker To Go is the correct built-in Windows tool for encrypting removable drives like USB flash drives. It provides full-disk encryption specifically designed for portable storage, ensuring that the confidential client data on the drive is protected if the drive is lost or stolen.

Exam trap

CompTIA often tests the distinction between EFS (file-level encryption) and BitLocker (full-disk encryption), and the trap here is that candidates may confuse EFS with BitLocker To Go because both involve encryption, but EFS cannot encrypt entire removable drives for portable use.

How to eliminate wrong answers

Option A is wrong because EFS (Encrypting File System) encrypts individual files and folders on NTFS volumes, not entire removable drives, and it does not support encrypting USB flash drives for use on other systems without additional configuration. Option C is wrong because Windows Defender Firewall is a network security tool that filters incoming and outgoing traffic based on rules; it does not provide any data-at-rest encryption for storage devices. Option D is wrong because Device Manager is used to manage hardware drivers and device settings, not to perform encryption or security configurations on storage media.

Full explanation →
370
MCQmedium

A technician is troubleshooting a Windows 10 system that fails to boot with a 'Bootmgr is missing' error. They need to repair the boot configuration data (BCD) from the Windows Recovery Environment. Which command should they use?

A.bootrec /fixmbr
B.bootrec /fixboot
C.bootrec /rebuildbcd
D.sfc /scannow
AnswerC

This command is the correct solution because it scans all disks for compatible Windows installations and then allows the user to add them to a newly created Boot Configuration Data (BCD) store. The BCD store contains critical boot information, including the location of the operating system files and boot options. Rebuilding the BCD directly addresses scenarios where the 'Bootmgr is missing' error occurs due to a corrupt, missing, or improperly configured BCD, ensuring the system can locate and load the Windows operating system.

Why this answer

The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is corrupted or missing. The `bootrec /rebuildbcd` command scans all disks for Windows installations and allows you to rebuild the BCD store from scratch, which directly resolves this issue. In contrast, `bootrec /fixmbr` and `bootrec /fixboot` repair the master boot record and boot sector, respectively, but do not rebuild the BCD store.

Exam trap

The trap here is that candidates often confuse `bootrec /fixboot` with repairing the boot configuration data, but `fixboot` only repairs the boot sector, not the BCD store, which is the actual cause of the 'Bootmgr is missing' error.

How to eliminate wrong answers

Option A is wrong because `bootrec /fixmbr` rewrites the master boot record (MBR) to the system partition, which addresses boot sector corruption but does not repair the BCD store. Option B is wrong because `bootrec /fixboot` writes a new boot sector to the system partition, which fixes boot sector issues but does not rebuild the BCD store. Option D is wrong because `sfc /scannow` checks and repairs system file integrity, but it does not operate on the BCD store or boot configuration data.

Full explanation →
371
MCQmedium

During a security incident investigation, a technician finds that an attacker called the help desk, pretended to be a new employee who forgot their password, and successfully reset it. The attacker knew the employee's name and department. Which social engineering technique was used?

A.Phishing
B.Pretexting
C.Tailgating
D.Shoulder surfing
AnswerB

Pretexting is a sophisticated social engineering tactic where an attacker creates a convincing, fabricated scenario or 'pretext' to manipulate a target into divulging specific information or performing a particular action. This often involves extensive prior research to establish a believable false identity and a compelling story, such as impersonating a high-level executive or a vendor, to gain the target's trust. The attacker's goal is to exploit human psychology and a perceived legitimate need for information, typically through direct interaction like a phone call or in-person conversation.

Why this answer

Pretexting is a social engineering technique where the attacker fabricates a scenario (pretext) to manipulate a target into performing an action. In this case, the attacker called the help desk, assumed the identity of a new employee, and used the known details (name and department) to create a believable story, convincing the help desk to reset the password. This relies on psychological manipulation rather than technical exploitation.

Exam trap

CompTIA often tests the distinction between pretexting and phishing by emphasizing that pretexting involves direct impersonation and a fabricated scenario (often via phone or in person), while phishing relies on electronic communication like email or text messages.

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing involves sending deceptive emails or messages that trick users into revealing sensitive information or clicking malicious links, not directly calling and impersonating someone to reset a password. Option C (Tailgating) is wrong because tailgating is a physical security breach where an unauthorized person follows an authorized individual into a restricted area without proper authentication, not a phone-based impersonation. Option D (Shoulder surfing) is wrong because shoulder surfing involves directly observing someone's screen or keyboard to steal information like passwords, not fabricating a story over the phone.

Full explanation →
372
MCQeasy

A technician is writing a batch script to automate the installation of a software package on multiple Windows workstations. The script needs to check if the software is already installed before attempting installation. Which scripting construct should the technician use?

A.A for loop
B.An if statement
C.A variable
D.A while loop
AnswerB

An `if` statement is the fundamental control structure used to execute commands conditionally based on the evaluation of a specified condition. It checks whether a given condition, such as the existence of a file or the value of a variable, is true or false. If the condition evaluates to true, the associated block of commands is executed exactly once, making it ideal for checking prerequisites like an existing installation before proceeding with a new action.

Why this answer

This tests knowledge of conditional logic in scripting. An 'if' statement allows the script to check a condition (e.g., existence of a registry key or file) and execute code only if the condition is true or false. Loops are for repetition, and variables store data, not control flow.

