CompTIA A+ Core 2 220-1202 220-1202 Questions 376–450 | Page 6/7

376

MCQmedium

A technician is troubleshooting a PowerShell script that collects system information and writes it to a log file. The script runs without errors but the log file is empty. The script uses Out-File to write data. What is the most likely issue?

A.The script is not running with administrative privileges.

B.The Out-File cmdlet is misspelled.

C.The command before Out-File does not produce any output.

D.The log file path contains a forward slash instead of a backslash.

AnswerC

The Out-File cmdlet functions by taking input from the PowerShell pipeline. If the command preceding Out-File (e.g., Get-Process -Name "NonExistentProcess") returns no objects or an empty collection, Out-File will still execute successfully. In this scenario, Out-File will create the specified log file but write zero bytes of content to it, resulting in an empty file. This is a common cause of empty output files when a filter or query yields no results.

Why this answer

If a PowerShell command does not produce output, piping it to Out-File will result in an empty file. The issue is that the command used does not generate any output.

Full explanation →

377

MCQhard

A user reports that their Windows 11 laptop's search bar is not returning results for local files, though web searches work. You suspect the indexing service is not running or the index is corrupted. Which tool should you use to rebuild the search index?

A.Services.msc

B.Indexing Options in Control Panel

C.Task Manager

D.Windows Settings > Privacy & security > Searching Windows

AnswerB

Indexing Options, accessible via the Control Panel, is the dedicated utility for managing the Windows search index. Within this tool, users can click the 'Advanced' button, which reveals an option to 'Rebuild' the index. This action completely deletes the existing search index database and then re-scans all specified locations to create a new, fresh index, effectively resolving corruption or inconsistencies that impair search functionality. This is the precise method for a full index reconstruction.

Why this answer

The Indexing Options control panel (accessible via Control Panel or by searching 'indexing options') provides a direct interface to manage the Windows Search index, including the ability to rebuild it. Rebuilding the index is the appropriate fix when the index is corrupted or not functioning, as it forces Windows to re-scan all indexed locations and create a fresh index database, resolving issues where local file searches fail but web searches (which do not rely on the local index) still work.

Exam trap

The trap here is that candidates confuse the 'Searching Windows' settings in the modern Windows Settings app (which controls privacy and cloud search options) with the legacy Indexing Options control panel that actually contains the rebuild function.

How to eliminate wrong answers

Option A is wrong because Services.msc allows you to start, stop, or restart the Windows Search service, but it does not provide a direct option to rebuild the search index; rebuilding requires the Indexing Options interface. Option C is wrong because Task Manager is used to manage running processes, monitor performance, and start/stop applications, but it has no capability to manage or rebuild the search index. Option D is wrong because Windows Settings > Privacy & security > Searching Windows controls privacy-related search settings (e.g., whether to include cloud content or history), but it does not include a rebuild option for the local search index; the rebuild function is exclusively in the legacy Indexing Options control panel.

Full explanation →

378

MCQeasy

A customer calls saying their home Wi-Fi network suddenly stopped working after they changed the router's security mode from WPA2-PSK to WPA2-Enterprise. All their devices previously connected fine. What is the most likely cause of the problem?

A.The router's firmware is outdated.

B.The devices do not support the new encryption cipher.

C.The router is now requiring a username and password from a RADIUS server, which the home network lacks.

D.The SSID was changed during the configuration.

AnswerC

WPA2-Enterprise mode is designed for corporate or institutional environments, leveraging 802.1X authentication to provide centralized user management and stronger security. This mode requires a Remote Authentication Dial-In User Service (RADIUS) server to validate user credentials (username and password) for each device attempting to connect. Standard home networks lack the complex infrastructure of a dedicated RADIUS server, meaning client devices cannot complete the required authentication handshake, leading to connection failures.

Why this answer

WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to validate credentials (username and password). Home routers typically lack a built-in RADIUS server, so after changing to WPA2-Enterprise, the router cannot authenticate any client, causing all devices to fail to connect. The previous WPA2-PSK mode used a simple pre-shared key, which worked without any external server.

Exam trap

In the CompTIA A+ exam, it's important to distinguish between WPA2-PSK (pre-shared key, no server) and WPA2-Enterprise (requires a RADIUS/AAA server). The trap here is that candidates may assume all WPA2 modes work identically or blame encryption cipher support instead of the missing authentication infrastructure.

How to eliminate wrong answers

Option A is wrong because an outdated firmware would not cause a sudden failure immediately after changing the security mode; the issue is directly tied to the authentication method change, not firmware version. Option B is wrong because WPA2-Enterprise can use the same encryption ciphers (AES/CCMP) as WPA2-PSK; device support for the cipher is not the problem—the problem is the missing authentication server. Option D is wrong because the SSID was not changed according to the question; the customer only changed the security mode, and an SSID change would cause devices to not see the network, not fail authentication.

Full explanation →

379

MCQmedium

A technician receives a ticket from a user who says their email is 'broken.' Upon investigation, the technician finds that the user's mailbox is full. The user is known for being confrontational. Which response best demonstrates professionalism?

A."Your mailbox is full. Delete some emails and empty your trash. Let me know if that fixes it."

B."This is a common issue when people don't manage their inbox. Please clean it up."

C."I'll increase your mailbox quota so you don't have to delete anything."

D."Your email isn't broken; you just have too many messages."

AnswerA

This response exemplifies professional IT support by providing a clear, actionable solution without assigning blame. It directly addresses the technical symptom of a full mailbox and offers standard user-level remediation steps: deleting unnecessary emails and emptying the trash. Furthermore, it includes a crucial follow-up request, "Let me know if that fixes it," which ensures the issue is fully resolved and demonstrates commitment to user satisfaction, aligning with best practices for incident management.

Why this answer

It directly addresses the root cause (full mailbox) with a clear, actionable solution (delete emails and empty trash) while maintaining a neutral, professional tone. The technician avoids blaming the user or escalating the situation, which is critical when dealing with a confrontational user. This response focuses on resolving the issue without unnecessary commentary, aligning with CompTIA's emphasis on professionalism and effective communication.

Exam trap

CompTIA often tests the trap of choosing a technically expedient solution (like increasing quota) over a professional communication approach, leading candidates to overlook the importance of de-escalating a confrontational user by providing a clear, non-judgmental resolution.

How to eliminate wrong answers

Option B is wrong because it includes a judgmental phrase ('people don't manage their inbox') that can be perceived as condescending, which may provoke a confrontational user and violates professional communication standards. Option C is wrong because increasing the mailbox quota without addressing the underlying storage issue is a temporary workaround that could lead to future problems (e.g., exceeding server limits or violating organizational email retention policies), and it fails to educate the user on proper mailbox management. Option D is wrong because it dismisses the user's concern by stating 'your email isn't broken,' which invalidates their experience and can escalate tension; the technician should acknowledge the issue while explaining the cause professionally.

Full explanation →

380

MCQeasy

A small business owner reports that after upgrading their wireless router to a newer model, several older laptops running Windows 7 can no longer connect to the Wi-Fi network. The new router is configured to use WPA3. What is the most likely reason for the connection failures?

A.The laptops have outdated wireless drivers that do not support WPA3.

B.The router's firewall is blocking the older laptops' MAC addresses.

C.The laptops are using an incompatible encryption cipher like TKIP.

D.The router's SSID is hidden, and the laptops cannot discover it.

AnswerA

This is the correct answer. WPA3 introduces significant cryptographic enhancements, including the Simultaneous Authentication of Equals (SAE) handshake, which requires specific hardware capabilities in the wireless adapter and corresponding driver support, as well as updated operating system components. Older laptops, particularly those running Windows 7, predate WPA3 standardization and therefore lack the necessary drivers and OS support to implement these advanced security protocols, preventing them from authenticating with a WPA3-only network.

Why this answer

WPA3 is a newer security protocol that requires both the router and the client device to support it. Older laptops running Windows 7 typically have wireless network adapters and drivers that were designed before WPA3 was standardized (2018), so they only support WPA2 or earlier protocols. Without updated drivers that include WPA3 support, these laptops cannot authenticate with the router, causing the connection failures.

Exam trap

The 220-1202 exam often tests the misconception that encryption ciphers (like TKIP) are the primary cause of incompatibility, when in fact the core issue is the security protocol version (WPA3 vs. WPA2) and the driver's lack of support for the new authentication handshake.

How to eliminate wrong answers

Option B is wrong because MAC address filtering is a separate feature from security protocol support; if the router's firewall were blocking MAC addresses, the laptops would not even see the network or would be explicitly denied, but the issue is specifically about authentication after the upgrade to WPA3. Option C is wrong because TKIP is an encryption cipher used with WPA and WPA2, not WPA3; WPA3 uses AES-CCMP or GCMP-256, and while older laptops might use TKIP with WPA2, the core incompatibility here is the protocol version itself, not the cipher. Option D is wrong because a hidden SSID does not prevent a client from connecting if the SSID is manually entered; the problem is the authentication handshake failure due to WPA3 incompatibility, not network discovery.

Full explanation →

381

MCQhard

A user reports that their computer is infected with a virus that has encrypted all their personal files and left a text file with instructions to pay a ransom. The technician has verified the infection is ransomware. The company has a backup policy. What is the best course of action to recover the data?

A.Pay the ransom and hope the decryption key is provided.

B.Use a ransomware decryption tool from a reputable source.

C.Restore the files from a recent backup after removing the malware.

D.Reinstall the operating system and hope the files become accessible.

AnswerC

Restoring files from a recent, clean backup is the most effective and recommended method for recovering from a ransomware attack without engaging with the attackers. After ensuring the malware has been completely removed from the infected system, a technician can confidently overwrite the encrypted files with unencrypted versions from a verified backup. This approach bypasses the need for decryption, guarantees data integrity (assuming the backup is sound), and avoids supporting criminal enterprises.

Why this answer

The company has a backup policy, meaning a recent, clean backup should exist. Restoring from backup after removing the ransomware ensures data recovery without paying criminals or relying on unreliable decryption tools. This aligns with best practices for ransomware incidents: isolate, remove, then restore from verified backups.

Exam trap

CompTIA often tests the misconception that paying the ransom or using a decryption tool is a viable recovery method, when the correct answer is always to restore from a known-good backup after malware removal.

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee the decryption key will be provided; attackers often take the money and disappear, and paying funds further criminal activity. Option B is wrong because ransomware decryption tools from reputable sources are only effective for specific, known ransomware variants; the infection could use a unique or custom encryption algorithm, making such tools useless. Option D is wrong because reinstalling the operating system only wipes the system drive; it does not decrypt or recover the encrypted personal files, which remain encrypted on the storage media.

Full explanation →

382

MCQmedium

A technician is troubleshooting a VM that fails to boot with the error 'Operating system not found'. The VM was working yesterday. The technician checks the virtual machine settings and sees that the virtual hard disk is attached to the IDE controller. What should the technician do first?

A.Reattach the virtual hard disk to the SCSI controller

B.Check the VM's boot order in the BIOS and ensure the virtual hard disk is first

C.Increase the VM's memory allocation

D.Restore the VM from a recent snapshot

AnswerB

Checking the VM's boot order in the virtual BIOS/UEFI and ensuring the virtual hard disk is the primary boot device is the most appropriate action. An "Operating system not found" error frequently indicates that the VM is attempting to boot from a non-bootable device, such as a virtual CD-ROM drive, network adapter, or another empty virtual disk, before it tries the virtual hard disk containing the operating system. This common misconfiguration can easily occur accidentally or after certain VM operations.

Why this answer

The error 'Operating system not found' indicates that the VM is attempting to boot from a device that does not contain a bootable operating system. Since the VM was working yesterday, the most likely cause is that the boot order in the VM's BIOS has been changed or reset, causing it to try booting from a non-bootable device (e.g., network or CD-ROM) before the virtual hard disk. Checking and correcting the boot order in the BIOS to prioritize the virtual hard disk is the logical first step before making configuration changes.

Exam trap

The trap here is that candidates assume the IDE controller is the problem and immediately try to change it to SCSI, but the error is actually caused by the boot order, not the storage controller type.

How to eliminate wrong answers

Option A is wrong because reattaching the virtual hard disk to the SCSI controller is unnecessary; the IDE controller is fully capable of booting a VM, and the error is not caused by the controller type. Option C is wrong because increasing memory allocation addresses performance or out-of-memory issues, not boot failures related to missing operating system detection. Option D is wrong because restoring from a snapshot should be a last resort after simpler checks like boot order, as snapshots can cause data loss and the issue may be a simple configuration change.

Full explanation →

383

MCQmedium

A user on a Windows 10 Pro workstation complains that they cannot change their desktop background or theme, and several personalization settings are grayed out. The computer is not joined to a domain. Which Group Policy or local policy setting is most likely causing this restriction?

A.The 'Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands' policy.

B.The 'Prohibit access to Control Panel and PC settings' policy.

C.The 'Prevent changing desktop background' policy.

D.The 'Turn off all Windows Spotlight features' policy.

AnswerC

This Group Policy setting directly addresses the user's complaint by specifically disabling the functionality to modify the desktop background. When this policy is enabled, it effectively grays out the options within the Personalization settings that allow users to select or change their desktop image, preventing any alterations. This targeted policy ensures that the desktop background remains static without affecting other customization or system settings.

Why this answer

The Local Group Policy Editor (gpedit.msc) can enforce user restrictions. The specific policy 'Prevent changing desktop background' under User Configuration > Administrative Templates > Control Panel > Personalization would cause this symptom. The other options are either not specific to personalization or affect different settings.

Full explanation →

384

MCQmedium

A technician is troubleshooting a Windows 11 computer that fails to boot with a 'Bootmgr is missing' error. They have a Windows installation USB. Which tool from the Windows Recovery Environment should they use to repair the boot configuration data (BCD)?

A.System File Checker (sfc /scannow)

B.Bootrec (bootrec /rebuildbcd)

C.DISM (DISM /Online /Cleanup-Image /RestoreHealth)

D.Diskpart (diskpart /s script.txt)

AnswerB

The `bootrec` command-line utility, specifically with the `/rebuildbcd` switch, is the dedicated tool for diagnosing and repairing boot environment problems in Windows. This command scans all disks for compatible Windows installations and allows the user to add them to a newly created or repaired Boot Configuration Data (BCD) store. It directly addresses scenarios where the BCD is missing or corrupted, preventing the system from locating and loading the operating system.

Why this answer

The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is corrupted or missing. The `bootrec /rebuildbcd` command scans all disks for Windows installations and rebuilds the BCD store from scratch, directly addressing the missing or corrupted boot configuration. This is the correct tool in the Windows Recovery Environment for repairing BCD issues.

Exam trap

The trap here is that candidates confuse `bootrec /rebuildbcd` with `sfc /scannow` or `DISM`, thinking any 'repair' tool can fix boot issues, but only `bootrec` specifically targets the BCD store required for the boot manager to locate the Windows loader.

How to eliminate wrong answers

Option A is wrong because System File Checker (sfc /scannow) repairs corrupted system files, not the boot configuration data (BCD) store; it operates on protected system files like DLLs and executables, not boot manager metadata. Option C is wrong because DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows image (component store) for servicing issues, such as corruption in the system files used by Windows Update, and does not interact with the BCD store or boot sector. Option D is wrong because Diskpart is a disk partitioning tool used to manage volumes and partitions (e.g., create, delete, format), not to repair boot configuration data; running a script with `diskpart /s script.txt` would execute partition commands, not fix the BCD.

