CompTIA A+ Core 2 220-1202 (220-1202) — Questions 376–450

This question tests knowledge of Android's built-in diagnostic tools. The correct answer is the 'Diagnostics' or 'Test' mode, often accessed via the dialer code or settings, which allows hardware testing without third-party apps. This is a standard feature for verifying touchscreen integrity after physical damage.

Assigned Access (Kiosk Mode) locks down the device to run only one app and restricts access to other system features. It is designed for public or kiosk scenarios.

The most likely cause is that the security update was applied automatically by Windows Update. In many corporate environments, Windows Update is configured to install critical patches automatically without requiring manual intervention or logging in the technician's change documentation. This explains why the technician found no record of the update, even though it was installed and caused the printer driver to stop functioning.

When a network printer is moved to a different floor, its physical location and network connectivity change. The network diagram is the authoritative document that records device locations, switch ports, IP addresses, and cabling paths. Updating it ensures that troubleshooting, asset tracking, and future moves remain accurate, directly supporting change management and documentation best practices.

Password confidentiality is a core security principle; passwords must be kept secret and not be easily observable. Writing passwords on sticky notes directly violates this by making them visible to anyone nearby. This question tests the understanding of password security best practices and the concept of confidentiality.

The correct setting is to turn off 'Password protected sharing' in the Advanced sharing settings. This allows anyone on the network to access shared folders without entering a username and password, which is necessary for the scenario described.

Option B is correct because a failing power supply leaking a brown, oily substance (typically from swollen or ruptured capacitors) is classified as hazardous e-waste due to toxic materials like lead, cadmium, and electrolyte fluids. Placing it in an anti-static bag prevents short circuits during transport, and labeling it as hazardous ensures proper disposal per environmental regulations such as the Resource Conservation and Recovery Act (RCRA) or local e-waste directives.

NTFS permissions control access at the folder level on the server. Even if share permissions allow access, restrictive NTFS permissions can block a specific user. The technician should check the effective permissions on that folder for the user.

The Print Spooler service is a Windows service that manages print jobs sent to the printer. Its startup type (e.g., Automatic, Manual, Disabled) is configured in the Services console, which is accessed via Administrative Tools > Services. Device Manager and Printers & scanners do not provide service startup type settings, and System > Advanced system settings deals with performance and user profiles, not services.

Propping a door open bypasses access control systems, allowing unauthorized individuals to enter without credentials. This is a common physical security violation that undermines the entire access control mechanism.

BitLocker protects data when the system is off. If the laptop was unlocked, data is accessible. A pre-boot authentication PIN or password ensures that even if the device is powered on, the drive remains locked until the PIN is entered.

This is a whaling attack, a type of phishing that targets high-profile individuals or impersonates them to trick lower-level employees. The attacker used a spoofed email address to impersonate the CEO and create a sense of urgency.

High memory usage (90%+) with 8 GB of RAM indicates that the system is running out of physical memory, causing it to use the hard drive as virtual memory, which is very slow. The best upgrade is to add more RAM to reduce reliance on the slow hard drive paging.

Windows Deployment Services (WDS) is designed for network-based deployment of Windows images to multiple computers. It can be configured with answer files to automate computer naming and domain joining, making it the ideal tool for this scenario.

Computer Configuration policies in Group Policy apply to the computer itself and take effect at boot, before user logon. User Configuration policies apply only after a user logs on. To ensure a setting is applied before any user logs on, it must be placed under Computer Configuration.

The correct answer is B because an if-else statement is the most appropriate scripting method to check the status of a specific Windows service and conditionally execute a command or start the service. In PowerShell, you can use `Get-Service` to retrieve the service status and then an if-else block to evaluate whether the `Status` property equals 'Running'. This provides clear, linear logic that directly matches the requirement without unnecessary complexity.

The Ease of Access Center in Windows 10 is the dedicated Control Panel tool for configuring accessibility features, including Magnifier and high-contrast themes. It provides settings to enable Magnifier to start automatically at login and to apply high-contrast themes system-wide, directly addressing the user's needs.

CRT monitors contain leaded glass in the cathode ray tube and significant amounts of lead in the solder and phosphor coating, making them hazardous electronic waste that must be handled separately under regulations like the EPA's RCRA and the EU's WEEE Directive. Unlike LCDs, which may contain mercury in backlights but are often managed differently, CRTs require specialized recycling to prevent lead leaching into groundwater.

