CompTIA A+ Core 2 220-1202 (220-1202) — Questions 451–525

A privacy filter prevents shoulder surfing by limiting the viewing angle of a monitor, protecting sensitive data from being seen by unauthorized individuals. This scenario tests knowledge of visual data protection controls.

This question tests understanding of advanced audit policies. To log file access, you need to enable 'Audit File Share' or 'Audit Detailed File Share' under Advanced Audit Policy. The 'Object Access' subcategory must be configured to log both success and failure events for file share access.

The 'Low Disk Space' warning on the C: drive can be resolved by using the built-in Storage Sense or the manual 'Free up space now' feature, both accessible under System > Storage. This page provides tools to delete temporary files, empty the Recycle Bin, and remove other unnecessary data to reclaim disk space without third-party software.

The net view command lists available shared resources on a specified server, allowing you to verify both network connectivity and share availability. It is a quick diagnostic tool for shared folder issues. Other commands either test basic connectivity or map drives but do not list shares.

The technician found an unauthorized change (the update) with no approval record. The first step in change management is to document and escalate the unauthorized change to the Change Advisory Board (CAB) to assess impact, determine root cause, and authorize remediation. Restoring or reinstalling without CAB approval could violate change control policies and introduce additional risks.

Using sudo with the find command elevates privileges to root, bypassing permission restrictions and allowing the user to search all directories.

Donating the switches to the school district aligns with the principle of reuse, which is the most environmentally responsible option before recycling or disposal. The switches are still functional, so extending their lifecycle reduces e-waste and benefits the community. This practice supports the waste hierarchy: reduce, reuse, recycle.

The correct answer is to verify the destruction by inspecting the platters for visible damage and ensuring they are not intact. Hammering may leave platters partially readable. This question tests the concept of verification in data destruction, as physical methods must be confirmed effective.

BitLocker To Go is the built-in Windows 10 Pro feature specifically designed to encrypt removable drives such as USB flash drives. It uses AES encryption to protect the entire volume, and the drive can be accessed only with a password, smart card, or recovery key. This directly satisfies the company's mandate for encrypting USB drives before use.

The System applet (also known as 'System Properties' or 'About' in Settings) is the correct Control Panel location to view and manage Windows activation status. After replacing the motherboard, Windows 10 detects a significant hardware change and may require re-activation. The System applet provides a 'Change product key' or 'Activate Windows' link to enter a new or existing license key, or to use the activation troubleshooter to re-activate with a digital license tied to a Microsoft account.

Account expiration policies can be set to automatically disable accounts after a specified period of inactivity. This enforces the security policy without manual intervention.

Group Policy is the correct tool in Windows environments to enforce restrictions on browser extensions across multiple computers. This prevents users from adding potentially malicious or unapproved extensions, enhancing security.

On Android devices, deleted files are moved to a recycle bin or trash folder (e.g., in the Files by Google app or the Gallery app's trash), not permanently erased. The system still counts these files as occupied storage until the trash is emptied, so even after deleting large files, the available space remains unchanged, causing the 'insufficient storage' error during app installation.

Optical discs cannot be overwritten (write-once media). Physical destruction, such as shredding or breaking, is the only reliable way to ensure data is unrecoverable. Degaussing has no effect on optical media.

Certificate-based authentication provides mutual authentication, meaning both the VPN client and server verify each other's identity using digital certificates issued by a trusted Certificate Authority (CA). Unlike PSK, which is a shared secret that can be leaked and reused across all devices, each certificate is unique per device, so compromise of one certificate does not expose the entire VPN infrastructure. This significantly reduces the blast radius of a security breach and aligns with the principle of least privilege.

Touching the CPU contacts with bare fingers transfers natural oils and contaminants from the skin onto the gold-plated contact pads. These oils can cause corrosion over time or create an insulating layer that impedes proper electrical connectivity, leading to intermittent failures or permanent damage. The primary concern is contamination, not ESD, overheating, or physical pressure.

This is a classic example of pretexting, where the attacker creates a fabricated scenario (pretext) to trick the victim into divulging sensitive information. The caller impersonated an IT staff member to establish trust and authority.

