CompTIA A+ Core 2 220-1202 (220-1202) — Questions 526–600

Using a VPN encrypts all traffic between the remote user and the internal network, including the unencrypted HTTP traffic from the legacy app. This provides a secure tunnel without requiring changes to the application itself. SSL/TLS termination could also work but requires a reverse proxy setup.

Resource quotas are administrative limits set per user or project, independent of actual cluster utilization. Even with plenty of free resources, a quota can block deployment. This tests understanding of cloud resource management and the difference between quotas and capacity.

The correct answer is `netsh interface ip set address "Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1`. This sets a static IP with the specified parameters. `ipconfig` is used for display, `netstat` for connections, and `ping` for testing.

A dynamic DNS (DDNS) service maps a domain name to a changing IP address, allowing users to connect using a consistent hostname. This is a standard solution for environments with dynamic public IPs. Port forwarding alone won't solve the IP change issue, and static IPs are not always available or cost-effective.

The gpupdate /force command forces an immediate refresh of all group policy settings, including drive maps, without requiring a reboot. It is the standard tool for applying policy changes on Windows. Other commands either manage user accounts or network configurations.

Option C is correct because the VPN concentrator must have a route to the file server's subnet to forward traffic from VPN clients. Without this route, packets destined for the file server are dropped, while other resources (like email) remain accessible if their subnets are reachable. This is a classic routing issue in remote access VPN deployments.

Even in emergency changes, documentation and retroactive approval are required. The technician must document the change and notify the CAB as soon as possible to obtain retroactive approval, ensuring compliance with change management policies.

Option C is correct because repeated Apple ID password prompts, even after correct entry, are typically caused by an iCloud Keychain sync conflict. When iCloud Keychain becomes out of sync—often after a password change or device restore—the authentication token chain breaks, forcing the device to re-request the password. Signing out of iCloud and back in resets the local Keychain state and re-establishes a trusted sync relationship with Apple's servers.

Modern browsers use sandboxing to isolate web applications from the operating system and other tabs. This security feature prevents malicious code from affecting the system, and it is often enabled by default but can be configured via browser settings or group policies.

The most important safety precaution when running cables through a drop ceiling is to use a non-contact voltage tester to check for live wires. Drop ceilings often conceal electrical wiring, and accidentally cutting or damaging a live wire can cause electrocution, fire, or equipment damage. A non-contact voltage tester allows the technician to detect the presence of AC voltage without making physical contact, ensuring the area is safe before handling cables.

The taskkill command can terminate processes by name or PID. The /F flag forces termination, which is necessary for stubborn malware. Other commands like tasklist list processes, shutdown reboots the system, and regedit edits the registry.

WPA2-Enterprise (or WPA3-Enterprise) with EAP-TLS provides certificate-based authentication, which can use smart cards. EAP-TLS is considered the most secure because it requires both client and server certificates. This tests knowledge of enterprise authentication methods and their security levels.

The immediate priority is containment to prevent the ransomware from spreading to other systems on the network. Isolating the workstation by disconnecting it from the network is the first step, followed by notifying the security team.

This question tests knowledge of Android enterprise features. The correct answer is 'Screen Pinning', which locks the device to a single app and requires a PIN or password to exit. This is a native Android security feature ideal for kiosk scenarios without third-party software.

Option B is correct because UPS batteries contain hazardous materials such as lead and sulfuric acid, which must be handled through specialized recycling processes to prevent environmental contamination. Local battery recycling centers are equipped to safely extract and reuse these materials, complying with regulations like the Resource Conservation and Recovery Act (RCRA) in the U.S.

WPA3-Enterprise with 192-bit encryption is the most secure option for environments requiring individual authentication and high traffic. It provides stronger encryption and protection against dictionary attacks compared to WPA2-Enterprise.

The 'Switch to mobile data' or 'Smart Network Switch' option in Android Wi-Fi settings automatically transitions to cellular when Wi-Fi is weak. Disabling this keeps the device connected to Wi-Fi, addressing the user's complaint. This is a common mobile OS feature for network management.

Disabling WPS prevents attackers from using brute-force attacks to guess the PIN and retrieve the passphrase. WPA2-PSK with a strong passphrase is secure, but WPS can bypass that security.