In a VDI environment, over-provisioning resources like memory leads to resource contention and poor performance. The high memory utilization indicates the host does not have enough physical memory to support all running virtual desktops, causing swapping and slowdowns. This scenario tests understanding of resource allocation in virtualized environments.

User Account Control (UAC) prompts for consent or credentials even for administrators when changes require elevated permissions, such as writing to protected folders like Program Files. Disabling UAC or running the installer as administrator can resolve this.

This question covers iOS battery management tools. The correct answer is the Battery Health feature, which shows maximum capacity and peak performance capability, and can indicate if the battery needs service. Checking this first helps rule out hardware degradation before troubleshooting software.

Polymorphic malware changes its signature, making signature-based detection ineffective. Heuristic analysis and behavior-based detection tools, such as those used by advanced endpoint detection and response (EDR) solutions, can identify malware based on suspicious actions rather than static signatures. Running a tool that uses heuristic scanning can detect the malware's behavior, such as file encryption or unauthorized registry changes.

Option B is correct because the most common cause of a previously working email account suddenly failing to sync is an authentication issue, such as a changed password or expired credentials. Since other internet services work, the network connectivity is fine, so the problem is isolated to the email app's authentication. Verifying the username and password in the app's account settings is the quickest, least disruptive first step before escalating to more drastic measures.

The correct answer is B because many iPad models (particularly older ones like iPad 2 through iPad 4, and some iPad mini models) include a physical switch on the side edge that can be configured to act as a mute/orientation lock toggle. Even if the software rotation lock in Control Center is off, this hardware switch can independently lock the screen orientation, overriding the software setting. Checking this physical switch is the logical next step before attempting more invasive troubleshooting.

Phishing is a social engineering attack where attackers impersonate a trusted entity to trick victims into revealing sensitive information. The suspicious link is a key indicator. This question tests the ability to recognize phishing attempts based on common characteristics like urgent language and deceptive links.

Bootrec.exe is the command-line tool specifically designed to repair the Boot Configuration Data (BCD) and Master Boot Record (MBR). It is used from the Windows Recovery Environment command prompt. Other tools like SFC or DISM target system files or image health, not boot configuration.

Option A is correct because it politely declines the gift while citing the specific company policy limit of $20, which aligns with professional conduct and ethical guidelines. This response maintains trust and integrity without offending the user, as required by the CompTIA A+ 220-1202 exam objectives on professionalism and communication.

Option C is correct because enforcing an execution policy that requires scripts to be digitally signed ensures that only scripts signed by a trusted publisher can run. If the attacker modified the script, the digital signature would become invalid, and the execution policy would block the script from running, preventing the malicious commands from executing.

This is likely a whaling or spear phishing attack impersonating the CEO. The technician should never share passwords and should verify the request through a separate communication channel (e.g., phone call or in-person) before taking any action. Reporting to the security team is also critical.

WPA3-SAE uses Simultaneous Authentication of Equals (SAE), which provides forward secrecy. This means that even if an attacker captures the handshake, they cannot crack the passphrase offline because the handshake does not contain enough information to derive the key.

BitLocker To Go encrypts removable drives with a password or recovery key. To access the drive on a new Windows 10 workstation, the technician must provide the user with the drive's password or recovery key, as the drive is already encrypted and requires authentication at mount time. No additional configuration is needed on the workstation beyond entering the correct credentials.

This tests the chown command with the -R option for recursive changes. chown -R :datagroup /srv/data changes the group for the directory and all files/subdirectories.

Printers with hard drives can retain copies of printed documents. Physically securing the printer in a locked room or cabinet prevents unauthorized persons from removing the drive or accessing the device directly.

The correct answer is C because find / -perm -4000 searches for files with the SUID bit set (octal 4000). The -4000 notation matches any file that has the SUID bit, regardless of other permissions.

Windows Defender Offline Scan boots from a trusted environment to detect and remove persistent malware that standard scans miss. It is ideal for rootkits or stubborn infections that hide from a live OS.

This tests the cp command with preservation of permissions and ownership. cp -p preserves the original file's attributes, which is important for a system script.