Scheduled tasks often run with limited permissions, so if the script requires administrative rights, it will fail when triggered automatically. The correct answer highlights the need to configure the task to run with highest privileges.

Standard local user accounts with NTFS permissions provide isolation by default; each user has their own profile folder with restricted permissions. The other options either don't enforce isolation (guest account) or are for different purposes (domain, BitLocker).

The persistent pop-up ads, even without a browser open, indicate adware behavior typical of malicious apps. Since the employee side-loaded a game from an unknown website, the most likely cause is that the side-loaded app contains adware. Booting into safe mode (which disables third-party apps) and uninstalling the suspicious app is the best immediate action because it removes the adware without data loss, unlike a factory reset.

Option C is correct because Android allows users to change the default home app via Settings > Apps > Default apps > Home app without uninstalling the new launcher or losing any data. This procedure simply reassigns the default launcher to the system's built-in launcher, preserving all installed apps, settings, and user data.

The 'Activation Error' after a software update typically indicates that the iPhone cannot reach Apple's activation servers to verify its eligibility. Since the SIM card is known to be working, the most logical first step is to check Apple's System Status page to rule out a server-side outage, which is a common cause of activation failures and can be resolved without any device-side intervention.

In a WPA2-Enterprise environment, the user's domain credentials are used for authentication. If the account is locked or the password has expired, authentication will fail even though the wireless association succeeds. This tests understanding of enterprise authentication integration.

Option B is correct because the change management policy requires that any modification to a system handling critical patient records must first be formally approved via a change request submitted to the Change Advisory Board (CAB). This ensures that risks are assessed, downtime is scheduled, and compliance with healthcare data regulations (e.g., HIPAA) is maintained before any physical work begins.

User Account Control (UAC) settings in Control Panel can be adjusted to always notify and require administrator credentials for installations. However, the most effective method is to make users standard accounts (not administrators) and configure UAC to the highest level.

A botnet is a network of infected computers that are remotely controlled to perform tasks like sending spam or launching DDoS attacks. The unusual network traffic and startup file indicate the machine is part of a botnet. Removal requires disconnecting from the network and scanning with updated anti-malware.

For cost-sensitive environments with sensitive data, physical destruction is often the most reliable and inexpensive method. Drilling through the platters is a low-cost way to render the drive unreadable without specialized equipment.

This warning typically indicates a certificate issue, such as an expired or invalid SSL certificate on the banking site itself. It is not a problem with the user's browser or computer.

CRT monitors contain hazardous materials such as lead, phosphor, and other heavy metals that pose environmental and health risks. Certified e-waste recycling facilities are equipped to safely dismantle and process these components in compliance with environmental regulations like the EPA's Resource Conservation and Recovery Act (RCRA). Option C is the correct disposal method because it ensures legal and environmentally responsible handling of e-waste.

Windows Remote Assistance (option B) is the correct built-in tool because it allows a user to invite a technician to remotely control their Windows 10 workstation via an invitation file or Easy Connect, using Remote Desktop Protocol (RDP) on TCP port 3389 but with a session-sharing model that requires the user's consent. This is ideal for a non-technical user, as they can launch it from the Start menu and follow simple prompts to generate an invitation or use a Microsoft account to share a code.

Legacy OSes often lack drivers for virtualized hardware, so using a P2V tool that can inject the necessary HAL and storage drivers during conversion is essential. Without this, the VM will likely blue screen on boot. This tests advanced knowledge of P2V migration challenges and driver injection.

The cp command with the -a (archive) option preserves permissions, ownership, timestamps, and copies recursively. It is the standard way to duplicate directory trees with metadata.

Option C is correct because change management documentation must include the business justification to demonstrate that the change was authorized and necessary. Without a clear reason, auditors cannot verify that the firewall rule complies with organizational security policy or regulatory requirements. The business justification provides the context needed to distinguish legitimate changes from unauthorized or malicious modifications.