HIPAA requires that PHI be rendered unrecoverable. Many organizations use a certified third-party destruction service that provides a certificate of destruction. Physical shredding is a common compliant method.

SaaS provides ready-to-use software applications over the internet, such as Google Workspace or Microsoft 365, which include file storage and collaboration features. This eliminates the need for the business to manage underlying infrastructure. The scenario tests knowledge of cloud service models: SaaS, PaaS, and IaaS.

Since the backup was stored on a disconnected external drive, it is likely not encrypted by the ransomware. The best action is to disconnect the infected computer from the network to prevent further spread, then restore the files from the clean backup.

Full disk encryption (FDE) encrypts the entire drive, making data unreadable without the decryption key. It operates transparently after the user authenticates at boot, meeting the policy requirement. BitLocker is a common implementation for Windows systems.

Adware is designed to display unwanted advertisements and can modify browser settings, causing pop-ups and search engine hijacking. Unlike a virus or worm, adware does not typically replicate itself or require a host file to spread. The symptoms described—pop-ups outside the browser and unauthorized search engine changes—are classic signs of adware infection.

Option B is correct because toner cartridges contain plastic, metal, and residual toner powder, which are hazardous to the environment if landfilled. Certified e-waste recyclers or manufacturer take-back programs ensure proper disassembly, material recovery, and safe disposal of toxic components, complying with regulations like the EPA's Resource Conservation and Recovery Act (RCRA). This method minimizes environmental harm and supports circular economy principles.

Option C is correct because the 'Default apps' page under Apps in the Settings app is the specific location where you can change the default web browser from Microsoft Edge to Google Chrome. This setting controls which application handles protocols like HTTP and HTTPS, and it allows you to set Chrome as the default by selecting it from the list of installed browsers.

This tests the useradd command with the -m option to create a home directory, and passwd to set the password. useradd -m jdoe creates the user and home directory; then passwd jdoe sets the password. No single command does both; the scenario implies two steps.

BitLocker To Go is the correct built-in Windows tool for encrypting removable drives like USB flash drives. It provides full-disk encryption specifically designed for portable storage, ensuring that the confidential client data on the drive is protected if the drive is lost or stolen.

The bootrec /rebuildbcd command scans all drives for Windows installations and rebuilds the Boot Configuration Data store. This is the standard recovery command for missing or corrupt BCD. Other commands either fix the master boot record or system files, not the BCD specifically.

Pretexting is the creation of a fabricated scenario (the pretext) to obtain information or access. The attacker used the employee's details to build credibility and trick the help desk. This highlights the importance of identity verification procedures.

This is tailgating (or piggybacking), where an unauthorized person follows an authorized individual into a restricted area without proper authentication. The attacker is exploiting the employee's politeness or lack of awareness.

This tests knowledge of conditional logic in scripting. An 'if' statement allows the script to check a condition (e.g., existence of a registry key or file) and execute code only if the condition is true or false. Loops are for repetition, and variables store data, not control flow.

Option B is correct because the update was installed without authorization (not in the approved change log), violating change management policy. The technician should immediately roll back the update to restore application functionality and then document the incident to ensure proper change control procedures are followed. This aligns with the CompTIA A+ change management process: identify the unauthorized change, reverse it, and report it.

The correct answer is D because find /usr/bin -user root -perm /6000 finds files owned by root with either SUID (4000) or SGID (2000) bit set. The -perm /6000 uses the 'any' match syntax (GNU find) to match files with either bit.

If a PowerShell command does not produce output, piping it to Out-File will result in an empty file. The issue is that the command used does not generate any output.

The Indexing Options control panel (accessible via Control Panel or by searching 'indexing options') provides a direct interface to manage the Windows Search index, including the ability to rebuild it. Rebuilding the index is the appropriate fix when the index is corrupted or not functioning, as it forces Windows to re-scan all indexed locations and create a fresh index database, resolving issues where local file searches fail but web searches (which do not rely on the local index) still work.

WPA2-Enterprise requires a RADIUS authentication server, which is not present in a typical home network. WPA2-PSK uses a pre-shared key, which is standard for home use. This question tests the understanding of the difference between Personal and Enterprise modes.