Controlled Folder Access (part of Windows Defender Exploit Guard) allows only trusted apps to access protected folders like Documents, Pictures, etc. It can be configured via Windows Security > Virus & threat protection > Ransomware protection. This effectively blocks ransomware from encrypting files.

Safe Mode loads only essential drivers and services, preventing most malware from running. This allows antivirus tools to clean infections more effectively. It is accessed via advanced startup options.

Option B is correct because the change management policy includes an emergency change process for urgent security vulnerabilities. Applying the patch immediately and documenting it as an emergency change aligns with ITIL best practices and the company's policy, ensuring the vulnerability is mitigated without delay while maintaining compliance through post-implementation review.

The correct answer is A because the Remote Desktop setting is managed through System Properties > Remote tab, which can be accessed via Control Panel > System > Remote Desktop. Disabling it here prevents the user from easily re-enabling it through the Settings app, as the Control Panel path requires administrative privileges to modify, whereas the Settings app may allow a standard user to toggle it. This directly addresses the audit finding by enforcing the policy at the system level.

The lag described is a classic symptom of network latency or insufficient bandwidth, which directly impacts the responsiveness of remote desktop protocols like RDP or VNC. These protocols transmit screen updates and input events in real time; high latency delays the round-trip of packets, while low bandwidth can cause frame drops or compression artifacts, resulting in the noticeable delay between the technician's actions and the screen update.

iOS allows per-app location permissions, including setting to 'While Using the App' to prevent background usage. This reduces battery drain while maintaining functionality. Disabling all location services or resetting settings is too drastic.

The absence of HTTPS and the lookalike page strongly indicate a phishing attempt. Phishing sites often mimic legitimate sites to steal credentials, and the lack of encryption is a red flag. Users should never enter credentials on non-HTTPS pages, especially from email links.

Software Restriction Policies can be bypassed by renaming executables. Using AppLocker with publisher rules (based on digital signatures) prevents this because it identifies software by its certificate, not file name.

This question covers device installation restrictions via Group Policy or Local Security Policy. The 'Allow installation of devices that match any of these device IDs' policy can be configured with a list of approved hardware IDs, blocking all others. This is a common method for controlling USB device usage in enterprise environments.

System Settings (formerly System Preferences) contains the Users & Groups pane, which is the central location for creating, deleting, and managing user accounts on macOS. It allows setting account types (Administrator, Standard, Managed with Parental Controls) to control permissions and software installation. Terminal commands exist but are not the recommended primary tool for this task.

The ipconfig /release command releases the current DHCP lease, and ipconfig /renew requests a new IP address from the DHCP server. This is the standard method to refresh IP configuration. Other commands like ping test connectivity, nslookup queries DNS, and netstat shows network connections.

Application whitelisting allows only pre-approved programs to execute, blocking all others by default. This is the most effective way to prevent unauthorized software installation. Software Restriction Policies or AppLocker in Windows can enforce this.

Option B is correct because the technician must validate the user's concern through proper research rather than dismissing it. Checking the software's documented compatibility with the specific antivirus program and testing in an isolated sandbox environment prevents potential system instability or security bypasses without risking the production system.

WPA2-Enterprise requires a username and password or certificate for authentication, not a pre-shared key. The phone's WPA2-PSK setting is incompatible with the network's authentication method.

The correct answer is `taskkill /IM malware.exe /F`. This forcefully terminates the process by image name. `tasklist` only lists processes, `net stop` stops services (not processes), and `shutdown` restarts the computer.

The 'INACCESSIBLE_BOOT_DEVICE' error often indicates a driver or disk configuration issue caused by an update. The Startup Repair tool in the Windows Recovery Environment (WinRE) can automatically diagnose and fix common boot problems like this. It is the safest and fastest initial step before trying more invasive methods.

Local Users and Groups (lusrmgr.msc) is the snap-in for managing user accounts, groups, and local security policies on a standalone Windows system. It allows creating, modifying, and deleting users and setting password requirements.

Configuring the browser to prompt for download location and then blocking downloads via Group Policy or registry is effective. The simplest approach is to disable downloads entirely in the browser settings or use a kiosk mode that restricts functionality.

The advanced security settings in the folder's Properties dialog (accessible from File Explorer) allow you to check encryption (EFS) and compression attributes. These attributes can override NTFS permissions. The other tools do not provide this information.