Full explanation →

385

MCQhard

A technician is reviewing the change management log and finds that a previous change to the email server was marked as 'completed' but the email service has been intermittent since then. The technician suspects the change was not fully tested. Which step in the change management process was most likely skipped?

A.The change request was not submitted

B.The change was not approved by the CAB

C.A post-implementation review was not conducted

D.The rollback plan was not documented

AnswerC

A post-implementation review would have caught the intermittent issue and prevented the change from being marked as completed.

Why this answer

A post-implementation review (PIR) is the step where the change is verified to have met its objectives without causing adverse effects. Since the email service became intermittent after the change was marked 'completed', the lack of a PIR means the change was not validated in production, allowing the underlying issue to go undetected. In the CompTIA change management process, the PIR ensures that the change has been fully tested and that any residual problems are identified and addressed before the change is closed.

Exam trap

CompTIA often tests the distinction between the approval step and the validation step, trapping candidates who assume that a completed change must have been approved, when the real issue is the failure to verify the change's success through a post-implementation review.

How to eliminate wrong answers

Option A is wrong because the change was logged in the change management log as 'completed', which implies a change request was submitted and processed; the issue is not the absence of a request but the lack of validation after implementation. Option B is wrong because CAB approval is typically required for high-risk or significant changes, but the email server change was already approved and implemented; the skipped step is the verification of success, not the approval itself. Option D is wrong because while a rollback plan is important for reverting a failed change, the problem here is that the change was not fully tested and its impact was not assessed post-implementation; a documented rollback plan would not have prevented the intermittent service if the root cause was not identified during testing.

Full explanation →

386

MCQeasy

An iOS user complains that their iPhone will not connect to a known Wi-Fi network, but other devices on the same network work fine. Which iOS-specific troubleshooting step should you perform first to resolve this issue without erasing any personal data?

A.Reset All Settings from the General > Reset menu.

B.Erase All Content and Settings to start fresh.

C.Use the 'Reset Network Settings' option in Settings > General > Reset.

D.Restore the iPhone from an iCloud backup.

AnswerC

The 'Reset Network Settings' option specifically clears all network-related configurations on the iPhone, including saved Wi-Fi networks and their corresponding passwords, cellular data settings (such as APN and carrier settings), VPN configurations, and Bluetooth pairings. By resetting these specific parameters to their factory defaults, it effectively resolves corrupted network profiles or incorrect settings that often cause connectivity issues, without affecting any personal data, apps, or other system settings.

Why this answer

The correct step is to use the 'Reset Network Settings' option in iOS, which clears saved Wi-Fi networks, VPN configurations, and other network-related settings without affecting personal data like photos or contacts. This often resolves stubborn Wi-Fi connection issues. A full factory reset or iCloud restore would be excessive and data-destructive.

Full explanation →

387

MCQeasy

A customer is returning a leased laptop that contains sensitive client data. The lease agreement requires that the data be irrecoverably destroyed, but the laptop must remain functional for the next lessee. Which method should you use?

A.Perform a quick format of the hard drive.

B.Use a degausser to demagnetize the drive.

C.Run a secure erase utility that overwrites all sectors with zeros.

D.Physically shred the hard drive.

AnswerC

A secure erase utility, often compliant with standards like NIST SP 800-88, systematically overwrites every addressable sector on the storage device, typically with zeros or a specific pattern, multiple times. This process effectively renders all previous data unrecoverable by standard and even advanced forensic methods, while crucially preserving the drive's physical integrity and functionality. The drive remains fully operational and ready for re-provisioning to the next user.

Why this answer

A secure erase utility that overwrites all sectors with zeros (e.g., using ATA Secure Erase or a tool like DBAN) renders the data irrecoverable by standard forensic methods while leaving the drive functional for the next lessee. This satisfies the lease agreement's requirement for data destruction without damaging the hardware. Quick formats only remove file system pointers, leaving data recoverable, while degaussing or physical destruction would render the laptop non-functional.

Exam trap

On the CompTIA A+ exam, candidates often confuse a quick format with a secure erase, assuming it removes data when it only removes the index. The key distinction is that a secure overwrite (e.g., zero-fill) preserves hardware functionality while making data irrecoverable.

How to eliminate wrong answers

Option A is wrong because a quick format only clears the file system metadata (e.g., MFT or FAT) and does not overwrite the actual data sectors, leaving all client data recoverable with simple file recovery tools. Option B is wrong because a degausser uses a strong magnetic field to demagnetize the platters, which destroys the drive's ability to store data permanently, making the laptop non-functional for the next lessee. Option D is wrong because physically shredding the hard drive destroys the hardware entirely, which violates the requirement that the laptop remain functional for the next lessee.

Full explanation →

388

MCQeasy

A user reports that they cannot connect to the company's internal file server from home using the provided VPN client. They can access the internet without issues. Which of the following is the most likely cause of this problem?

A.The user's home router is blocking VPN traffic on port 443.

B.The VPN client is configured for split tunneling, and the file server's IP range is not in the allowed routes.

C.The file server is powered off or experiencing a hardware failure.

D.The user's VPN client software is outdated and needs to be reinstalled.

AnswerB

Split tunneling is a VPN configuration where only traffic destined for specific corporate network subnets is routed through the VPN tunnel, while all other traffic, such as general internet browsing, is sent directly from the user's local network. If the file server's IP range or subnet is not explicitly included in the VPN client's routing table for the tunnel, the client will attempt to reach it directly via the local network. This attempt will fail as the server is on the corporate network, explaining why internet access works but internal resources are unreachable.

Why this answer

Split tunneling allows the VPN client to route only specific traffic (e.g., corporate subnets) through the encrypted tunnel, while all other traffic goes directly to the internet. If the file server's IP range is not included in the allowed routes, traffic to that server will bypass the VPN and be sent unencrypted to the user's local gateway, which cannot reach the internal server. This matches the symptom: internet works, but the file server is unreachable.

Exam trap

The trap here is that candidates often assume any remote access issue is due to firewall blocking or server failure, overlooking the specific split tunneling misconfiguration that allows internet but blocks internal resources.

How to eliminate wrong answers

Option A is wrong because port 443 is typically used for HTTPS or SSL/TLS-based VPNs (e.g., OpenVPN, SSTP), and if the home router were blocking it, the VPN client would fail to establish any connection at all, not just fail to reach the file server. Option C is wrong because a powered-off or failed file server would affect all users, not just a remote VPN user, and the user can access the internet, indicating the VPN tunnel itself is up. Option D is wrong because outdated VPN client software would typically cause connection failures or authentication errors, not a selective inability to reach a specific internal resource while internet access works.

Full explanation →

389

MCQmedium

A technician is troubleshooting a remote user's inability to connect to the office network via VPN. The user can ping the VPN server's public IP address but the VPN connection fails after entering credentials. The VPN logs show an authentication error. What should the technician check next?

A.Verify that the VPN server's firewall is allowing UDP port 500 and 4500.

B.Check if the user's account is locked out or if the password has expired.

C.Reinstall the VPN client software on the user's computer.

D.Configure the VPN to use a different encryption protocol.

AnswerB

An "authentication error" directly signifies that the credentials provided by the user, such as the username, password, or certificate, were rejected by the authentication server. Common and immediate reasons for such rejection include the user's account being administratively locked out due to too many failed login attempts, or the password having reached its expiration date and requiring a mandatory reset. Addressing these account-specific issues is the most direct and logical troubleshooting step for an authentication failure.

Why this answer

The VPN logs show an authentication error, which indicates the failure occurs during the credential validation phase, not during network connectivity. Since the user can ping the VPN server's public IP, Layer 3 connectivity is intact, and the issue is likely with the user's account status. Checking if the account is locked out or the password has expired directly addresses the authentication failure.

Exam trap

CompTIA often tests the distinction between connectivity issues (Layer 3 reachability) and authentication issues (Layer 7 credential validation), leading candidates to incorrectly focus on firewall ports or client software when the logs clearly point to an authentication failure.

How to eliminate wrong answers

Option A is wrong because UDP ports 500 and 4500 are used for IPsec IKE traffic, and the user can already ping the VPN server, so firewall rules are not the immediate cause of an authentication error. Option C is wrong because reinstalling the VPN client software would not resolve an authentication error that occurs after credentials are entered; the client is functioning enough to reach the server. Option D is wrong because changing the encryption protocol would not fix an authentication error; it would only alter how data is secured after authentication succeeds.

Full explanation →

390

MCQmedium

A technician is configuring a new Windows 10 workstation for a remote employee. The employee will use the laptop to access company resources via VPN. Which security setting should be configured to ensure the VPN connection is always used when accessing the internet?

A.Enable split tunneling to improve performance.

B.Disable split tunneling to force all traffic through the VPN.

C.Configure the VPN to use PPTP protocol.

D.Set the VPN to connect only when accessing internal websites.

AnswerB

Disabling split tunneling, also known as "full tunnel" VPN, ensures that all network traffic originating from the workstation, regardless of its destination (internal corporate network or external internet), is routed through the encrypted VPN tunnel to the corporate network. This forces all traffic to be inspected and filtered by corporate security appliances before reaching its final destination. This configuration is crucial for maintaining a consistent security posture and enforcing corporate policies, as it prevents any traffic from bypassing the secure corporate perimeter.

Why this answer

Disabling split tunneling ensures that all network traffic, including internet-bound traffic, is routed through the VPN tunnel. This forces the VPN connection to be always used when accessing the internet, which is essential for enforcing security policies and ensuring that company resources are protected even when the remote employee accesses external websites.

Exam trap

CompTIA often tests the misconception that enabling split tunneling improves security by reducing VPN load, when in fact it creates a security risk by allowing non-VPN traffic to bypass corporate security controls.

How to eliminate wrong answers

Option A is wrong because enabling split tunneling would allow internet-bound traffic to bypass the VPN, directly contradicting the requirement to always use the VPN for internet access. Option C is wrong because PPTP is an outdated and insecure protocol; the question asks about a security setting to force traffic through the VPN, not about the protocol choice. Option D is wrong because setting the VPN to connect only when accessing internal websites would not force all internet traffic through the VPN; it would only trigger the VPN for internal resource requests, leaving other internet traffic unprotected.

Full explanation →

391

MCQeasy

A small business owner wants to deploy a custom inventory app to five company-owned iPads. The app is not available on the App Store. Which method should you use to install it?

A.Use Apple Configurator to install the app directly.

B.Download the app from a third-party website and open it in Safari.

C.Email the app file to each user and have them install it.

D.Enable sideloading in Settings and install via iTunes.

AnswerA

Apple Configurator is a macOS application designed for mass deployment and management of iOS devices in an organizational setting. It enables IT administrators to supervise devices, install custom in-house applications (often referred to as Line of Business apps) directly onto them, provided these apps are properly signed with an Apple Enterprise Developer Program certificate. This method bypasses the App Store, making it ideal for proprietary business tools not intended for public distribution.

Why this answer

Apple Configurator allows IT administrators to install enterprise or custom in-house apps directly onto supervised iOS devices without requiring the App Store. Since the app is not available on the App Store and the iPads are company-owned, Apple Configurator provides a supported, secure method for direct installation using a Mac.

Exam trap

CompTIA often tests the misconception that iOS supports general sideloading or direct file installation like Android, when in reality iOS strictly controls app installation through the App Store, enterprise distribution, or supervised device management tools like Apple Configurator.

How to eliminate wrong answers

Option B is wrong because downloading an app from a third-party website and opening it in Safari is not a supported installation method on iOS; iOS does not allow direct installation from arbitrary websites without enterprise distribution certificates or jailbreaking. Option C is wrong because emailing an app file (.ipa) to users does not work on iOS; the operating system blocks installation of apps from email attachments due to security restrictions. Option D is wrong because iOS does not have a general 'sideloading' toggle in Settings; sideloading via iTunes is limited to free Apple Developer accounts with a 7-day expiry and requires the app to be signed, making it impractical for permanent deployment to five company-owned iPads.

Full explanation →

392

MCQeasy

A user calls the help desk, frustrated because their computer is running slowly after installing a new antivirus program. The technician suspects the antivirus is causing high CPU usage. Which of the following is the MOST appropriate initial response?

A.Tell the user to uninstall the antivirus immediately.

B.Explain that antivirus programs always slow down computers and there's nothing to be done.

C.Apologize for the frustration and ask the user to describe when the slowness started.

D.Immediately remote into the computer to check CPU usage.

AnswerC

This is the most appropriate first step as it demonstrates empathy, which is crucial for building user trust and de-escalating frustration. By asking when the slowness started, the technician begins to gather vital diagnostic information, establishing a timeline that can help identify recent changes, software installations, or updates that might correlate with the performance degradation. This approach prioritizes user experience while initiating a structured troubleshooting process.

Why this answer

It follows the CompTIA A+ troubleshooting methodology by first gathering information and showing empathy. The technician needs to confirm the timeline of the slowness relative to the antivirus installation, as other factors (e.g., a Windows update, disk I/O bottleneck, or malware) could be the root cause. Jumping to conclusions without verifying the symptom onset violates the 'identify the problem' step and risks misdiagnosis.

Exam trap

CompTIA often tests the candidate's ability to prioritize the troubleshooting methodology over technical action—the trap here is that many candidates choose Option D because they think immediate remote access is efficient, but the exam emphasizes gathering information and showing empathy as the first step.

How to eliminate wrong answers

Option A is wrong because uninstalling the antivirus immediately removes security protection without confirming it is the cause, and the slowness could stem from a different issue like a pending update or driver conflict. Option B is wrong because it dismisses the user's frustration and is factually incorrect—modern antivirus programs can be tuned (e.g., excluding scheduled scans during peak usage, adjusting real-time protection settings) to minimize performance impact. Option D is wrong because remotely accessing the computer without first explaining the action and obtaining consent violates professional conduct and the user's privacy; the technician should first ask questions to narrow down the problem before taking invasive steps.

Full explanation →

393

MCQeasy

A customer reports that their computer is running slowly and they see pop-up ads even when no browser is open. They suspect malware. Which of the following should you perform first to remediate this issue?

A.Run a full antivirus scan

B.Disconnect the computer from the network

C.Reboot the computer in Safe Mode

D.Restore from a recent backup

AnswerB

Disconnecting the computer from the network is the critical first step in malware remediation because it immediately isolates the infected system. This action prevents the malware from communicating with external command-and-control servers, stops data exfiltration, and halts any attempts to spread laterally to other devices on the local network. Containment is paramount before attempting any diagnostic or removal procedures, creating a safe environment for subsequent steps.

Why this answer

Disconnecting the computer from the network is the first step because it immediately stops the malware from communicating with its command-and-control (C2) server, preventing further data exfiltration, additional payload downloads, or remote control. This containment step is critical before any remediation (like scanning or rebooting) to avoid the malware spreading or causing more damage.

Exam trap

The trap here is that candidates often jump to running an antivirus scan (Option A) as the immediate action, but CompTIA emphasizes containment first to prevent further damage or data loss, especially when active C2 communication is suspected.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan while the computer is still connected to the network allows active malware to continue communicating with its C2 server, potentially downloading more malicious code or exfiltrating data during the scan. Option C is wrong because rebooting into Safe Mode does not immediately stop network-based threats; the malware may still have network access in Safe Mode with networking, and the reboot itself could trigger destructive payloads. Option D is wrong because restoring from a recent backup should only be performed after confirming the backup is clean and the current infection is contained; doing it first risks reinfecting the system from the backup or missing active malware still on the network.