Option A is correct because it directly addresses the root cause (full mailbox) with a clear, actionable solution (delete emails and empty trash) while maintaining a neutral, professional tone. The technician avoids blaming the user or escalating the situation, which is critical when dealing with a confrontational user. This response focuses on resolving the issue without unnecessary commentary, aligning with CompTIA's emphasis on professionalism and effective communication.

A DDoS attack floods the service with traffic, making it unavailable to legitimate users, directly impacting availability. Cloud services rely on high availability, but an attack can overwhelm resources. This tests understanding of the five essential characteristics of cloud computing (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service) and the CIA triad.

WPA3 is the latest wireless security protocol, but it is not backward-compatible with older operating systems like Windows 7, which only support WPA2. The technician should configure the router to use WPA2/WPA3 mixed mode or WPA2 only to ensure compatibility with all devices.

First, you must stop the Windows Update service using net stop wuauserv. Then, delete the contents of the SoftwareDistribution folder (e.g., del /f /s /q C:\Windows\SoftwareDistribution\*). Other commands like sfc repair system files, dism repair the image, and taskkill terminate processes but are not the correct sequence.

The best approach for ransomware recovery is to restore files from a known clean backup after removing the malware. Decryption tools are not always available, and paying the ransom is discouraged. Reinstalling the OS is needed only if the system is compromised, but data recovery is the priority.

The boot order in the VM's BIOS might be set to boot from a different device (e.g., network or CD-ROM) before the hard disk. Changing the boot order to prioritize the virtual hard disk is the most direct fix. This tests knowledge of VM boot configuration and BIOS settings.

The Local Group Policy Editor (gpedit.msc) can enforce user restrictions. The specific policy 'Prevent changing desktop background' under User Configuration > Administrative Templates > Control Panel > Personalization would cause this symptom. The other options are either not specific to personalization or affect different settings.

The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) store is corrupted or missing. The `bootrec /rebuildbcd` command scans all disks for Windows installations and rebuilds the BCD store from scratch, directly addressing the missing or corrupted boot configuration. This is the correct tool in the Windows Recovery Environment for repairing BCD issues.

The bootrec tool is specifically designed to repair boot-related issues like a missing or corrupted Boot Manager. The /fixboot and /rebuildbcd options can resolve the 'Bootmgr is missing' error. Other tools like diskpart manage disks, sfc repairs system files, and chkdsk checks disk integrity.

WPA3 is the latest Wi-Fi security standard, offering stronger encryption (GCMP-256) and improved authentication (SAE). It is backward compatible with WPA2 devices, making it suitable for mixed environments. This question tests knowledge of current wireless security standards and their compatibility.

Option C is correct because a post-implementation review (PIR) is the step where the change is verified to have met its objectives without causing adverse effects. Since the email service became intermittent after the change was marked 'completed', the lack of a PIR means the change was not validated in production, allowing the underlying issue to go undetected. In the CompTIA change management process, the PIR ensures that the change has been fully tested and that any residual problems are identified and addressed before the change is closed.

The correct step is to use the 'Reset Network Settings' option in iOS, which clears saved Wi-Fi networks, VPN configurations, and other network-related settings without affecting personal data like photos or contacts. This often resolves stubborn Wi-Fi connection issues. A full factory reset or iCloud restore would be excessive and data-destructive.

This is a classic social engineering attempt using urgency and authority to pressure the victim into divulging credentials. The correct response is to verify the caller's identity through official channels before providing any sensitive information.

Data destruction methods vary by need. For this scenario, the drive must stay functional, so physical destruction or degaussing is not appropriate. A secure wipe using a tool that overwrites all sectors is the correct approach because it renders data unrecoverable while preserving the drive's usability.

Split tunneling allows the VPN client to route only specific traffic (e.g., corporate subnets) through the encrypted tunnel, while all other traffic goes directly to the internet. If the file server's IP range is not included in the allowed routes, traffic to that server will bypass the VPN and be sent unencrypted to the user's local gateway, which cannot reach the internal server. This matches the symptom: internet works, but the file server is unreachable.