Option A is correct because the setting to control how Windows 10 handles driver updates from Windows Update is located under Update & Security > Windows Update > Advanced options. Here, you can toggle the 'Update drivers automatically' option, which determines whether Windows Update will automatically download and install driver updates for your hardware.

AutoPlay is the Windows Control Panel tool specifically designed to manage the default behavior when removable media like USB flash drives are connected. By configuring AutoPlay, you can set the system to 'Take no action' instead of automatically opening the folder and playing media files. This directly addresses the customer's frustration by stopping the automatic playback and folder opening.

Option A is correct because, after resolving the issue, the technician must document the resolution in the change log to maintain an accurate audit trail of changes and their outcomes. This aligns with change management best practices, ensuring that future technicians can see what was done to fix the problem and avoid repeating the same troubleshooting steps. Closing the ticket after documenting the resolution completes the incident management lifecycle.

The user can access webmail via Safari but cannot receive emails in the native Mail app. This indicates the email account credentials are valid and the network connection is working, but the incoming mail server (POP3/IMAP) settings are misconfigured. Incorrect incoming server hostname, port, or SSL/TLS settings would prevent the Mail app from downloading new messages while leaving webmail unaffected.

Rack-mount locks secure the server chassis within the rack, preventing unauthorized removal or tampering with individual servers. This is a standard physical control for multi-tenant or shared spaces where racks are accessible.

NTFS permissions control access at the file system level, while share permissions control network access. A user-specific deny entry on the NTFS permissions can block an individual user while allowing others.

Windows Defender Offline (now part of Microsoft Defender Antivirus) can be run from the Windows Recovery Environment to scan for malware without booting the infected OS. This bypasses malware that blocks security tools in the normal Windows environment. It is the appropriate tool for this scenario.

The directory has group read and execute permissions (r-x) but no write permission for the group. Since the user is in the 'staff' group, they need group write permission to create or modify files.

The most important safety step before opening a computer case is to unplug the power cord from the wall outlet. This ensures complete disconnection from the AC mains, eliminating the risk of electric shock from exposed internal components, such as the power supply unit (PSU) capacitors, which can hold a dangerous charge even when the system is off. While other steps like wearing an anti-static wrist strap are good practices, they do not address the primary hazard of lethal voltage.

RDP (Remote Desktop Protocol) is the native protocol used by Windows for remote desktop connections. Windows 10 Pro includes an RDP server that listens on TCP port 3389, allowing clients such as the Microsoft Remote Desktop client on Linux to connect and provide a full graphical desktop experience. The technician must ensure the 'Allow remote connections to this computer' setting is enabled and that the Windows Firewall permits inbound RDP traffic.

System Settings > General > Login Items (or System Preferences > Users & Groups > Login Items on older macOS) lists all applications and services that start automatically when the user logs in. From there, the user can select an item and click the minus button to disable it. Activity Monitor shows running processes but does not manage startup items.

Option B is correct because the most effective first step to prevent weak passwords is to enforce a strong password policy via Group Policy. This centrally mandates complexity requirements (e.g., uppercase, lowercase, digits, special characters) and a minimum length (typically 8–14 characters), which directly blocks the use of simple, common passwords at the domain level. Unlike awareness campaigns or reactive measures, this technical control proactively enforces security standards across all domain accounts.

Option C is correct because a rootkit that hides its processes from Task Manager and evades the installed antivirus operates at a deep level within the operating system, often in kernel mode. Booting from a rescue disk (e.g., a live CD/USB with an offline scanner) loads a clean operating system environment, preventing the rootkit from loading and allowing the antivirus to scan the infected system's files without interference. This offline approach is the most effective remediation step when the rootkit is actively hiding from the installed AV in the normal OS context.

Option C is correct because the VPN settings in Windows are located under Network & Internet > VPN. This is the dedicated section where users can add, configure, and manage VPN connections, including setting up a new VPN profile with the server address, authentication method, and protocol (e.g., IKEv2, SSTP, or L2TP/IPsec). The network tray only shows existing connections; to add a new VPN, you must navigate to this specific settings page.

Glare from overhead lighting is a common cause of eye strain. The simplest and most effective fix is to reposition the monitor so that the light source is perpendicular to the screen, reducing direct glare.