Full explanation →

394

MCQmedium

A user reports that their computer has been acting strangely: files are missing, and the mouse cursor moves on its own, opening programs and typing messages. The technician suspects a remote access Trojan (RAT). What is the most effective immediate action to stop the unauthorized access?

A.Run a full antivirus scan while the user is logged off.

B.Disconnect the Ethernet cable and disable Wi-Fi.

C.Change the user's password and log off.

D.Restore the system to a previous restore point.

AnswerB

Immediately disconnecting the Ethernet cable and disabling Wi-Fi is the most crucial initial step when a system is suspected of being compromised by a remote attacker. This action severs the command and control (C2) communication channel, preventing the attacker from issuing further commands, exfiltrating data, or deploying additional malicious payloads. Network isolation effectively quarantines the infected system, stopping the active threat and allowing for safer forensic analysis and remediation.

Why this answer

A RAT gives an attacker remote control of the system. The immediate action is to disconnect the computer from the network, which cuts off the attacker's connection. After isolation, the technician can run scans and remove the malware.

Continuing to work while connected risks data theft or further damage.

Full explanation →

395

MCQeasy

A company is implementing a new policy to prevent tailgating at the main entrance. Which physical security control should they deploy?

A.Security cameras

B.Biometric reader

C.Mantrap

D.Badge reader

AnswerC

A mantrap is a security vestibule featuring two interlocking doors, where only one door can be open at any given time. After an authorized individual authenticates and enters the first door, it closes behind them, and they are then verified again before the second door opens, allowing exit into the secure area. This design physically isolates individuals, ensuring that only one person can pass through the controlled access point at a time, thereby directly and effectively preventing tailgating.

Why this answer

A mantrap uses two interlocking doors to ensure only one person can enter at a time, effectively preventing tailgating. This tests understanding of specialized access controls designed to enforce one-person-per-authentication.

Full explanation →

396

MCQeasy

A customer reports that their Windows 10 PC is slow and displays pop-up ads even when no browser is open. They suspect malware. After running a full antivirus scan, the symptoms persist. Which step should you take next to remediate the issue?

A.Reinstall the operating system.

B.Run a scan with a dedicated anti-malware tool like Malwarebytes.

C.Disable Windows Defender permanently.

D.Clear the browser cache and cookies.

AnswerB

Dedicated anti-malware tools, such as Malwarebytes, specialize in detecting and removing Potentially Unwanted Programs (PUPs) and adware that often bypass traditional antivirus software. These utilities employ more aggressive heuristics and signature databases specifically tailored to identify intrusive browser extensions, unwanted toolbars, and persistent pop-up generators, effectively cleaning the system without resorting to more drastic measures.

Why this answer

Standard antivirus software often misses potentially unwanted programs (PUPs) and adware that inject pop-ups into the system. A dedicated anti-malware tool like Malwarebytes uses heuristic analysis and signature databases specifically tuned to detect and remove adware, browser hijackers, and other low-level threats that traditional AV engines may overlook.

Exam trap

CompTIA often tests the distinction between standard antivirus and specialized anti-malware tools, trapping candidates who assume that a full antivirus scan is sufficient to remove all types of malware, especially adware and PUPs.

How to eliminate wrong answers

Option A is wrong because reinstalling the operating system is an extreme, time-consuming step that should only be taken after all other remediation methods have failed, and it does not address the root cause of the infection. Option C is wrong because disabling Windows Defender permanently would remove a critical layer of real-time protection, leaving the system vulnerable to further infections and violating best practices for security. Option D is wrong because clearing browser cache and cookies only removes temporary web data and cannot eliminate adware or malware that is running as a background process or service on the system.

Full explanation →

397

MCQmedium

A user reports that their Windows 10 laptop will not boot and displays the error 'Bootmgr is missing'. They have a valid Windows installation USB. Which steps should you take to repair the boot manager?

A.Boot from the USB, go to Troubleshoot > Advanced Options > Command Prompt, and run 'bootrec /rebuildbcd' and 'bootrec /fixmbr'.

B.Boot from the USB and select 'Repair your computer' > 'Startup Repair'.

C.Boot from the USB and run 'sfc /scannow' from the Command Prompt.

D.Boot from the USB and perform a system restore to a previous point.

AnswerA

This is the correct approach because the 'bootrec /fixmbr' command writes a new Master Boot Record (MBR) to the system partition, which is essential if the MBR is corrupted or missing. Subsequently, 'bootrec /rebuildbcd' scans for Windows installations and allows them to be added to the Boot Configuration Data (BCD) store. This combination directly repairs the foundational boot components necessary for the Windows Boot Manager to load, effectively resolving the 'Bootmgr is missing' error.

Why this answer

The 'Bootmgr is missing' error indicates that the Boot Manager (bootmgr) is either corrupted or missing, or the BCD (Boot Configuration Data) store is damaged. Booting from a Windows installation USB and using the Command Prompt via Troubleshoot > Advanced Options allows you to run 'bootrec /rebuildbcd' to scan for Windows installations and rebuild the BCD store, and 'bootrec /fixmbr' to repair the Master Boot Record (MBR) on the system partition. This directly addresses the boot manager issue by restoring the boot configuration and ensuring the MBR points to the correct boot sector.

Exam trap

CompTIA often tests the distinction between automated tools like Startup Repair and manual command-line utilities, leading candidates to choose the simpler option (B) without realizing that specific boot manager errors require targeted commands like 'bootrec' to rebuild the BCD and repair the MBR.

How to eliminate wrong answers

Option B is wrong because Startup Repair is a more automated tool that attempts to fix common boot issues, but it may not specifically rebuild the BCD or repair the MBR in all cases, and it often fails when the BCD is severely corrupted or missing. Option C is wrong because 'sfc /scannow' (System File Checker) scans and repairs protected system files, but it does not repair the boot manager, MBR, or BCD store, which are the root cause of the 'Bootmgr is missing' error. Option D is wrong because System Restore reverts system files, settings, and registry to a previous restore point, but it does not repair the boot manager or BCD; if the boot configuration is corrupted, System Restore may not even run successfully without a functional boot loader.

Full explanation →

398

MCQeasy

A user reports that their Windows 10 laptop takes an unusually long time to boot and frequently shows a 'Preparing Automatic Repair' screen before finally loading the desktop. Which Windows tool should be used first to diagnose and potentially fix the boot process?

A.Run the System File Checker (SFC) from an elevated Command Prompt.

B.Perform a full system restore from a backup made last month.

C.Use the Disk Cleanup tool to remove temporary files.

D.Reinstall Windows using the 'Reset this PC' option.

AnswerA

SFC scans and repairs corrupted system files, which can resolve boot delays and automatic repair loops.

Why this answer

The 'Preparing Automatic Repair' loop and slow boot often indicate corruption in critical boot files, such as the Boot Configuration Data (BCD) or system files. Running System File Checker (SFC) from an elevated Command Prompt scans and repairs protected system files, addressing the root cause without data loss. This is the first-line diagnostic tool for boot integrity issues before escalating to more destructive methods.

Exam trap

CompTIA often tests the misconception that Disk Cleanup or a full restore is the appropriate first step for boot issues, when in fact SFC is the correct initial diagnostic tool for file corruption without data loss.

How to eliminate wrong answers

Option B is wrong because performing a full system restore from a backup is a reactive, data-loss-prone step that should only be used after less invasive repairs fail; it does not diagnose the specific boot file corruption. Option C is wrong because Disk Cleanup only removes temporary files and does not repair system files or boot configuration, making it irrelevant to boot loops. Option D is wrong because reinstalling Windows via 'Reset this PC' is a last-resort destructive recovery that wipes applications and settings, and is not the first tool to use for boot file corruption.

Full explanation →

399

MCQeasy

During a routine security audit, a technician finds that a user's computer has an unknown program running that is sending keystrokes and screenshots to a remote server. The user did not install this program. Which type of malware is this?

A.Rootkit

B.Worm

C.Keylogger

D.Ransomware

AnswerC

A keylogger, also known as a keystroke logger, is a type of surveillance technology used to monitor and record each keystroke typed on a specific computer's keyboard. Many advanced keyloggers also incorporate additional data capture features, such as periodically taking screenshots, recording clipboard contents, or monitoring web browser activity. This direct and covert capture of both keystrokes and visual information precisely matches the described findings of the security audit.

Why this answer

The described behavior—capturing keystrokes and screenshots and sending them to a remote server—is the defining characteristic of a keylogger. This type of malware specifically records user input and screen activity to steal sensitive data like passwords and personal information, and it often runs without the user's knowledge or consent.

Exam trap

The trap here is that candidates often confuse a keylogger with a rootkit because both can operate stealthily, but the rootkit's primary function is hiding itself and other malware, not capturing keystrokes or screenshots.

How to eliminate wrong answers

Option A is wrong because a rootkit is designed to hide its presence and other malware from the operating system by modifying kernel-level functions, not to capture keystrokes or screenshots. Option B is wrong because a worm is a self-replicating malware that spreads across networks without user interaction, focusing on propagation rather than data theft via keystroke logging. Option D is wrong because ransomware encrypts files or locks the system to demand a ransom, and it does not typically exfiltrate keystrokes or screenshots to a remote server.

Full explanation →

400

MCQhard

A company's login script uses a batch file that calls multiple other scripts. Recently, the script stopped working after a Windows update. The technician discovers that the script uses 'call' to run sub-scripts, but one of the sub-scripts contains an 'exit' command that terminates the entire batch process. How should the technician modify the sub-script to prevent this?

A.Replace 'exit' with 'goto :eof'

B.Change 'exit' to 'exit /b'

C.Remove the 'exit' command entirely

D.Use 'endlocal' before 'exit'

AnswerB

The 'exit /b' command is crucial for proper script execution within a larger context, such as a login script called by a system process or another batch file. It terminates only the current batch script, returning control to the calling script or process without closing the command interpreter window. This preserves the execution environment and allows subsequent commands in the calling process to run, which is essential for maintaining the integrity of a multi-stage login process.

Why this answer

The 'exit' command without parameters terminates the entire command interpreter (cmd.exe), which kills the parent batch file as well. Using 'exit /b' instead exits only the current batch script or subroutine, returning control to the calling script. This preserves the intended flow when sub-scripts are invoked via 'call'.

Exam trap

CompTIA often tests the difference between 'exit' (terminates the entire command shell) and 'exit /b' (exits only the current batch script), leading candidates to mistakenly think 'exit' is always safe in sub-scripts.

How to eliminate wrong answers

Option A is wrong because 'goto :eof' is used to jump to the end of the current batch file, but it does not exit a subroutine that was called; it simply transfers control, which may not stop execution of the sub-script if there are more commands after the label. Option C is wrong because removing the 'exit' command entirely would leave the sub-script to continue executing any subsequent commands, potentially causing unintended behavior or an infinite loop. Option D is wrong because 'endlocal' only ends local variable scope set by 'setlocal'; it does not affect the termination behavior of the 'exit' command and does not prevent the parent batch from being terminated.

Full explanation →

401

MCQhard

A technician needs to deploy a software update to 100 computers in a domain. The update requires administrative privileges. The technician wants to run the installer silently without user interaction. Which command-line syntax should be used?

A.msiexec /i update.msi /passive

B.msiexec /i update.msi /quiet /norestart

C.msiexec /i update.msi /qb

D.msiexec /i update.msi /l* log.txt

AnswerB

Installs silently and prevents automatic restart.

Why this answer

The `/quiet` switch suppresses all user interface and user interaction, which satisfies the requirement for silent installation. The `/norestart` switch prevents an automatic reboot after the installation, which is necessary when deploying to multiple computers without disrupting users. Together, these switches ensure the update runs with administrative privileges in a fully unattended manner.

Exam trap

CompTIA A+ often tests the distinction between /passive (which still shows a progress bar) and /quiet (which is truly silent), leading candidates to choose /passive when the question explicitly requires no user interaction.

How to eliminate wrong answers

Option A is wrong because `/passive` displays a progress bar and only minimizes user interaction, not eliminating it entirely; the installation is not fully silent. Option C is wrong because `/qb` shows a basic progress dialog (a basic UI), which still requires user interaction and does not meet the silent requirement. Option D is wrong because `/l* log.txt` only enables verbose logging to a file; it does not control the installation's user interface or silence it, so the installer would run with its default UI.

Full explanation →

402

MCQmedium

A user reports that their MacBook Pro running macOS Monterey frequently displays a message saying 'Your system has run out of application memory.' They have 16 GB of RAM and are only using Safari and Mail. Which macOS tool should you use to investigate the cause?

A.System Information

B.Terminal with 'vm_stat' command

C.Activity Monitor

D.Console

AnswerC

Activity Monitor is the definitive graphical utility for real-time system resource monitoring on macOS, and its Memory tab is specifically engineered for diagnosing memory-related performance issues. It prominently displays a "Memory Pressure" graph, which visually indicates how efficiently the system is utilizing its RAM, alongside a detailed breakdown of memory usage per process, including "Compressed Memory" and "Swap Used." This comprehensive, user-friendly view empowers technicians to swiftly identify memory-intensive applications, memory leaks, or system-wide memory contention.

Why this answer

Activity Monitor is the correct tool because it provides real-time, graphical monitoring of memory pressure, process-specific memory usage, and the 'Memory' tab's 'Memory Pressure' graph directly indicates whether the system is under memory strain. Since the user has 16 GB of RAM and is only using Safari and Mail, the 'out of application memory' error typically indicates a memory leak or excessive memory consumption by a specific process, which Activity Monitor can pinpoint by sorting processes by memory usage.

Exam trap

The A+ exam often tests the distinction between diagnostic tools by making candidates confuse a static information tool (System Information) or a log viewer (Console) with a real-time performance monitor (Activity Monitor), especially when the symptom is a dynamic resource exhaustion issue.

How to eliminate wrong answers

Option A is wrong because System Information provides a static hardware and software inventory (e.g., RAM type, serial numbers) but does not show real-time memory usage or process-level memory consumption, so it cannot diagnose the cause of a memory pressure event. Option B is wrong because while 'vm_stat' in Terminal shows virtual memory statistics (e.g., page-ins, page-outs), it does not provide a user-friendly, process-level view of memory usage or the 'Memory Pressure' graph, making it less practical for quickly identifying the offending application. Option D is wrong because Console displays system logs and diagnostic messages, which can show kernel panics or app crashes, but it does not offer a live, graphical overview of memory usage or process memory footprints, so it is not the primary tool for investigating memory pressure.

Full explanation →

403

MCQhard

A technician is tasked with creating a PowerShell script that will parse a CSV file containing user information and create local user accounts on a Windows 10 machine. The CSV has columns: 'Username', 'FullName', 'Password'. The script must skip any row where the 'Username' is empty. Which control structure should the technician use to handle this requirement?

A.A 'for' loop with a counter to skip empty rows

B.A 'switch' statement to match usernames

C.An 'if' statement to test whether the Username property is not empty

D.A 'try/catch' block to handle errors when creating the account

AnswerC

An 'if' statement is the most direct and appropriate control flow construct for evaluating a specific condition and executing code only if that condition is true. By testing whether the 'Username' property is not null or empty, the script can precisely determine if valid data exists. This allows the script to prevent account creation attempts for incomplete entries, ensuring data integrity and preventing unnecessary errors.

Why this answer

The requirement is to conditionally skip rows based on a property value. An 'if' statement in PowerShell allows you to test whether the 'Username' property is empty or null using a condition like `if ($_.Username -ne '')` and then skip the row with `continue` or simply not process it. This is the most direct and efficient control structure for a simple boolean check on each row.