Full explanation →
373
MCQeasy

A user reports that their virtual machine, which is used for testing software, suddenly lost network connectivity. The host machine is connected to the internet and can browse websites. The VM is configured with a bridged network adapter. What is the most likely cause of this issue?

A.The host's firewall is blocking the VM's network traffic.
B.The VM's DHCP lease has expired and it failed to obtain a new IP address.
C.The virtual switch on the host has been disabled.
D.The VM's operating system is corrupted.
AnswerB

When a virtual machine's DHCP lease expires, it loses its assigned IP address, subnet mask, and default gateway configuration. If the VM then fails to successfully renew its lease with the DHCP server, it will no longer have valid network parameters, effectively severing its connection to the network. This is a common occurrence in bridged networking where the VM directly relies on the physical network's DHCP server for its addressing.

Why this answer

In a bridged network configuration, the VM obtains its IP address directly from the same DHCP server as the host (e.g., the home router). If the DHCP lease expires and the VM fails to renew it (due to a network hiccup, DHCP server overload, or misconfigured lease time), the VM will lose its IP address and network connectivity, while the host remains unaffected because it maintains its own active lease. This is the most common cause of isolated VM connectivity loss in a bridged setup.

Exam trap

CompTIA A+ exams often test the misconception that a bridged adapter shares the host's IP address; candidates incorrectly assume the VM inherits the host's connectivity, but in reality, the VM must obtain its own IP via DHCP, and a lease expiration can cause a silent disconnect while the host remains online.

How to eliminate wrong answers

Option A is wrong because a host firewall typically filters traffic based on IP addresses or ports, but since the VM uses a bridged adapter, it appears as a separate device on the network; the host firewall does not inherently block the VM's traffic unless explicitly configured to do so, and the question states the host is connected and browsing, making a host firewall block unlikely. Option C is wrong because if the virtual switch on the host were disabled, the host itself would likely lose network connectivity or the VM would not even start, but the host is working fine; the virtual switch is a software component that remains active as long as the hypervisor is running. Option D is wrong because a corrupted OS would typically cause boot failures, crashes, or application errors, not a sudden, isolated loss of network connectivity while the VM remains running; network stack corruption is possible but far less common than a DHCP lease issue.

Full explanation →
374
MCQmedium

A help desk technician receives a complaint that a user’s custom software application stopped working after a Windows update was installed automatically overnight. The technician checks the system and finds the update is not in the approved change log. What should the technician do next?

A.Reinstall the custom application immediately
B.Roll back the Windows update and document the incident
C.Leave the update in place and submit a new change request for the application
D.Disable Windows Update on the workstation permanently
AnswerB

Rolling back the Windows update is the most direct and efficient method to restore the system to its last known good configuration, thereby immediately resolving the application's functionality issue caused by the unauthorized change. This action directly addresses the identified root cause. Concurrently, documenting the incident is crucial for maintaining a comprehensive audit trail, identifying the source of the unauthorized update, and implementing preventative measures to ensure future compliance with change management policies.

Why this answer

The update was installed without authorization (not in the approved change log), violating change management policy. The technician should immediately roll back the update to restore application functionality and then document the incident to ensure proper change control procedures are followed. This aligns with the CompTIA A+ change management process: identify the unauthorized change, reverse it, and report it.

Exam trap

The trap here is that candidates may think restoring functionality (Option A) or preventing future updates (Option D) is the priority, but CompTIA emphasizes that following change management documentation and incident reporting is the correct first step, not just fixing the symptom.

How to eliminate wrong answers

Option A is wrong because reinstalling the custom application does not address the root cause (the unauthorized Windows update) and may waste time if the update breaks the application again. Option C is wrong because leaving an unauthorized update in place bypasses change management controls and could cause further instability; a new change request should be submitted before, not after, the change is applied. Option D is wrong because permanently disabling Windows Update leaves the system vulnerable to security patches and is an overreaction; the proper response is to manage updates through an approved change process, not disable the service entirely.

Full explanation →
375
MCQhard

A technician needs to deploy a custom Windows 10 image to 50 identical workstations. The image must include specific drivers, applications, and settings. Which tool should the technician use to create and manage the deployment image?

A.System Preparation Tool (Sysprep)
B.Deployment Image Servicing and Management (DISM)
C.Windows Preinstallation Environment (Windows PE)
D.Windows Assessment and Deployment Kit (Windows ADK)
AnswerA

The System Preparation Tool (Sysprep) is the correct utility because it generalizes a Windows installation by removing system-specific data, such as unique security identifiers (SIDs) and hardware-specific drivers. This crucial process prepares the operating system image to be deployed on multiple computers with potentially dissimilar hardware without encountering conflicts or duplicate SIDs. Sysprep ensures that each deployed machine receives a fresh, unique identity upon its first boot, facilitating large-scale custom Windows deployments.

Why this answer

System Preparation Tool (Sysprep) is used to generalize a Windows installation so it can be imaged and deployed to multiple computers. DISM is used to capture and apply images, but Sysprep is required to prepare the OS for imaging. Windows PE is a minimal OS for deployment tasks, not for creating the image.

Windows ADK includes deployment tools but Sysprep is the specific tool for image preparation.

Full explanation →
Page 4

Page 5 of 7

Page 6

All pages

1234567

Practice 220-1202 by domain

Target a specific domain to shore up weak areas.

Operating SystemsSecuritySoftware TroubleshootingOperational Procedures
See all domains with question counts →