Disk Cleanup (cleanmgr.exe) is the built-in tool for removing temporary files, system cache, and other unnecessary data. Storage Sense can automate this, but Disk Cleanup is the direct tool for manual cleanup. The other options do not clean temporary files.

Task Scheduler is the correct tool because it allows you to create a task that triggers on a specific event, such as user logon. You can set the trigger to 'At log on' for any user or a specific user, and the task will run automatically each time the user logs into the Windows 10 domain-joined computer. This is the native Windows mechanism for scheduling scripts or programs to run at logon without requiring additional configuration.

This is a tech support scam, a form of scareware that uses a persistent pop-up. Booting into Safe Mode with Networking allows the technician to run an anti-malware scan without the rogue process interfering. Safe Mode loads only essential drivers, preventing the scareware from starting.

A degausser generates a powerful magnetic field to erase data from magnetic media. SSDs (Solid State Drives) store data in NAND flash memory cells, which are not magnetic. The intense magnetic field from a degausser induces high currents in the SSD's internal circuitry, physically destroying the controller and memory chips, rendering the drive completely unusable.

The Remote Desktop Gateway (RD Gateway) acts as a proxy, allowing external RDP connections to internal desktops. When users can connect to the gateway itself but see no desktops, it typically indicates an authorization failure: the RD Gateway uses Resource Authorization Policies (RAPs) to control which desktops a user can access. If the user is not a member of the Active Directory group specified in the RAP, the gateway will deny the list of available desktops, even though the gateway connection succeeds.

The principle of least privilege requires that users have only the access necessary for their job. An inactive account with remote access violates this and also the principle of account lifecycle management. The immediate issue is that the account should have been disabled upon termination.

Option C is correct because enabling sleep mode after 15 minutes of inactivity places the computer into a low-power state (S3 sleep, Suspend-to-RAM) where the CPU is powered down but RAM retains data, allowing a quick wake-up. This directly reduces energy consumption during idle periods more effectively than simply turning off the display, as it cuts power to the processor, drives, and most peripherals.

The Privacy settings are managed through the Settings app in Windows 10/11, not the traditional Control Panel. However, the question tests knowledge of where privacy controls are located. The correct path is Settings > Privacy > Camera/Microphone, which allows per-app permission management.

MAC address filtering restricts network access to devices with approved MAC addresses, providing a basic layer of security. This is a simple way to allow only specific laptops to connect to the file server.

This question tests understanding of the chmod command for modifying file permissions. The script currently lacks execute permission for the owner; chmod u+x adds execute permission for the user (owner).

WPA3-SAE uses Simultaneous Authentication of Equals (SAE), which provides forward secrecy and prevents offline dictionary attacks. WPA2-PSK is vulnerable to handshake capture and offline cracking.

For mobile devices, a Kensington lock (cable lock) is a standard, lightweight physical security measure that can be used in various locations to tether the laptop to a fixed object, deterring opportunistic theft.

Gatekeeper controls where apps can be installed from. Setting it to 'App Store' restricts installations to only Mac App Store apps, meeting the business requirement.

The xcopy command with the /y switch suppresses the prompt to confirm overwriting, and /s copies directories and subdirectories (if needed). It is designed for file copying with advanced options like silent overwrite. Other commands either do not copy files or lack the silent overwrite feature.

This is a classic whaling attack, a form of phishing that targets high-level executives or impersonates them to trick employees into performing actions like wire transfers. The spoofed email address and urgent request are typical indicators. Whaling is a specific type of social engineering focused on senior staff.

According to change management best practices, when a deployment encounters failures, the immediate priority is to halt the deployment to prevent further issues and then execute the rollback plan to restore the failed workstations to their previous known-good state. This ensures stability and minimizes disruption, as the rollback plan was already defined and approved as part of the change request. Continuing or forcing the patch could lead to system instability or security vulnerabilities.

The most important step in incident documentation is to capture the reason the patch was applied outside the approved maintenance window. This directly addresses the root cause of the unauthorized change, which is critical for post-incident review, process improvement, and preventing recurrence. Without the reason, the documentation fails to support a meaningful root cause analysis (RCA) and corrective action planning.