Exam trap

CompTIA often tests the distinction between control structures used for conditional logic versus iteration or error handling, and the trap here is that candidates may overcomplicate the solution by choosing a loop or switch when a simple conditional check is the most appropriate and efficient choice.

How to eliminate wrong answers

Option A is wrong because a 'for' loop with a counter is unnecessary; it would require manual index tracking and does not inherently skip empty rows without an additional conditional check, making it less efficient and more error-prone than a direct property test. Option B is wrong because a 'switch' statement is designed to match a single value against multiple patterns, not to test whether a property is empty or not; it would be overcomplicated and not the idiomatic choice for a simple null/empty check. Option D is wrong because a 'try/catch' block is used for exception handling during runtime errors (e.g., account creation failure), not for skipping rows based on data validation before processing.

Full explanation →

404

MCQeasy

A user reports that their Windows 10 PC is running slowly and they suspect too many programs start automatically. Which tool in the Settings app would you use to disable unnecessary startup programs?

A.System > About

B.Devices > Bluetooth & other devices

C.Update & Security > Troubleshoot

D.Apps > Startup

AnswerD

The "Apps > Startup" section within Windows Settings is the designated interface for users to manage applications configured to launch automatically when the operating system starts. This page provides a clear list of all such programs, often indicating their impact on startup time, and features simple toggle switches next to each entry. Users can easily enable or disable specific applications from starting with Windows, directly addressing the need to control startup items.

Why this answer

The Apps > Startup page in the Windows 10 Settings app provides a list of all startup programs with toggle switches to enable or disable them. This directly addresses the user's issue of too many programs launching automatically, which can slow down boot time and overall performance. The tool shows the impact of each startup item (e.g., 'High', 'Medium', 'Low') to help prioritize which to disable.

Exam trap

The trap here is that candidates often confuse the Apps > Startup page with the Task Manager's Startup tab (accessible via Ctrl+Shift+Esc), but the question specifically asks for a tool 'in the Settings app,' making Apps > Startup the correct choice.

How to eliminate wrong answers

Option A is wrong because System > About displays basic device specifications (e.g., processor, RAM, Windows edition) and does not manage startup programs. Option B is wrong because Devices > Bluetooth & other devices is used to pair and manage Bluetooth peripherals, not to control startup applications. Option C is wrong because Update & Security > Troubleshoot runs automated diagnostic tools for system issues like internet connectivity or audio, but it cannot disable startup programs.

Full explanation →

405

MCQeasy

A technician is installing a new power supply in a desktop computer. After connecting all cables, the computer will not power on. What is the most likely safety-related oversight?

A.The power supply is not compatible with the motherboard.

B.The power cord is not securely plugged into the power supply.

C.The voltage selector switch on the power supply is set to the wrong voltage.

D.The power supply fan is blocked by debris.

AnswerC

Many power supplies include a manual voltage selector switch (typically 115V for North America/Japan or 230V for Europe/most other regions) to accommodate different regional electrical standards. Setting this switch incorrectly, such as to 115V in a 230V region, can cause immediate and severe damage to the power supply due to overcurrent, potentially leading to smoke, sparks, or even fire, making it a critical safety oversight during installation. Conversely, setting it to 230V in a 115V region would likely prevent the system from powering on due to insufficient voltage.

Why this answer

The voltage selector switch on the power supply must match the local mains voltage (typically 115V in North America or 230V in Europe). If set to 230V while plugged into a 115V outlet, the power supply will receive insufficient voltage to start, causing the computer to appear completely dead. This is a common safety-related oversight because the switch is often overlooked during installation.

Exam trap

CompTIA often tests the voltage selector switch as a safety-related oversight because candidates mistakenly focus on physical connection issues (like a loose power cord) or component compatibility, overlooking the critical step of matching the power supply to the local mains voltage.

How to eliminate wrong answers

Option A is wrong because power supply compatibility with the motherboard is determined by the form factor (e.g., ATX) and connector types, not by the ability to power on; an incompatible power supply would still typically power on but might not fit or provide correct voltages. Option B is wrong because if the power cord were not securely plugged in, the computer would not power on, but this is a physical connection issue, not a safety-related oversight—the question specifically asks for a safety-related oversight. Option D is wrong because a blocked fan would cause overheating after the system is powered on, not prevent the computer from powering on entirely; the power supply would still start and spin the fan briefly before thermal protection might kick in.

Full explanation →

406

MCQmedium

A company's Android devices are failing to connect to the corporate email server after a security policy update. The devices show 'Authentication failed' for the email app. What is the most likely cause?

A.The devices need a factory reset to clear cached credentials.

B.The email app's server settings (IMAP/POP/SMTP) are no longer correct.

C.The SIM cards are deactivated.

D.The devices are infected with malware that blocks email.

AnswerB

Company security policy updates frequently involve changes to email server infrastructure, such as migrating to new server addresses, updating required port numbers, or enforcing stricter encryption protocols like specific SSL/TLS versions. If the Android devices' email applications retain outdated IMAP, POP3, or SMTP server addresses, port numbers, or authentication methods, they will fail to establish a secure and authorized connection to the mail servers. This directly results in authentication failures and an inability to send or receive email.

Why this answer

After a security policy update, authentication failures often stem from outdated or incorrect server settings. The most common change is an updated server address or port. The technician should verify the incoming/outgoing server settings in the email app.

Full explanation →

407

MCQeasy

A user reports that after a recent Windows update, their laptop takes significantly longer to boot and they see a message about 'Preparing Automatic Repair' before the login screen appears. You need to access the advanced startup options to disable automatic restart on system failure. Which tool or feature should you use to boot into the Windows Recovery Environment (WinRE) from a running system?

A.Boot from a Windows installation USB and select 'Repair your computer'.

B.Press F8 repeatedly during boot to access advanced boot options.

C.Hold the Shift key while clicking Restart from the Start menu power options.

D.Open the System Configuration tool (msconfig) and set the boot to 'Safe Mode' under the Boot tab.

AnswerC

Holding the Shift key while clicking 'Restart' from the Start menu's power options is the primary and most direct method to access the Windows Recovery Environment (WinRE) from a running Windows operating system. This action immediately initiates a reboot into WinRE, providing access to troubleshooting tools like System Restore, Startup Repair, and Safe Mode options without requiring any external bootable media. It is the most convenient and intended built-in pathway for users to self-diagnose and repair system issues.

Why this answer

Holding the Shift key while clicking Restart forces the system to boot directly into the Windows Recovery Environment (WinRE) without needing installation media. This method leverages the built-in boot configuration data (BCD) to load the recovery tools, including the option to disable automatic restart on system failure under advanced startup settings.

Exam trap

The trap here is that candidates may confuse the deprecated F8 method (Option B) with the modern Shift+Restart method, or assume that msconfig (Option D) can directly launch WinRE, when in fact it only configures Safe Mode boot options.

How to eliminate wrong answers

Option A is wrong because booting from a Windows installation USB and selecting 'Repair your computer' is a valid way to access WinRE, but it requires external media and is not the most direct method from a running system; the question specifies 'from a running system,' making this an unnecessary extra step. Option B is wrong because pressing F8 during boot to access advanced boot options was deprecated in Windows 8 and later; modern Windows systems use a fast startup process that makes F8 unreliable, and it does not reliably lead to WinRE. Option D is wrong because opening the System Configuration tool (msconfig) and setting the boot to 'Safe Mode' under the Boot tab only configures the system to boot into Safe Mode on the next restart, not into WinRE, and it does not provide access to the advanced startup options needed to disable automatic restart on system failure.

Full explanation →

408

MCQmedium

After installing a new application, a user reports that their default web browser keeps changing to a different one without their consent. Which Windows feature can you use to prevent applications from changing file associations and default programs?

A.Programs and Features

B.Default Programs (Control Panel)

C.Local Group Policy Editor

D.Registry Editor

AnswerC

The Local Group Policy Editor (gpedit.msc) provides administrative control to enforce system-wide settings, including default application associations. By configuring the 'Set a default associations configuration file' policy, an administrator can specify an XML file that dictates precise file type and protocol handlers. This policy then actively prevents users or newly installed applications from altering these defined associations, ensuring consistent behavior across the system.

Why this answer

The Local Group Policy Editor (gpedit.msc) allows administrators to configure the 'Set a default associations configuration file' policy under Computer Configuration > Administrative Templates > Windows Components > File Explorer. When enabled, this policy prevents applications from changing file associations and default programs by locking the association file, overriding any user or application changes. This is the correct tool for enforcing system-wide control over default programs in Windows 10/11 Pro, Enterprise, or Education editions.

Exam trap

CompTIA often tests the misconception that Default Programs in Control Panel can lock associations, but it only provides a manual interface for setting them without any enforcement mechanism against application changes.

How to eliminate wrong answers

Option A is wrong because Programs and Features is used to uninstall, change, or repair installed programs, not to prevent applications from changing file associations or default programs. Option B is wrong because Default Programs in Control Panel allows users to manually set file associations and default programs, but it does not prevent other applications from changing them afterward. Option D is wrong because Registry Editor (regedit) can be used to manually modify association keys (e.g., HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations), but it does not provide a built-in mechanism to lock or prevent changes by other applications.

Full explanation →

409

MCQmedium

A user reports that they clicked a link in a text message that appeared to be from their bank, warning of suspicious activity. The link led to a realistic-looking login page, but the user realized it was fake after entering their credentials. What type of social engineering attack is this?

A.Vishing

B.Smishing

C.Pharming

D.Pretexting

AnswerB

Smishing is a specific form of phishing that leverages Short Message Service (SMS), commonly known as text messages, to deliver malicious links or solicit sensitive information. In a smishing attack, users receive a deceptive text message, often impersonating a legitimate entity like a bank or delivery service, which prompts them to click a fraudulent link. This link typically leads to a fake website designed to capture credentials or install malware, directly matching the scenario where a user clicked a link in a text message.

Why this answer

Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) containing a link to a fraudulent website. The user received the message on their mobile device, clicked the link, and entered credentials on a fake login page, which is the hallmark of smishing. Unlike vishing (voice phishing), this attack uses text-based messaging to deliver the malicious link.

Exam trap

The CompTIA A+ exam often tests the distinction between smishing and vishing by focusing on the delivery method (SMS vs. voice), so candidates mistakenly choose vishing when they see 'text message' but focus on the 'warning of suspicious activity' pretext rather than the medium.

How to eliminate wrong answers

Option A (Vishing) is wrong because vishing involves voice calls or voicemail messages that trick victims into revealing information, not text messages with links. Option C (Pharming) is wrong because pharming redirects users from legitimate websites to fraudulent ones via DNS poisoning or local host file manipulation, without requiring the user to click a link in a message. Option D (Pretexting) is wrong because pretexting relies on fabricating a scenario (pretext) to obtain information, typically through direct conversation or impersonation, not via a link in a text message.

Full explanation →

410

MCQhard

A company's security policy mandates that all wireless traffic must be encrypted using a protocol that is resistant to KRACK attacks. The current network uses WPA2-PSK with AES. Which of the following upgrades should be implemented to meet this requirement?

A.Change the encryption from AES to TKIP.

B.Enable WPA2-Enterprise with 802.1X.

C.Upgrade to WPA3-Personal.

D.Implement MAC address filtering.

AnswerC

Upgrading to WPA3-Personal is the correct solution because it introduces Simultaneous Authentication of Equals (SAE) as a robust replacement for the WPA2 four-way handshake. SAE provides stronger cryptographic assurances, including forward secrecy, which prevents an attacker from decrypting past traffic even if the session key is compromised. This new handshake design inherently prevents the key reinstallation attacks that KRACK exploits, thereby securing wireless traffic against this specific vulnerability.

Why this answer

WPA3-Personal replaces the Pre-Shared Key (PSK) handshake with Simultaneous Authentication of Equals (SAE), which is resistant to offline dictionary attacks and the KRACK vulnerability that exploits the 4-way handshake in WPA2. Since the policy requires encryption resistant to KRACK attacks, upgrading to WPA3-Personal directly addresses this requirement.

Exam trap

The 220-1202 exam often tests the misconception that changing authentication methods (e.g., from PSK to 802.1X) fixes protocol-level vulnerabilities like KRACK, when in fact the underlying handshake protocol (WPA2) remains the same and still vulnerable.

How to eliminate wrong answers

Option A is wrong because TKIP is an older, less secure encryption protocol that is also vulnerable to KRACK attacks and is deprecated in favor of AES. Option B is wrong because WPA2-Enterprise with 802.1X still uses the same WPA2 4-way handshake, which is susceptible to KRACK attacks; it changes authentication but not the underlying handshake vulnerability. Option D is wrong because MAC address filtering is a basic access control mechanism that does not encrypt traffic and provides no protection against KRACK or any encryption-based attack.

Full explanation →

411

MCQmedium

A user reports that their Windows 11 laptop can see the office Wi-Fi network but fails to connect, displaying 'Can't connect to this network'. Other users with the same laptop model connect without issues. The network uses WPA2-PSK with AES. What should you check first?

A.Update the wireless adapter driver.

B.Change the router's security protocol to WPA3.

C.Forget the network on the laptop and reconnect by entering the passphrase again.

D.Disable the firewall on the laptop.

AnswerC

Forgetting the network on the laptop purges the stored Wi-Fi profile, which includes any potentially corrupted or incorrect security keys, SSIDs, and network settings cached by the operating system. Reconnecting forces the laptop to perform a fresh authentication handshake with the access point, prompting the user to re-enter the passphrase. This action is crucial for resolving issues stemming from an incorrect or expired saved credential, effectively resetting the client-side network configuration for that specific SSID.

Why this answer

A mismatch in the saved passphrase is a common cause of connection failures when the network is visible. The correct answer is to forget the network and re-enter the correct passphrase. This tests troubleshooting skills for wireless authentication issues.

Full explanation →

412

MCQhard

A user's browser is infected with a malicious extension that steals credentials. The extension was installed via a drive-by download from a compromised website. After removing the extension, what additional step should you take to ensure the credentials are not compromised?

A.Clear the browser cache and cookies

B.Run a full antivirus scan

C.Reset the browser settings to default

D.Change all passwords that were entered while the extension was active

AnswerD

Changing all passwords that were entered while the malicious extension was active is the most critical and direct action to mitigate the immediate risk of unauthorized account access. Malicious browser extensions designed for credential harvesting often log keystrokes, intercept form submissions, or read data from web pages. By changing these passwords, the user invalidates any credentials that the extension may have already captured and transmitted, thereby preventing attackers from using the stolen information to log into affected accounts.

Why this answer

A malicious browser extension that steals credentials has already exfiltrated any passwords entered while it was active. Removing the extension stops further theft, but the compromised credentials remain exposed. Changing all passwords ensures that stolen credentials are invalidated, preventing unauthorized access to accounts.

Exam trap

CompTIA often tests the misconception that removing the malicious component or clearing local data is sufficient, when in fact the attacker already has the stolen credentials and only changing passwords remediates the actual compromise.

How to eliminate wrong answers

Option A is wrong because clearing the browser cache and cookies removes local data like session tokens or stored form entries, but does not address credentials that were already sent to an attacker via the extension. Option B is wrong because running a full antivirus scan targets malware on the system, but the malicious extension has already been removed; the core issue is the theft of credentials, not persistent malware. Option C is wrong because resetting browser settings to default removes configurations and extensions, which is redundant after removal, but does not change passwords that were already compromised.

Full explanation →

413

MCQmedium

A small business owner wants to ensure that all company laptops are protected in case of theft. They need a solution that encrypts the entire hard drive and requires a pre-boot PIN. Which security feature should you implement?