Disk Cleanup is the built-in tool designed to safely delete temporary files, system cache, and old Windows installations. It offers a simple interface to select categories of files to remove. Other tools like Storage Spaces or Defragment are for different disk management tasks.

The VPN logs show an authentication error, which indicates the failure occurs during the credential validation phase, not during network connectivity. Since the user can ping the VPN server's public IP, Layer 3 connectivity is intact, and the issue is likely with the user's account status. Checking if the account is locked out or the password has expired directly addresses the authentication failure.

Biometric locks use unique physical characteristics like fingerprints, eliminating the need for keys or cards that can be lost or stolen. This question tests knowledge of access control methods that combine security with convenience.

Cable locks are simple, effective physical security controls that deter theft by anchoring portable devices to a fixed object. This scenario tests the understanding of basic physical security measures for endpoint devices.

Disabling split tunneling ensures that all network traffic, including internet-bound traffic, is routed through the VPN tunnel. This forces the VPN connection to be always used when accessing the internet, which is essential for enforcing security policies and ensuring that company resources are protected even when the remote employee accesses external websites.

Phishing attacks use deceptive emails to trick users into revealing sensitive information. The suspicious link and errors indicate a phishing attempt, not a legitimate bank communication.

Apple Configurator allows IT administrators to install enterprise or custom in-house apps directly onto supervised iOS devices without requiring the App Store. Since the app is not available on the App Store and the iPads are company-owned, Apple Configurator provides a supported, secure method for direct installation using a Mac.

The ipconfig /flushdns command clears the DNS resolver cache, which can resolve issues caused by stale or corrupted entries. Other commands like nslookup query DNS servers, netstat show connections, and ping test connectivity but do not clear the cache.

Option C is correct because it follows the CompTIA A+ troubleshooting methodology by first gathering information and showing empathy. The technician needs to confirm the timeline of the slowness relative to the antivirus installation, as other factors (e.g., a Windows update, disk I/O bottleneck, or malware) could be the root cause. Jumping to conclusions without verifying the symptom onset violates the 'identify the problem' step and risks misdiagnosis.

Disconnecting the computer from the network is the first step because it immediately stops the malware from communicating with its command-and-control (C2) server, preventing further data exfiltration, additional payload downloads, or remote control. This containment step is critical before any remediation (like scanning or rebooting) to avoid the malware spreading or causing more damage.

Degaussing destroys the magnetic field on the platters, making data unrecoverable. Physical destruction is also secure, but degaussing is the most efficient for bulk drives. Simply reformatting or overwriting may leave recoverable data.

A mantrap uses two interlocking doors to ensure only one person can enter at a time, effectively preventing tailgating. This tests understanding of specialized access controls designed to enforce one-person-per-authentication.

Option B is correct because standard antivirus software often misses potentially unwanted programs (PUPs) and adware that inject pop-ups into the system. A dedicated anti-malware tool like Malwarebytes uses heuristic analysis and signature databases specifically tuned to detect and remove adware, browser hijackers, and other low-level threats that traditional AV engines may overlook.

The 'Bootmgr is missing' error indicates that the Boot Configuration Data (BCD) is corrupted or missing. Booting from the Windows installation USB and using the bootrec command-line tool can rebuild the BCD and fix the boot manager.

The 'Preparing Automatic Repair' loop and slow boot often indicate corruption in critical boot files, such as the Boot Configuration Data (BCD) or system files. Running System File Checker (SFC) from an elevated Command Prompt scans and repairs protected system files, addressing the root cause without data loss. This is the first-line diagnostic tool for boot integrity issues before escalating to more destructive methods.

A keylogger records keystrokes and can capture screenshots, sending data to an attacker. This is a form of spyware, not a worm, rootkit, or ransomware, which have different behaviors.

The 'exit' command without parameters terminates the entire command interpreter (cmd.exe), which kills the parent batch file as well. Using 'exit /b' instead exits only the current batch script or subroutine, returning control to the calling script. This preserves the intended flow when sub-scripts are invoked via 'call'.

The correct answer is `msiexec /i update.msi /quiet /norestart`. This installs the MSI silently without prompting the user. `/passive` shows a progress bar, `/qb` shows a basic UI, and `/l*` creates a log file but does not suppress UI.