Adware is a type of malware that displays unwanted advertisements and often installs toolbars or other software without user consent. It can significantly degrade system performance. This question tests the ability to identify adware based on symptoms like pop-ups and unauthorized toolbars.

Find My Mac is the built-in Apple feature for locating, locking, and erasing lost devices. For MDM-enrolled devices, the school can also use their MDM solution, but Find My Mac is the direct user-facing tool.

The find command with -mtime -1 finds files modified less than 1 day ago, and -ls displays detailed information including full path and timestamp. This is efficient for forensic searches.

Kiosk mode locks the browser to a specific site or set of sites, hides the address bar, and disables settings access. This is ideal for public terminals. Other options like private browsing or parental controls do not provide the same level of restriction.

The correct tool is 'Battery usage' under Settings > System > Power & battery. This page provides a graph and detailed list of app and hardware power consumption, which can help identify the cause of rapid drain.

WPA3 is not supported on older operating systems like Windows 7, which only support up to WPA2. The correct solution is to either downgrade to WPA2 or update the wireless adapter drivers if possible. This question tests knowledge of backward compatibility between WPA2 and WPA3.

A swollen lithium-ion battery is a fire hazard and must be handled with care. Placing it in a fireproof container and contacting a hazardous waste facility ensures safe disposal. This question emphasizes the importance of proper battery disposal to prevent fires and environmental contamination.

The System applet's 'Advanced system settings' includes a 'Hardware' tab with 'Device Installation Settings'. However, driver signing enforcement is configured via 'Startup and Recovery' or by using the 'bcdedit' command. The correct answer is System > Advanced system settings > Hardware > Device Installation Settings, which lets you choose whether to automatically download drivers and allow unsigned drivers.

BitLocker Drive Encryption (C) is the correct choice because it provides full-disk encryption using AES encryption algorithms, ensuring that if the laptop is lost or stolen, the sensitive customer data remains inaccessible without the recovery key or TPM authentication. This directly addresses the requirement to protect data at rest on a lost device.

Loose or damaged cabling is a common cause of intermittent failures in physical access control systems. Checking the physical connection is a logical first step before moving to software or configuration issues.

The correct answer is B because the chmod command with u+x adds execute permission for the owner. Permissions 644 (rw-r--r--) do not include execute, so the owner cannot run the script until execute is granted.

Adware displays unwanted advertisements and often installs browser toolbars, slowing down the system. Unlike a virus or worm, adware does not self-replicate, and ransomware would demand payment rather than show ads.

The error 'Unable to Check for Update' on iOS often indicates a corrupted software update cache or a DNS resolution issue. The most effective step is to use a computer (Mac or PC) to force the update via Finder or iTunes, which bypasses the device's own update mechanism. Restarting the device or resetting network settings may not clear the underlying cache issue, and an iCloud restore would be too destructive.

Outdated antivirus often results from the update service being disabled or misconfigured. Checking the Windows Update or antivirus update service ensures that automatic updates can run, preventing future lapses.

Battery drain and overheating after app installation indicate a misbehaving app. The best first step is to check battery usage statistics to identify the culprit, then force stop or uninstall that app. This is a standard Android troubleshooting procedure.

Device Manager provides a centralized view of all hardware devices and their drivers, including driver status and version details. This makes it the go-to tool for driver-related troubleshooting. Other tools like Disk Management or System Configuration serve different purposes.

MAC address filtering restricts network access based on the unique hardware identifier of a device's network interface. This is a simple logical security control that can be applied at the network level to allow only known laptops. It is not as strong as certificate-based authentication but directly addresses the requirement.

Safe Mode with Networking allows the technician to boot with minimal drivers and services while still having network access to download updated antivirus definitions or removal tools. Safe Mode alone does not provide network access, which is often needed to get the latest malware signatures. This mode also prevents many malware variants from loading, making removal easier.

Rootkits load before the operating system and can hide from standard scans. Booting from a rescue disk (e.g., a bootable anti-malware USB) loads a clean OS environment, allowing the scanner to detect and remove the rootkit without interference.