A.Enable EFS (Encrypting File System) on the Documents folder.

B.Set a BIOS password.

C.Enable BitLocker with a TPM + startup PIN.

D.Install a third-party antivirus with encryption.

AnswerC

Enabling BitLocker with a Trusted Platform Module (TPM) and a startup PIN provides robust full disk encryption. The TPM securely stores the encryption keys and verifies the system's boot integrity, while the startup PIN adds a crucial second factor of authentication. This configuration ensures that the entire drive's contents remain encrypted and inaccessible until the correct PIN is entered *before* the operating system even begins to load, effectively protecting all data even if the drive is physically removed.

Why this answer

BitLocker with a TPM + startup PIN provides full-disk encryption and requires a pre-boot authentication PIN, meeting the requirement to protect the entire hard drive in case of theft. The TPM validates system integrity, and the PIN must be entered before the OS loads, preventing unauthorized access even if the drive is removed.

Exam trap

The trap here is that candidates often confuse EFS with full-disk encryption or assume a BIOS password alone secures data, but only BitLocker with TPM + startup PIN provides the required pre-boot authentication and full-drive encryption.

How to eliminate wrong answers

Option A is wrong because EFS encrypts individual files or folders, not the entire hard drive, and does not require a pre-boot PIN; it operates at the file system level after the OS loads. Option B is wrong because a BIOS password only prevents unauthorized users from changing BIOS settings or booting the system, but it does not encrypt the hard drive, leaving data accessible if the drive is removed. Option D is wrong because third-party antivirus with encryption typically offers file-level or folder-level encryption, not full-disk encryption with pre-boot authentication, and antivirus software focuses on malware detection, not drive encryption.

Full explanation →

414

MCQeasy

A customer reports that their office printer is emitting a strong, acrid smell and producing distorted prints. The printer uses a fuser unit that has been in service for five years. What should you recommend as the most environmentally responsible action?

A.Replace the entire printer with a new Energy Star model.

B.Replace only the fuser unit and recycle the old one through a certified e-waste recycler.

C.Continue using the printer until it fails completely.

D.Disassemble the printer and dispose of all parts in the general trash.

AnswerB

Replacing only the fuser unit is the correct and most efficient solution, as a burning smell often indicates a failing fuser, which is responsible for fusing toner to paper using heat and pressure. This targeted repair addresses the specific problem without unnecessary expense or waste. Furthermore, recycling the old fuser through a certified e-waste recycler ensures that hazardous materials are handled properly and valuable components are recovered, aligning with environmental best practices and regulations.

Why this answer

The fuser unit is a consumable component that degrades over time, and replacing only the faulty fuser while recycling the old one through a certified e-waste recycler minimizes electronic waste. This approach addresses the root cause (a worn-out fuser) without discarding the entire printer, which would generate unnecessary e-waste and violate environmental best practices.

Exam trap

CompTIA often tests the misconception that a failing component always requires full device replacement, but the trap here is that candidates overlook the environmental impact of e-waste and fail to recognize that consumable parts like fusers are designed to be replaced individually.

How to eliminate wrong answers

Option A is wrong because replacing the entire printer with a new Energy Star model is unnecessarily wasteful; the printer itself is likely still functional, and only the fuser unit needs replacement. Option C is wrong because continuing to use the printer until it fails completely poses a fire hazard from the overheating fuser and may cause further damage to other components, increasing waste and repair costs. Option D is wrong because disposing of all parts in general trash violates e-waste regulations and environmental guidelines, as printer components contain hazardous materials like lead and mercury that require proper recycling.

Full explanation →

415

MCQhard

A technician is tasked with disposing of a failed SSD that contains encrypted financial records. The SSD is non-functional and cannot be powered on. Which method should the technician use to ensure data is destroyed?

A.Use a degausser on the SSD.

B.Perform a secure erase command via SATA interface.

C.Physically shred the SSD using an industrial shredder.

D.Overwrite the SSD with a data wiping tool on another computer.

AnswerC

Physically shredding the SSD using an industrial shredder is the most robust and reliable method for data destruction when a drive has failed and cannot be accessed electronically. This process mechanically breaks the entire device, including all individual NAND flash memory chips, into tiny, unrecognizable fragments. By pulverizing the semiconductor dies where the data is actually stored, it becomes absolutely impossible to reconstruct the original data. This ensures complete and irreversible data sanitization regardless of the drive's operational status.

Why this answer

The SSD is non-functional and cannot be powered on, so any software-based method (secure erase, overwriting) is impossible. Physical destruction via an industrial shredder is the only reliable way to ensure the encrypted financial records are unrecoverable from a dead SSD, as it physically breaks the NAND chips beyond repair.

Exam trap

The trap here is that candidates assume a degausser works on all storage devices, but SSDs are not magnetic media and degaussing has no effect on NAND flash memory.

How to eliminate wrong answers

Option A is wrong because degaussers use a strong magnetic field to erase data on magnetic media (HDDs), but SSDs store data electrically in NAND flash cells and are not affected by magnetic fields; degaussing will not destroy the data and may leave the SSD physically intact. Option B is wrong because a secure erase command requires the SSD to be powered on and functional to execute the ATA Secure Erase command via the SATA interface; a non-functional SSD cannot communicate or execute any command. Option D is wrong because overwriting with a data wiping tool requires the SSD to be connected to another computer and powered on to write new data over the existing data; a dead SSD cannot be recognized or written to.

Full explanation →

416

MCQeasy

During a software deployment, you need to ensure that a legacy application always runs with administrative privileges, even for standard users. How can you configure this using Windows built-in tools?

A.Set the application's shortcut to 'Run as administrator' in the Compatibility tab

B.Disable User Account Control (UAC) in the Control Panel

C.Add the user to the local Administrators group

D.Use the 'Run as different user' option from the Shift+right-click menu

AnswerA

Setting the application's shortcut to 'Run as administrator' in the Compatibility tab is the most targeted and secure method for a specific application requiring elevated privileges. This configuration modifies the shortcut's properties to include a flag, instructing Windows to prompt for administrative credentials via User Account Control (UAC) each time the application is launched. This ensures the application consistently runs with the necessary elevated rights without granting the user full administrative privileges for all their activities, adhering strictly to the principle of least privilege.

Why this answer

The Compatibility tab in a shortcut's properties allows you to set the 'Run as administrator' flag, which embeds a compatibility manifest that prompts for elevation via UAC when the application is launched. This ensures the legacy application always runs with administrative privileges, even for standard users, by triggering a credential prompt for an administrator account.

Exam trap

CompTIA often tests the misconception that disabling UAC or adding users to the Administrators group is the correct way to grant admin rights to a single application, when the targeted 'Run as administrator' shortcut setting is the proper built-in method.

How to eliminate wrong answers

Option B is wrong because disabling UAC globally would remove the elevation prompt, but the application would still run with the user's limited privileges, not administrative rights, and it weakens system security. Option C is wrong because adding a standard user to the local Administrators group grants permanent administrative rights to the entire user account, which is excessive and violates the principle of least privilege; it is not a targeted solution for a single application. Option D is wrong because 'Run as different user' allows running an application under a different user account, but it does not automatically grant administrative privileges; the specified user must already have the necessary rights, and it requires manual intervention each time.

Full explanation →

417

MCQhard

A technician is called to a user's desk for a 'printer issue.' Upon arrival, the user is on a phone call and waves dismissively at the technician. The technician waits for two minutes, but the user continues their call. What should the technician do?

A.Stand silently until the user finishes the call, even if it takes a long time.

B.Leave a note on the desk saying you were there and will return later, then check back in 15 minutes.

C.Interrupt the call to say you'll come back later.

D.Close the ticket as 'user not available' and move on to the next task.

AnswerB

This is the most professional and efficient course of action. Leaving a note respectfully acknowledges the user's current engagement without interruption, while documenting the technician's presence and intent to return. The specified 15-minute follow-up provides a reasonable timeframe for the user to conclude their call and allows the technician to manage their schedule effectively, demonstrating proactive customer service and time management.

Why this answer

It demonstrates professional respect for the user's current activity while ensuring the issue is addressed. Leaving a note and returning in 15 minutes maintains a service-level commitment without disrupting the user's call, aligning with CompTIA's best practices for customer communication and time management in a support scenario.

Exam trap

The trap here is that candidates may choose Option D (close the ticket) thinking it is efficient, but CompTIA emphasizes that closing a ticket without user consent or follow-up is unprofessional and violates the core principle of customer service.

How to eliminate wrong answers

Option A is wrong because standing silently for an indefinite period wastes technician time and does not proactively manage the support queue; it fails to balance efficiency with customer service. Option C is wrong because interrupting the user's call is unprofessional and could escalate frustration, violating the principle of respecting the user's current engagement. Option D is wrong because closing the ticket as 'user not available' without attempting to reschedule abandons the support request prematurely, which is poor practice and could lead to unresolved issues and negative user experience.

Full explanation →

418

MCQeasy

A user calls the help desk frustrated because their laptop will not connect to the company Wi-Fi. They say they have tried restarting the laptop but it still does not work. The technician suspects the wireless adapter driver may be corrupt. What is the best first step for the technician to take?

A.Remotely reinstall the wireless adapter driver.

B.Ask the user if they see any error messages or if other devices connect to the Wi-Fi.

C.Tell the user to bring the laptop to the IT office for a physical inspection.

D.Escalate the ticket to the network team immediately.

AnswerB

Asking the user about error messages and the connectivity of other devices is a critical first step in effective troubleshooting. Error messages provide specific diagnostic clues, while checking other devices helps to quickly determine if the problem is isolated to the user's laptop (client-side issue) or if it's a broader network problem affecting multiple clients or the access point. This information gathering allows for proper problem isolation and guides subsequent troubleshooting steps efficiently.

Why this answer

This question tests the concept of active listening and gathering information before jumping to solutions. The correct answer is to ask clarifying questions to understand the issue fully, which ensures the technician does not waste time on incorrect assumptions.

Full explanation →

419

MCQeasy

A technician is disposing of a stack of CDs and DVDs that contain backup data from a medical office. The media are labeled with patient information. Which method should the technician use to destroy the data?

A.Use a degausser on each disc.

B.Scratch the surface of each disc with a key.

C.Use a cross-cut shredder that accepts optical discs.

D.Place the discs in a microwave for 10 seconds.

AnswerC

A cross-cut shredder designed for optical media physically destroys the disc by cutting it into numerous small, irregular fragments. This process ensures that the data layer, where information is encoded as pits and lands, is completely obliterated across the entire surface. Reducing the disc to tiny, non-contiguous pieces makes it virtually impossible to reconstruct the original data, providing a highly secure and effective method for irreversible data destruction.

Why this answer

A cross-cut shredder that accepts optical discs physically destroys the media into small pieces, making data recovery impossible. This method is compliant with HIPAA requirements for destroying protected health information (PHI) on CDs and DVDs, as it renders the data irrecoverable through physical destruction.

Exam trap

CompTIA often tests the misconception that degaussing works on all storage media, but the trap here is that optical discs are non-magnetic, so candidates who confuse magnetic media destruction with optical media destruction will incorrectly choose Option A.

How to eliminate wrong answers

Option A is wrong because degaussers use a strong magnetic field to erase data on magnetic media (e.g., hard drives, tapes), but optical discs like CDs and DVDs store data as physical pits and lands on a reflective layer, not magnetically, so a degausser has no effect on them. Option B is wrong because scratching the surface with a key only damages a small portion of the disc; data can still be read from unscratched areas using specialized software, leaving patient information recoverable. Option D is wrong because microwaving discs for 10 seconds may cause physical damage but is unreliable and dangerous—it can create toxic fumes, fire hazards, and may not fully destroy all data layers, especially on dual-layer DVDs, leaving residual data potentially recoverable.

Full explanation →

420

MCQmedium

A technician is writing a PowerShell script to check the status of a Windows service on multiple remote computers. The script must output the service name and status for each computer where the service is running. Which cmdlet combination should the technician use to achieve this?

A.Get-Service -ComputerName $computers | Where-Object {$_.Status -eq 'Running'}

B.Invoke-Command -ComputerName $computers -ScriptBlock {Get-Service} | Select-Object Status

C.Get-WmiObject Win32_Service -ComputerName $computers | Where-Object {$_.State -eq 'Running'}

D.Get-Service -Name * -ComputerName $computers | Format-Table -AutoSize

AnswerA

This command leverages the Get-Service cmdlet, which is the standard PowerShell method for interacting with Windows services. The -ComputerName parameter allows specifying one or more remote machines, making it suitable for checking multiple computers. Piped to Where-Object, it filters the results based on the Status property, specifically selecting only those services whose status is 'Running', directly fulfilling the requirement to identify running services.

Why this answer

Get-Service with the -ComputerName parameter can query multiple remote computers directly, and piping its output to Where-Object with the condition {$_.Status -eq 'Running'} filters only services whose Status property equals 'Running'. This meets the requirement to output the service name and status for each computer where the service is running, as Get-Service returns objects containing both Name and Status properties by default.

Exam trap

CompTIA often tests the distinction between Get-Service and Get-WmiObject Win32_Service, where candidates confuse the property names 'Status' vs 'State' and the correct filtering syntax, leading them to choose option C despite its deprecated status and incorrect property reference.

How to eliminate wrong answers

Option B is wrong because Invoke-Command -ScriptBlock {Get-Service} returns service objects from remote computers, but Select-Object Status only outputs the Status property, omitting the service name required by the task. Option C is wrong because Get-WmiObject Win32_Service uses the State property (not Status) to check if a service is running, and the condition {$_.State -eq 'Running'} is incorrect; the correct property value is 'Running' but the property name is 'State', not 'Status', and the cmdlet is deprecated in favor of Get-CimInstance. Option D is wrong because Format-Table -AutoSize only formats the output for display but does not filter for running services; it would output all services regardless of their status, failing to meet the requirement to check only where the service is running.

Full explanation →

421

MCQeasy

A user reports that their Windows 10 laptop shows a 'Your license will expire soon' watermark on the desktop, even though they purchased a retail license key. You need to resolve the activation issue. Which Control Panel applet should you use first?

A.Device Manager

B.System

C.Programs and Features

D.User Accounts

AnswerB

The 'System' applet, accessible via Control Panel or Settings in Windows 10, is the correct location for viewing fundamental operating system information. This interface prominently displays details such as the Windows edition (e.g., Home, Pro), system type (32-bit or 64-bit), processor, and installed RAM. Crucially, it also provides the current Windows activation status, indicating whether the copy is activated and allowing users to change the product key or initiate the activation process if necessary.

Why this answer

The System applet (Control Panel > System) provides direct access to the Windows activation status and the 'Change product key' option. Since the user already has a retail license key, the first troubleshooting step is to verify the current activation state and re-enter the key via this applet, which triggers a re-activation with Microsoft's licensing servers.

Exam trap

The trap here is that candidates may confuse activation issues with driver or user account problems, leading them to Device Manager or User Accounts, when the correct first step is always to check the System applet for activation status and key entry.

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware drivers and devices, not software licensing or activation. Option C is wrong because Programs and Features is for uninstalling or modifying installed applications, not for managing Windows activation or product keys. Option D is wrong because User Accounts handles user profile settings, passwords, and credentials, but does not provide any interface for Windows license activation or product key entry.

Full explanation →

422

MCQeasy

During a routine security audit, you discover that several user accounts on a Windows 10 workstation have local administrator privileges when they should only be standard users. You need to quickly review and modify user account types from the command line. Which built-in tool should you use?

A.lusrmgr.msc (Local Users and Groups MMC)

B.net user

C.net localgroup

D.diskpart

AnswerC

The net localgroup command is the correct command-line utility for managing local security group memberships on a Windows system. It allows administrators to view existing local groups, create new ones, delete groups, and critically, add or remove specific user accounts from these groups. This functionality is essential for tasks like adjusting user privileges, enforcing the principle of least privilege, and rectifying unauthorized group memberships identified during a security audit.

Why this answer

The `net localgroup` command is the correct built-in tool for this task because it allows you to both view and modify group memberships from the command line. Specifically, `net localgroup Administrators` lists current members, and `net localgroup Administrators <username> /delete` removes a user from the local Administrators group, effectively demoting them to a standard user. This directly addresses the need to quickly review and change user account types without a GUI.

Exam trap

The trap here is that candidates often confuse `net user` with `net localgroup`, assuming `net user` can change group membership because it manages user accounts, but `net user` only modifies the user object itself, not its group affiliations.

How to eliminate wrong answers

Option A is wrong because `lusrmgr.msc` (Local Users and Groups MMC) is a graphical management console, not a command-line tool, and the question explicitly requires a command-line solution. Option B is wrong because `net user` manages individual user account properties (like password, account expiry) but cannot directly add or remove a user from a local group like Administrators; it lacks the `/add` or `/delete` group membership switches. Option D is wrong because `diskpart` is a disk partitioning tool used for managing disks, volumes, and partitions, and has no functionality for user account or group management.

Full explanation →

423

MCQmedium

A technician is tasked with securely connecting a remote office to the main office over the internet. The remote office has 10 users who need access to the same resources as local users. Which of the following remote access methods provides the most secure and scalable solution?

A.Configure port forwarding on the main office router for each required service

B.Set up a site-to-site VPN between the two offices

C.Use Remote Desktop for each user to connect to a workstation at the main office

D.Implement a client-to-site VPN for each user

AnswerB

A site-to-site VPN establishes a secure, encrypted tunnel between the two office networks, effectively making them appear as one contiguous network. This allows all users in the remote office to securely access resources in the main office as if they were locally connected, without individual client configuration. It provides robust network-level security and is highly scalable for connecting entire branch offices.

Why this answer

A site-to-site VPN (often using IPsec or a secure tunnel protocol) creates an encrypted, always-on connection between the two office routers, allowing all 10 users transparent access to the main office resources as if they were on the same LAN. This method is both secure (encrypting all traffic) and scalable (handling multiple users without per-client configuration), making it the best fit for connecting entire networks over the internet.

Exam trap

CompTIA often tests the distinction between site-to-site and client-to-site VPNs, where candidates mistakenly choose client-to-site VPN (Option D) thinking it is more secure per-user, but the question emphasizes 'scalable' and 'connecting a remote office'—a site-to-site VPN is the correct enterprise solution for network-to-network connectivity.

How to eliminate wrong answers

Option A is wrong because port forwarding exposes specific services directly to the internet, creating a large attack surface and requiring manual configuration for each service, which is neither secure nor scalable for multiple users. Option C is wrong because Remote Desktop Protocol (RDP) provides only per-user, per-session access to individual workstations, which is not designed for network-level resource sharing and introduces significant management overhead for 10 users. Option D is wrong because client-to-site VPN requires each user to install and maintain a VPN client, which adds administrative burden and is less scalable than a site-to-site VPN that centralizes the connection at the network edge.

Full explanation →

424

MCQmedium

An iOS user is concerned about a lost iPhone and wants to ensure that if the device is erased, it cannot be reactivated without their Apple ID and password. Which iOS security feature provides this protection?

A.Find My iPhone location tracking.

B.Activation Lock, enabled by Find My iPhone.

C.iCloud Keychain with two-factor authentication.

D.Lost Mode in the Find My app.

AnswerB

Activation Lock is a robust anti-theft feature automatically enabled when Find My iPhone is active on an iOS device. This security measure links the device's hardware to the owner's Apple ID, requiring that specific Apple ID and password to erase the device, turn off Find My, or reactivate it after a factory reset. It effectively renders a stolen iPhone useless to anyone but the original owner, significantly deterring theft.

Why this answer

Activation Lock is an iOS security feature that is automatically enabled when Find My iPhone is turned on. It ties the device to the owner's Apple ID, preventing anyone from reactivating the device after it is erased or restored without entering the correct Apple ID and password. Find My iPhone locates the device, but Activation Lock provides the anti-theft protection. iCloud Keychain is for passwords, and Lost Mode locks the device but does not prevent reactivation after a wipe.

Full explanation →

425

MCQeasy

A customer needs to transfer their user profile, documents, and application settings from an old Windows 7 PC to a new Windows 10 PC. Which Windows tool is specifically designed for this purpose?

A.Windows Easy Transfer

B.File History

C.User State Migration Tool (USMT)

D.Windows Backup and Restore

AnswerC

The User State Migration Tool (USMT) is a command-line utility provided by Microsoft as part of the Windows Assessment and Deployment Kit (ADK), specifically designed for IT professionals to migrate user profiles, files, and operating system settings during large-scale Windows deployments. It captures a user's entire "state" from a source computer using `scanstate` and then restores it to a new or reinstalled Windows machine using `loadstate`, making it ideal for transferring comprehensive user profile documents and settings.

Why this answer

The User State Migration Tool (USMT) is a command-line utility designed for IT professionals to automate large-scale user state migrations, including user profiles, documents, and application settings, from one Windows OS to another. It supports migration from Windows 7 to Windows 10 and provides granular control over what is transferred via XML configuration files.

Exam trap

A common mistake is thinking Windows Easy Transfer is still available for Windows 7 to Windows 10 migrations, but it was removed after Windows 8. USMT is the correct enterprise-grade tool for this scenario, as it is included in the Windows Assessment and Deployment Kit (ADK).

How to eliminate wrong answers

Option A is wrong because Windows Easy Transfer was deprecated starting with Windows 8 and is not available for migrating from Windows 7 to Windows 10; it was a consumer tool that did not support cross-version migrations in later OS releases. Option B is wrong because File History is a backup feature that only protects personal files in libraries, not user profiles or application settings, and is not designed for migrating to a new PC. Option D is wrong because Windows Backup and Restore creates system image backups or file backups but does not specifically migrate user profiles and application settings to a new operating system version; it is intended for disaster recovery, not user state transfer.

Full explanation →

426

MCQmedium

An employee's company-issued Android phone is suddenly displaying pop-up ads even when no browser is open. The employee claims they only downloaded apps from the official Google Play Store. Which of the following is the MOST likely cause?

A.The phone's firmware is outdated.

B.A recently installed app has been granted 'Draw over other apps' permission.

C.The phone's Wi-Fi network is infected with malware.

D.The phone's screen has a hardware defect causing ghost touches.

AnswerB

The 'Draw over other apps' permission, also known as 'Display over other apps' or 'Overlay permission,' grants an application the ability to render its content on top of any other running application or the system UI. Malicious adware frequently leverages this powerful permission to display intrusive, unsolicited advertisements that appear suddenly and cover legitimate app content, making them difficult to dismiss and often obscuring the actual source. This behavior is a hallmark of adware that aims to force ad impressions onto the user.

Why this answer

The 'Draw over other apps' permission allows an app to display content on top of other applications, including the home screen and lock screen. This is a common technique used by adware and malicious apps to serve persistent pop-up ads even when no browser is open, as the app can draw its own window outside of the normal app lifecycle. Since the employee only downloaded from Google Play, this permission abuse is the most likely cause, as even Play Store apps can be granted this permission by the user during installation or runtime.

Exam trap

CompTIA often tests the distinction between network-level threats (like DNS hijacking) and client-side permission abuse, so the trap here is that candidates may assume pop-up ads always come from browser-based malware or network injection, rather than recognizing the 'Draw over other apps' permission as the specific Android mechanism for persistent on-screen overlays.

How to eliminate wrong answers

Option A is wrong because an outdated firmware (system software) typically causes security vulnerabilities or performance issues, but it does not directly cause pop-up ads to appear; adware behavior is tied to app-level permissions, not firmware version. Option C is wrong because a Wi-Fi network infected with malware would typically intercept or redirect web traffic, not inject pop-up ads into the Android UI layer; pop-ups that appear without a browser open are a client-side overlay issue, not a network-level attack. Option D is wrong because ghost touches from a hardware defect would cause random taps and interactions, not the display of structured pop-up ads with specific content; ghost touches cannot generate ad windows with text and images.

Full explanation →

427

MCQhard

A technician needs to configure a Windows 10 kiosk machine that runs a single full-screen application for public use. They want to prevent users from accessing the desktop, taskbar, or any other system functions. Which Settings page should they use to set up this restricted user experience?

A.Settings > Personalization > Start

B.Control Panel > User Accounts > Manage User Accounts

C.Settings > Accounts > Other users > Set up a kiosk

D.Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings

AnswerC

This is the correct and most direct path in Windows 10 for configuring a single-app kiosk. The 'Set up a kiosk' option utilizes the 'Assigned Access' feature, which creates a highly restricted user experience. It allows an administrator to designate a specific user account to run only one Universal Windows Platform (UWP) application in full-screen mode, preventing access to the desktop, Start menu, taskbar, or other system functions, thereby ensuring a true kiosk environment.

Why this answer

The 'Set up a kiosk' option under Settings > Accounts > Other users is the dedicated Windows 10 feature for configuring an assigned access kiosk. This setting restricts the user to a single full-screen Universal Windows Platform (UWP) app and blocks access to the desktop, taskbar, and other system functions, meeting the exact requirement for a public-facing kiosk.

Exam trap

The trap here is that candidates often confuse the 'Set up a kiosk' feature with Group Policy security settings or user account management, mistakenly thinking that locking down a kiosk requires complex policy edits rather than the simple, built-in Settings wizard.

How to eliminate wrong answers

Option A is wrong because Settings > Personalization > Start only controls Start menu appearance and layout, not the ability to lock down the entire user experience or prevent desktop access. Option B is wrong because Control Panel > User Accounts > Manage User Accounts is used for standard user account management (creating, deleting, changing passwords) and does not provide any kiosk or restricted shell configuration. Option D is wrong because Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings deals with security policies like password policies, audit policies, and user rights assignments, not the assigned access kiosk mode which is configured via Settings or the 'Set up a kiosk' wizard.

Full explanation →

428

MCQhard

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

A.Reset the account password and enable MFA.

B.Disable the account to prevent further access.

C.Review the server logs to determine the extent of the breach.

D.Notify the employee's manager and HR department.

AnswerB

Disabling the compromised account is the paramount first step in incident response, specifically within the containment phase. This action immediately revokes all authentication tokens and active sessions associated with the account, effectively severing the attacker's current access and preventing any further unauthorized actions or data exfiltration. It provides a critical window for the security team to investigate and remediate the breach without the attacker continuing to operate within the system.

Why this answer

The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Full explanation →

429

MCQmedium

During a software deployment, a user reports that a stranger in a delivery uniform asked to use their computer to 'check a shipment status' and then quickly left. Later, the user notices unusual network activity. What should the technician investigate first?

A.Check the user's email for phishing messages.

B.Verify the delivery person's identity with the shipping company.

C.Scan the workstation for malware and review recent system changes.

D.Disable the user's network access permanently.

AnswerC

Unauthorized physical access to a workstation creates a high probability that an attacker could have installed malicious software, altered system configurations, or created backdoors for future access. Scanning for malware identifies immediate threats, while reviewing recent system changes helps pinpoint unauthorized modifications, making these crucial first steps in containment, eradication, and investigation to restore system integrity.

Why this answer

The scenario describes a classic social engineering attack where an unauthorized individual gains physical access to a workstation under a pretext. The immediate technical priority is to scan the workstation for malware and review recent system changes because the attacker may have installed a backdoor, keylogger, or remote access trojan (RAT) that explains the unusual network activity. This aligns with incident response best practices: isolate and analyze the affected system first to contain potential data exfiltration or lateral movement.

Exam trap

The CompTIA A+ exam often tests the candidate's ability to prioritize immediate technical containment over administrative or non-technical follow-ups; the trap here is that many candidates choose Option B (verifying identity) because it seems logical for a physical security breach, but the exam expects you to recognize that the workstation is already compromised and must be investigated first.

How to eliminate wrong answers

Option A is wrong because checking the user's email for phishing messages addresses a different attack vector (email-based social engineering), but the incident here involved direct physical access, not a phishing link. Option B is wrong because verifying the delivery person's identity with the shipping company is a non-technical, administrative step that does not address the immediate technical threat of malware or unauthorized system changes already present on the workstation. Option D is wrong because permanently disabling the user's network access is an overreaction and violates the principle of least disruption; a temporary network isolation (e.g., disabling the NIC or blocking the port) is appropriate, but permanent access removal is not a diagnostic or containment step.

Full explanation →

430

MCQmedium

A user reports that their Windows 10 computer is infected with a virus that keeps reinstalling itself after removal. What should you do to remediate this persistent infection?

A.Run a system restore to a previous restore point

B.Boot from a rescue disc or USB and run an antivirus scan

C.Disable System Restore and then run an antivirus scan in normal mode

D.Reinstall Windows from the recovery partition

AnswerB

Booting from a rescue disc or USB drive is the most effective method because it ensures the infected operating system is not active, preventing the malware from running, hiding, or interfering with the scanning process. This clean boot environment allows the antivirus software to access and thoroughly scan the entire file system, including hidden areas and system files, for complete and unhindered removal of malicious code. This approach bypasses the malware's ability to defend itself, ensuring a comprehensive cleanup.

Why this answer

A virus that reinstalls itself likely has a rootkit or persistent mechanism. Booting from trusted media and scanning the offline system ensures the malware cannot run, allowing complete removal.

Full explanation →

431

MCQmedium

A technician is configuring a new Windows 10 workstation for a user who handles sensitive financial data. The company policy mandates that the screen lock after 5 minutes of inactivity and require a password on wake. Which settings should the technician configure?

A.Set the power plan to turn off the display after 5 minutes.

B.Configure the screen saver to start after 5 minutes and check 'On resume, display logon screen.'

C.Enable the 'Require password on wakeup' setting in the power plan only.

D.Set the computer to sleep after 5 minutes and require a password on wake.

AnswerB

Configuring the screen saver to activate after 5 minutes of inactivity, combined with checking the 'On resume, display logon screen' option, directly addresses the requirement. The screen saver initiates after the specified idle period, and the critical checkbox ensures that upon any user input to dismiss the screen saver, the Windows logon screen is presented. This effectively locks the user's session, requiring re-authentication and thus securing the workstation as per policy.

Why this answer

The screen saver settings in Windows include an option to 'On resume, display logon screen,' which locks the workstation after the screen saver activates. Setting the screen saver timeout to 5 minutes and enabling the logon screen requirement meets the policy.

Full explanation →

432

MCQmedium

A technician is on a support call with a user who has a strong accent and is speaking quickly. The technician is having difficulty understanding the issue. What is the most professional way to handle this?

A.Pretend to understand and hope the issue becomes clear during troubleshooting.

B.Ask the user to speak more slowly and repeat the problem, apologizing for the difficulty.

C.Transfer the call to a different technician who might understand the accent better.

D.Tell the user that their accent is hard to understand and ask them to email the problem instead.

AnswerB

This is the most professional and effective approach for a technician. By politely asking the user to slow down and repeat, the technician demonstrates active listening and a genuine commitment to understanding the issue, fostering a positive customer experience. Apologizing for the difficulty, even if it's a communication barrier, shows empathy and helps de-escalate potential frustration, paving the way for accurate problem identification and resolution.

Why this answer

It demonstrates active listening and professional courtesy by politely asking the user to slow down and repeat the issue. This approach maintains rapport, ensures accurate information gathering, and avoids misdiagnosis that could lead to wasted time or incorrect troubleshooting steps. In a support context, clear communication is essential for identifying the root cause and applying the correct fix.

Exam trap

CompTIA often tests the candidate's ability to prioritize professional communication over technical shortcuts, and the trap here is that candidates may choose Option C (transfer the call) thinking it is efficient, but it actually violates the principle of taking ownership of the customer's issue.

How to eliminate wrong answers

Option A is wrong because pretending to understand risks missing critical details about the problem, leading to ineffective or even harmful troubleshooting steps that could escalate the issue or violate service-level agreements. Option C is wrong because transferring the call without first attempting to clarify the issue is unprofessional and may not resolve the communication barrier; it also wastes time and shifts responsibility unnecessarily. Option D is wrong because telling the user their accent is hard to understand is disrespectful and unprofessional, and asking them to email the problem bypasses real-time interaction, potentially delaying resolution and frustrating the user.

Full explanation →

433

MCQmedium

A company is decommissioning a server that contained encrypted customer financial data. The IT manager wants to ensure the data is destroyed without damaging the hard drives, as they will be reused in test environments. Which method should be used?

A.Physically shred the drives.

B.Perform a standard format and reinstall the OS.

C.Issue a cryptographic erase command to the drive's self-encrypting feature.

D.Use a degausser on the drives.

AnswerC

Issuing a cryptographic erase command to a self-encrypting drive (SED) is the most secure and efficient method for data sanitization while preserving drive functionality. This command instructs the drive's built-in encryption controller to instantly generate and apply a new, random encryption key, effectively rendering all previous data unreadable and irrecoverable with the old key. Since the data itself remains encrypted but inaccessible, the drive can be immediately reused or repurposed without physical destruction or lengthy overwriting processes.

Why this answer

The server's hard drives are self-encrypting drives (SEDs) that support the TCG Opal or IEEE 1667 standard. Issuing a cryptographic erase command (e.g., via hdparm --security-erase or a vendor tool) instantly invalidates the media encryption key, rendering all data on the drive permanently inaccessible without physically damaging the drive. This meets the requirement of destroying the encrypted customer financial data while preserving the drives for reuse in test environments.

Exam trap

A common misconception tested on the CompTIA A+ exam is that a standard format or OS reinstall is sufficient for secure data destruction. However, encrypted data on SEDs remains recoverable unless the encryption key is specifically invalidated via a cryptographic erase command.

How to eliminate wrong answers

Option A is wrong because physically shredding the drives destroys them, contradicting the requirement to reuse them in test environments. Option B is wrong because a standard format and OS reinstall only overwrites file system metadata and does not securely erase the underlying encrypted data; the original media encryption key remains intact, and data could potentially be recovered from the encrypted sectors. Option D is wrong because using a degausser applies a strong magnetic field that destroys the drive's firmware, servo tracks, and the self-encrypting capability, making the drive permanently unusable and violating the reuse requirement.

Full explanation →

434

MCQeasy

A system administrator is deploying a PowerShell script to 100 computers to change the local administrator password. The script must run once per computer and then exit. Which scripting technique ensures the script runs exactly once on each machine?

A.Use a for loop to run the script 100 times

B.Write a registry key after successful execution

C.Use a parameter to pass the computer name

D.Schedule the script to run daily

AnswerB

Implementing a registry key as an execution flag is a robust method to ensure a script runs only once per machine. After the script successfully completes its intended task, it can create a specific registry key (e.g., HKLM:\SOFTWARE\MyCompany\MyScript\Executed). Subsequent executions of the script would first check for the presence of this key; if found, the script would immediately terminate, preventing redundant operations and ensuring idempotence on each target system.

Why this answer

This question covers idempotency and run-once mechanisms. Using a registry key or a marker file to record that the script has executed prevents it from running again on reboot or reapplication. Loops and parameters don't enforce a single execution.

Full explanation →

435

MCQmedium

A small business owner wants to ensure that all company laptops have their hard drives encrypted in case of theft. The laptops run Windows 10 Pro. Which technology should the technician enable to meet this requirement?

A.EFS (Encrypting File System)

B.Windows Defender Antivirus

C.BitLocker Drive Encryption

D.TPM (Trusted Platform Module)

AnswerC

BitLocker Drive Encryption is a full-disk encryption feature included with Windows Pro and Enterprise editions that encrypts an entire volume, typically the operating system drive. By encrypting all data at rest, BitLocker ensures that even if a laptop is lost or stolen, the data remains inaccessible without the correct decryption key or recovery password. This comprehensive protection is crucial for safeguarding sensitive business information against physical device compromise, directly addressing the need for data protection on lost or stolen laptops.

Why this answer

BitLocker Drive Encryption (option C) is the correct technology because it provides full-disk encryption for Windows 10 Pro, ensuring that all data on the laptop's hard drive is encrypted at rest. This protects against data exposure if the device is stolen, as the drive cannot be accessed without the decryption key (e.g., a PIN, USB key, or TPM-based authentication). BitLocker is built into Windows 10 Pro and is specifically designed for whole-drive encryption, meeting the requirement for all company laptops.

Exam trap

The trap here is that candidates often confuse EFS (file-level encryption) with full-disk encryption, or they mistakenly think TPM alone provides encryption, when in fact TPM is merely a key storage and attestation component that requires BitLocker to enable drive encryption.

How to eliminate wrong answers

Option A is wrong because EFS (Encrypting File System) encrypts individual files or folders at the file system level, not the entire hard drive, and it does not protect system files or the operating system from offline access after theft. Option B is wrong because Windows Defender Antivirus is a malware protection tool that detects and removes malicious software; it does not provide any encryption or data protection for the hard drive. Option D is wrong because TPM (Trusted Platform Module) is a hardware security chip that can store encryption keys and support BitLocker, but it is not an encryption technology itself—it must be combined with BitLocker to achieve full-disk encryption.

Full explanation →

436

MCQeasy

A small business is deploying a new accounting application across five workstations. The IT lead creates a detailed change request that includes the purpose, scope, risk assessment, and rollback plan. Which document should the IT lead update immediately after the deployment is successfully completed?

A.The firewall configuration log

B.The change request form

C.The employee handbook

D.The backup verification checklist

AnswerB

The change request form (CRF) is a formal document used within IT service management (ITSM) frameworks, such as ITIL, to initiate, track, and approve modifications to IT infrastructure, services, or applications. It details the proposed change, its justification, impact analysis, approval signatures, implementation plan, and crucially, the actual completion date and verification of the change. Therefore, it serves as the authoritative record for confirming the successful deployment of a new accounting application.

Why this answer

The change request form is the central document that tracks the entire lifecycle of a change, including planning, approval, implementation, and post-implementation review. Once the deployment is successfully completed, the IT lead must update the change request form to mark it as 'Closed' or 'Completed,' documenting the actual outcome, any deviations, and the final status. This ensures an accurate audit trail for compliance and future troubleshooting, as required by ITIL-based change management processes.

Exam trap

CompTIA often tests the misconception that a technical log or checklist (like a backup verification checklist) is the immediate post-deployment update, but the correct answer is always the formal change management document that captures the entire change lifecycle.

How to eliminate wrong answers

Option A is wrong because the firewall configuration log is a security-specific record that would only be updated if firewall rules were modified as part of the deployment; the question describes a standard application installation with no mention of firewall changes. Option C is wrong because the employee handbook is a general HR policy document that outlines company rules and procedures, not a technical record for tracking IT changes or deployments. Option D is wrong because the backup verification checklist is used to confirm that backups were successfully created before or after a change, but it is not the primary document for recording the completion and outcome of a change request.

Full explanation →

437

MCQeasy

A user wants to encrypt a USB flash drive so that if it is lost, the data cannot be read on another computer. The USB drive will be used on both Windows 10 and Windows 11 devices. Which Windows feature should be used?

A.EFS (Encrypting File System)

B.BitLocker To Go

C.Windows Defender Encryption

D.Secure Boot

AnswerB

BitLocker To Go is the dedicated feature within Windows Pro and Enterprise editions specifically designed for encrypting removable data drives, such as USB flash drives and external hard drives. It provides full-disk encryption, protecting all data stored on the drive with a password or smart card. This feature ensures data security even if the drive is lost or stolen, and it allows access to the encrypted content on other Windows 10/11 systems with the correct credentials.

Why this answer

BitLocker To Go is the correct choice because it provides full-disk encryption specifically designed for removable drives like USB flash drives. It encrypts the entire drive using AES encryption, and when the drive is inserted into another Windows 10 or Windows 11 computer, the user must enter the password or use a smart card/recovery key to access the data. This ensures that if the drive is lost, the data remains unreadable on any other system.

Exam trap

CompTIA often tests the distinction between EFS and BitLocker To Go, where candidates mistakenly choose EFS because they think file-level encryption is sufficient for removable media, but EFS does not protect data when the drive is moved to another computer because the encryption certificate is not present on the target system.

How to eliminate wrong answers

Option A is wrong because EFS (Encrypting File System) encrypts individual files and folders on NTFS volumes, but it is tied to the user's account and certificate on the local machine; it does not protect data when the drive is moved to another computer, and it is not designed for removable drives. Option C is wrong because Windows Defender Encryption is not a real Windows feature; the correct name is Windows Device Encryption, which is a simplified version of BitLocker for system drives on supported hardware, not for removable USB drives. Option D is wrong because Secure Boot is a UEFI firmware security feature that ensures only trusted bootloaders and drivers are loaded during startup; it does not encrypt data on a USB drive or protect data at rest.

Full explanation →

438

MCQeasy

A customer is frustrated because every time they plug in a USB flash drive, Windows automatically opens the folder and plays any media files. They want to stop this behavior but still want the drive to be recognized. Which Control Panel item should you use?

A.File Explorer Options

B.AutoPlay

C.Device Manager

D.Sound

AnswerB

AutoPlay is a Windows feature, configurable through the Control Panel or Settings app, that allows users to define default actions for various types of media and devices when they are connected or inserted. For removable drives, such as USB flash drives, AutoPlay presents options like "Open folder to view files," "Import photos and videos," or "Take no action," directly addressing the customer's desire to control the automatic behavior upon device connection. This mechanism prevents unwanted applications from launching or specific actions from occurring without user intervention.

Why this answer

The AutoPlay settings in Control Panel let you configure default actions for different media types. Disabling or setting 'Take no action' for removable drives stops automatic folder opening and media playback without affecting drive recognition.

Full explanation →

439

MCQeasy

A customer reports that their printer is not working after a recent Windows update. The technician suspects a driver issue. Which of the following is the BEST way to handle this situation while maintaining customer satisfaction?

A.Tell the customer that Windows updates often break things and they should avoid updates.

B.Ask the customer to try unplugging the printer and plugging it back in.

C.Say you will research the issue and call them back within an hour with steps.

D.Immediately remote into their computer and start checking settings without explaining.

AnswerC

This is the most professional and effective initial response. It demonstrates a commitment to resolving the problem by taking ownership, sets a clear expectation for follow-up within a defined timeframe, and allows the technician to perform necessary research (e.g., checking known issues, driver updates, or specific error codes) before attempting a fix. This approach builds customer confidence and ensures a more informed and efficient troubleshooting process, rather than guessing or attempting immediate, potentially ineffective, actions.

Why this answer

It demonstrates professional communication and sets realistic expectations. The technician acknowledges the issue, commits to researching the specific driver compatibility problem caused by the Windows update, and promises a follow-up within a defined timeframe. This approach maintains customer trust and avoids making promises or taking actions without a clear plan.

Exam trap

The trap here is that candidates may choose Option B (unplug/replug) because it is a common troubleshooting step, but the question specifically tests communication and professionalism, not basic hardware troubleshooting, so the best answer is the one that manages the customer's expectations and demonstrates a planned, researched response.

How to eliminate wrong answers

Option A is wrong because telling the customer to avoid Windows updates is unprofessional, dismissive, and fails to address the actual driver issue; updates are necessary for security and stability. Option B is wrong because asking the customer to unplug and replug the printer is a generic hardware reset step that does not resolve a driver conflict caused by a Windows update; it wastes the customer's time and shows a lack of diagnostic effort. Option D is wrong because immediately remote into the computer without explaining the action violates customer consent and transparency; it can cause confusion or alarm and does not build trust.

Full explanation →

440

MCQmedium

A user is unable to install a new printer on their Windows 10 workstation because the 'Print Spooler' service is not running. You need to start the service and ensure it starts automatically on boot. Which tool should you use?

A.Device Manager

B.Services

C.Task Scheduler

D.System Configuration

AnswerB

The Services console (services.msc) is the definitive administrative tool for managing all background processes known as Windows services. It allows administrators to view the status of each service, start, stop, pause, or restart them, and configure their startup type (e.g., Automatic, Manual, Disabled). Printer installations frequently depend on services like the Print Spooler, and if such a service is stopped or misconfigured, this utility is the correct place to diagnose and rectify the issue, enabling successful printer setup.

Why this answer

The Print Spooler is a Windows service that manages print jobs sent to the printer. To start it and set its startup type to Automatic, you must use the Services console (services.msc), which provides direct control over service state and startup configuration. Device Manager manages hardware drivers, not service states.

Exam trap

The trap here is that candidates confuse Device Manager's ability to update or roll back printer drivers with the ability to start the underlying Print Spooler service, which is a service management task, not a device management task.

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware devices and their drivers, not to start or configure Windows services like the Print Spooler. Option C is wrong because Task Scheduler is designed to schedule automated tasks or scripts at specific times or events, not to manage the runtime state or startup type of a service. Option D is wrong because System Configuration (msconfig) controls boot options, startup programs, and general system startup behavior, but it does not allow you to start a stopped service or change its startup type to Automatic.

Full explanation →

441

MCQmedium

A technician needs to install a new hard drive in a computer that is under a strict security policy requiring all drives to be sanitized before disposal. The old drive will be replaced. What is the most secure method to ensure data cannot be recovered from the old drive?

A.Perform a quick format of the drive.

B.Use a degausser to erase the magnetic fields.

C.Run the Windows Disk Cleanup tool.

D.Delete all partitions using Disk Management.

AnswerB

Degaussing involves exposing a magnetic storage device, like a hard disk drive (HDD), to a powerful alternating magnetic field. This process randomizes the magnetic domains on the platters, effectively erasing all recorded data by rendering it unreadable. This method physically alters the magnetic properties of the storage medium, making data recovery practically impossible and satisfying the most stringent data destruction requirements for HDDs.

Why this answer

A degausser generates a powerful magnetic field that physically randomizes the magnetic domains on the platters, effectively destroying all stored data and rendering the drive unusable. This is the only method listed that meets the strict security policy requirement for sanitization, as it prevents any possible data recovery even with advanced forensic tools.

Exam trap

CompTIA often tests the misconception that a quick format or partition deletion is sufficient for data sanitization, when in reality these methods only remove pointers to the data, leaving the raw data recoverable with simple tools.

How to eliminate wrong answers

Option A is wrong because a quick format only rewrites the file system metadata (e.g., the MFT or FAT) and does not erase the actual data on the disk; data remains recoverable with tools like TestDisk or PhotoRec. Option C is wrong because the Windows Disk Cleanup tool only removes temporary files and empties the Recycle Bin; it does not touch user data or system files on the drive. Option D is wrong because deleting partitions using Disk Management only removes the partition table entries, leaving the underlying data intact and fully recoverable until overwritten.

Full explanation →

442

MCQmedium

A technician is deploying a new accounting software package across the company. The finance manager requests that the software be installed on their personal laptop, which is not company-managed. Company policy prohibits installing unapproved software on personal devices. How should the technician respond?

A."I'm sorry, but company policy doesn't allow installing this software on personal devices. However, I can help you set up remote access to a company workstation that has it."

B."I can install it, but you'll have to sign a waiver accepting all risks."

C."That's against policy. Please use a company laptop."

D."I'll need to get approval from IT management first. Can you email the request?"

AnswerA

This response effectively balances adherence to company policy with user support. By stating that installing software on personal devices is prohibited, the technician upholds crucial security, licensing, and data integrity standards. Simultaneously, offering remote access to a company workstation provides a practical, policy-compliant alternative that enables the user to perform their job functions without compromising organizational security or compliance.

Why this answer

It upholds the company's security policy by refusing to install unapproved software on a non-managed device, while still providing a practical solution: setting up remote access (e.g., via VPN and Remote Desktop Protocol) to a company workstation that already has the accounting software. This approach ensures compliance with policy and maintains data security by keeping the software within the managed environment.

Exam trap

CompTIA often tests the candidate's ability to balance policy enforcement with customer service, and the trap here is that candidates may choose a technically correct but unhelpful response (like C or D) instead of the one that both follows policy and provides a workable solution.

How to eliminate wrong answers

Option B is wrong because having the user sign a waiver does not negate the company policy; it still results in installing unapproved software on a personal device, which exposes the company to security risks such as data leakage or malware infection, and violates compliance requirements. Option C is wrong because while it correctly states the policy, it simply tells the user to use a company laptop without offering any immediate solution or guidance, which is unhelpful and fails to address the finance manager's need for access. Option D is wrong because it unnecessarily escalates the request to IT management for approval when the policy is already clear—this wastes time and does not resolve the user's need; the technician should know the policy and provide a compliant alternative directly.

Full explanation →

443

MCQmedium

A user complains that their laptop battery drains quickly and the device gets very hot. The battery is a lithium-ion type and is three years old. What is the most environmentally responsible recommendation?

A.Replace the entire laptop with a new Energy Star model.

B.Remove the battery and run the laptop only on AC power.

C.Replace the battery with a compatible model and recycle the old battery at a certified e-waste facility.

D.Continue using the laptop until the battery fails completely.

AnswerC

Replacing the depleted battery with a new, compatible model is the most appropriate and sustainable solution. This action restores the laptop's full functionality and portability, significantly extending its useful lifespan while being more cost-effective than purchasing a new device. Concurrently, recycling the old battery at a certified e-waste facility ensures hazardous materials are handled safely, preventing environmental contamination and promoting resource recovery.

Why this answer

It directly addresses the user's complaint (battery degradation causing heat and poor runtime) while ensuring responsible disposal of the hazardous lithium-ion battery. Recycling at a certified e-waste facility prevents toxic materials from entering landfills and allows recovery of valuable metals, aligning with environmental best practices.

Exam trap

The trap here is that candidates may choose Option B (remove battery and run on AC) thinking it solves the heat issue, but they overlook that the old battery still needs proper disposal and that the laptop's heat could stem from other factors like dust or failing thermal paste.

How to eliminate wrong answers

Option A is wrong because replacing the entire laptop when only the battery is faulty is wasteful and unnecessarily increases e-waste, even if the new model is Energy Star rated. Option B is wrong because removing the battery and running solely on AC power does not solve the heat issue (the laptop may still throttle or run hot due to other components) and leaves the old battery unaddressed, which could still pose a fire risk if stored improperly. Option D is wrong because continuing to use a degraded lithium-ion battery risks thermal runaway, swelling, or leakage, and delays responsible recycling, which is environmentally harmful.

Full explanation →

444

MCQhard

A company is migrating from Windows 10 to Windows 11 on several workstations. You need to verify that each computer meets the minimum hardware requirements, including TPM 2.0 and Secure Boot capability, before deploying the upgrade. Which built-in tool should you run on each machine to generate a compatibility report?

A.System Information (msinfo32.exe) and manually check the System Summary for TPM and Secure Boot status.

B.Windows 11 PC Health Check app (downloaded from Microsoft).

C.Deployment Imaging and Servicing Management (DISM) with the /Get-CurrentEdition option.

D.System Restore (rstrui.exe) to revert to a previous state if the upgrade fails.

AnswerB

The Windows 11 PC Health Check app is the official and most accurate tool specifically designed by Microsoft to assess a system's compatibility with Windows 11. It performs a comprehensive scan of all hardware and software requirements, including CPU generation, RAM, storage, TPM 2.0, and Secure Boot status. The app then provides a clear, consolidated pass/fail report, detailing any specific components that do not meet the upgrade criteria.

Why this answer

The Windows 11 PC Health Check app is the official Microsoft tool designed specifically to verify compatibility with Windows 11, including TPM 2.0 and Secure Boot capability. It generates a detailed compatibility report, making it the correct built-in tool for this pre-upgrade validation task.

Exam trap

The trap here is that candidates may confuse the PC Health Check app with the older Windows 10 Upgrade Assistant or rely on manual checks via msinfo32, but the exam specifically tests knowledge of the dedicated compatibility tool introduced for Windows 11.

How to eliminate wrong answers

Option A is wrong because manually checking System Information (msinfo32.exe) for TPM and Secure Boot status is inefficient and does not generate a compatibility report; it only displays raw hardware data without assessing Windows 11 requirements. Option C is wrong because DISM with /Get-CurrentEdition is used to display the current edition of Windows (e.g., Pro, Enterprise) and is unrelated to hardware compatibility checks. Option D is wrong because System Restore (rstrui.exe) is a recovery tool for reverting system changes, not a compatibility assessment tool.

Full explanation →

445

MCQeasy

A user reports that their Windows 10 laptop is running slowly and frequently shows a 'Low Memory' warning. They have 8 GB of RAM and are not running any unusual applications. Which built-in Windows tool should you use to determine if a specific process is leaking memory?

A.Performance Monitor

B.Task Manager

C.Event Viewer

D.System Configuration (msconfig)

AnswerB

Task Manager is the most direct and accessible utility for immediately identifying processes consuming excessive memory. Its 'Processes' or 'Details' tab provides a real-time, sortable list of all running applications and background processes, clearly displaying their current memory usage. This allows a technician to quickly pinpoint which specific process is exhibiting escalating memory consumption, a hallmark sign of a memory leak.

Why this answer

Task Manager (Option B) is the correct tool because it provides a real-time view of per-process memory usage, including the 'Memory (Active Private Working Set)' column, which can identify a process that is consuming an abnormally increasing amount of RAM over time—indicative of a memory leak. Unlike other tools, Task Manager allows you to quickly sort processes by memory usage and observe growth without needing to configure counters or parse logs.

Exam trap

CompTIA often tests the misconception that Performance Monitor is the only tool for memory leak diagnosis, but Task Manager is the correct first-line tool for quickly identifying a leaking process in a user-reported scenario.

How to eliminate wrong answers

Option A is wrong because Performance Monitor requires you to manually add specific counters (e.g., Process\Private Bytes) and set up data collector sets to track memory usage over time, which is more complex and not the quickest built-in tool for identifying a leaking process on a user's laptop. Option C is wrong because Event Viewer logs system, security, and application events, but it does not display real-time per-process memory consumption or memory leak patterns; it would only show low memory warnings after the fact, not the specific process causing the leak. Option D is wrong because System Configuration (msconfig) is used to manage boot options, startup programs, and services, not to monitor or diagnose active memory usage or leaks.

Full explanation →

446

MCQhard

A technician needs to deploy a custom security policy to all Windows 10 workstations in a small office. The policy must restrict access to the Control Panel and prevent users from changing system settings. Which administrative tool should be used to create and apply this policy locally on each machine?

A.Local Security Policy (secpol.msc)

B.User Accounts (netplwiz)

C.Local Group Policy Editor (gpedit.msc)

D.System Configuration (msconfig)

AnswerC

Local Group Policy Editor (gpedit.msc) is the appropriate tool for deploying custom security policies on a standalone Windows machine. It provides extensive administrative templates under both Computer Configuration and User Configuration, allowing technicians to configure granular settings. These settings include restricting access to the Control Panel, disabling specific system features, enforcing software restrictions, and managing user environments, making it ideal for implementing comprehensive custom security policies.

Why this answer

The Local Group Policy Editor (gpedit.msc) is the correct tool because it provides the administrative templates and policy nodes (e.g., User Configuration > Administrative Templates > Control Panel) needed to restrict access to Control Panel and prevent system setting changes. These settings are written to the local Group Policy Objects (GPOs) stored in %SystemRoot%\System32\GroupPolicy, which Windows applies at user logon. This tool is available on Windows 10 Pro, Enterprise, and Education editions, but not on Windows 10 Home.

Exam trap

A common misconception is that Local Security Policy (secpol.msc) can handle all policy restrictions, but it only covers security-specific settings, not administrative templates for UI restrictions like Control Panel access.

How to eliminate wrong answers

Option A is wrong because Local Security Policy (secpol.msc) only manages security-related policies such as account policies, audit policies, and user rights assignments; it does not include administrative templates for restricting Control Panel access or system settings. Option B is wrong because User Accounts (netplwiz) is used to manage user account properties, passwords, and automatic logon settings, not to deploy custom security policies that restrict Control Panel or system changes. Option D is wrong because System Configuration (msconfig) is a boot and startup configuration tool for troubleshooting (e.g., selective startup, boot options, services), and it cannot create or apply security policies to restrict user access to system settings.

Full explanation →

447

MCQhard

A security incident occurred on a Windows 10 workstation where an unauthorized user gained access. The technician needs to review detailed security events, such as logon attempts and file access, to determine the scope of the breach. Which tool should the technician use to examine these logs?

A.Event Viewer

B.Resource Monitor

C.Performance Monitor

D.Local Security Policy

AnswerA

The Event Viewer is the definitive tool for investigating past security incidents on a Windows 10 workstation. It centralizes system logs, with the 'Windows Logs > Security' section specifically detailing events like logon attempts, object access, and privilege use. Each entry includes a timestamp, user account, and an Event ID, providing crucial forensic data to reconstruct the sequence of events during a security breach.

Why this answer

Event Viewer is the correct tool because it provides a centralized, detailed log of security-related events, including logon attempts (Event ID 4624 for successful logons, 4625 for failed logons) and file access audits (Event ID 4663). These logs are essential for forensic analysis to determine the scope of a breach on a Windows 10 workstation.

Exam trap

CompTIA often tests the distinction between tools that configure security settings (Local Security Policy) versus tools that review logged events (Event Viewer), leading candidates to confuse policy configuration with log review.

How to eliminate wrong answers

Option B (Resource Monitor) is wrong because it focuses on real-time performance data such as CPU, memory, disk, and network usage, not historical security event logs. Option C (Performance Monitor) is wrong because it tracks system performance counters and creates data collector sets for performance analysis, not security event auditing. Option D (Local Security Policy) is wrong because it is used to configure security settings like password policies and audit policies, not to review existing event logs.

Full explanation →

448

MCQeasy

A technician needs to deploy a PowerShell script to 50 Windows 10 workstations that will install a security update silently. The script must run with administrative privileges. Which method should the technician use to ensure the script executes properly without user interaction?

A.Double-click the script file on each workstation

B.Run the script via 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt

C.Use the 'Start-Process' cmdlet without elevation

D.Copy the script to the Startup folder

AnswerB

Executing the script using 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt is the most effective method for deploying a PowerShell script requiring administrative privileges. The '-ExecutionPolicy Bypass' parameter temporarily overrides the system's execution policy for the current session, allowing the script to run without restrictions. When launched from an elevated command prompt, the script inherits administrative rights, ensuring it can perform system-level changes, and the '-File' parameter specifies the script to execute directly.

Why this answer

Running 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt bypasses PowerShell's execution policy for that session and ensures the script runs with administrative privileges. This combination allows silent, unattended execution of the security update installation across multiple workstations without user interaction.

Exam trap

CompTIA often tests the misconception that double-clicking a .ps1 file executes it like a batch file, when in reality it opens in an editor, and that 'Start-Process' without elevation is sufficient for administrative tasks.

How to eliminate wrong answers

Option A is wrong because double-clicking a .ps1 file opens it in Notepad by default on Windows 10, not executing it; even if execution policy allowed it, it would require user interaction and does not guarantee elevation. Option C is wrong because 'Start-Process' without elevation (e.g., missing the '-Verb RunAs' parameter) runs the script with the current user's privileges, which may lack the administrative rights needed to install a security update. Option D is wrong because copying the script to the Startup folder runs it at user logon with the user's privileges (not elevated), and the execution policy may block it; it also requires user logon, not a silent deployment.

Full explanation →

449

MCQmedium

A company’s change management policy requires that all changes be categorized as standard, emergency, or normal. During a server migration, a technician discovers a critical security patch must be applied immediately to prevent a data breach. Which type of change should the technician request?

A.Standard change

B.Emergency change

C.Normal change

D.Service request

AnswerB

An emergency change is specifically designed for situations that demand immediate action to resolve a critical incident or prevent a major service disruption, such as an active security breach or a widespread system failure. This type of change allows for an expedited approval process, often bypassing some standard review steps, to deploy critical fixes like security patches without delay. Post-implementation review and documentation are still required to ensure proper governance and learning.

Why this answer

The scenario describes a critical security patch that must be applied immediately to prevent a data breach, which aligns with the definition of an emergency change. Emergency changes are pre-approved or fast-tracked to address urgent threats or service outages, bypassing the normal change advisory board (CAB) review process. This ensures the patch can be deployed without delay to mitigate the risk.

Exam trap

CompTIA often tests the distinction between 'emergency' and 'standard' changes by presenting a time-sensitive scenario where candidates mistakenly classify a critical patch as a standard change because it is a routine security update, ignoring the 'immediate' and 'critical' context.

How to eliminate wrong answers

Option A is wrong because a standard change is a low-risk, pre-approved change that follows a documented procedure (e.g., applying routine OS updates), not an urgent security patch requiring immediate action. Option C is wrong because a normal change requires full CAB review and scheduling, which would introduce unacceptable delay for a critical security vulnerability. Option D is wrong because a service request is a user-initiated request for information, access, or a standard service (e.g., password reset), not a change to the IT infrastructure like applying a security patch.

Full explanation →

450

MCQeasy

During a security incident, a user's files have been renamed with a '.encrypted' extension, and a ransom note demands Bitcoin to restore them. The user has no backups. What is the most appropriate immediate action?

A.Pay the ransom to regain access quickly.

B.Disconnect the computer from the network immediately.

C.Run a full antivirus scan to remove the malware.

D.Restart the computer in Safe Mode and attempt file recovery.

AnswerB

Disconnecting the computer from the network immediately is the most critical first step in containing a ransomware infection. This action prevents the malware from encrypting additional local files, stops it from accessing and encrypting shared network drives or cloud storage, and halts its potential spread to other systems or network segments. Isolating the compromised machine effectively limits the scope of the attack and preserves uninfected data, which is crucial for incident response.

Why this answer

Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

Full explanation →

CompTIA A+ Core 2 220-1202 (220-1202) — Questions 376–450