CompTIA A+ Core 2 220-1202 (220-1202) — Questions 526–600

Why this answer

How to eliminate wrong answers

Option A is wrong because Services.msc allows you to start, stop, or restart the Windows Search service, but it does not provide a direct option to rebuild the search index; rebuilding requires the Indexing Options interface. Option C is wrong because Task Manager is used to manage running processes, monitor performance, and start/stop applications, but it has no capability to manage or rebuild the search index. Option D is wrong because Windows Settings > Privacy & security > Searching Windows controls privacy-related search settings (e.g., whether to include cloud content or history), but it does not include a rebuild option for the local search index; the rebuild function is exclusively in the legacy Indexing Options control panel.

Why this answer

How to eliminate wrong answers

Option A is wrong because an outdated firmware would not cause a sudden failure immediately after changing the security mode; the issue is directly tied to the authentication method change, not firmware version. Option B is wrong because WPA2-Enterprise can use the same encryption ciphers (AES/CCMP) as WPA2-PSK; device support for the cipher is not the problem—the problem is the missing authentication server. Option D is wrong because the SSID was not changed according to the question; the customer only changed the security mode, and an SSID change would cause devices to not see the network, not fail authentication.

Why this answer

How to eliminate wrong answers

Option B is wrong because it includes a judgmental phrase ('people don't manage their inbox') that can be perceived as condescending, which may provoke a confrontational user and violates professional communication standards. Option C is wrong because increasing the mailbox quota without addressing the underlying storage issue is a temporary workaround that could lead to future problems (e.g., exceeding server limits or violating organizational email retention policies), and it fails to educate the user on proper mailbox management. Option D is wrong because it dismisses the user's concern by stating 'your email isn't broken,' which invalidates their experience and can escalate tension; the technician should acknowledge the issue while explaining the cause professionally.

Why this answer

How to eliminate wrong answers

Option A is wrong because on-demand self-service refers to a user's ability to provision computing resources automatically without human interaction, which is not directly affected by a DDoS attack. Option B is wrong because broad network access describes the ability to access cloud services over standard network protocols (e.g., HTTP/HTTPS) from various devices, and while the attack uses the network, it does not directly impact this characteristic. Option D is wrong because resource pooling involves the provider's ability to serve multiple customers from shared physical resources using multi-tenancy, which is a cost-efficiency model, not a measure of service accessibility.

Why this answer

How to eliminate wrong answers

Option B is wrong because MAC address filtering is a separate feature from security protocol support; if the router's firewall were blocking MAC addresses, the laptops would not even see the network or would be explicitly denied, but the issue is specifically about authentication after the upgrade to WPA3. Option C is wrong because TKIP is an encryption cipher used with WPA and WPA2, not WPA3; WPA3 uses AES-CCMP or GCMP-256, and while older laptops might use TKIP with WPA2, the core incompatibility here is the protocol version itself, not the cipher. Option D is wrong because a hidden SSID does not prevent a client from connecting if the SSID is manually entered; the problem is the authentication handshake failure due to WPA3 incompatibility, not network discovery.

Why this answer

How to eliminate wrong answers

Option B is wrong because 'sfc /scannow' scans and repairs protected system files, but it does not stop the Windows Update service or delete temporary update files; it addresses file corruption, not update stuck states. Option C is wrong because 'dism /online /cleanup-image /restorehealth' repairs the Windows system image and component store corruption, but it does not stop the update service or remove the temporary update files that cause repeated failed attempts. Option D is wrong because 'taskkill /IM svchost.exe /F' forcefully terminates all svchost.exe processes, which would crash critical system services including the Windows Update service, but it is a brute-force method that can destabilize the system and does not safely stop the service or clean up the temporary files.

Why this answer

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee the decryption key will be provided; attackers often take the money and disappear, and paying funds further criminal activity. Option B is wrong because ransomware decryption tools from reputable sources are only effective for specific, known ransomware variants; the infection could use a unique or custom encryption algorithm, making such tools useless. Option D is wrong because reinstalling the operating system only wipes the system drive; it does not decrypt or recover the encrypted personal files, which remain encrypted on the storage media.

Why this answer

How to eliminate wrong answers

Option A is wrong because reattaching the virtual hard disk to the SCSI controller is unnecessary; the IDE controller is fully capable of booting a VM, and the error is not caused by the controller type. Option C is wrong because increasing memory allocation addresses performance or out-of-memory issues, not boot failures related to missing operating system detection. Option D is wrong because restoring from a snapshot should be a last resort after simpler checks like boot order, as snapshots can cause data loss and the issue may be a simple configuration change.

Why this answer

How to eliminate wrong answers

Option A is wrong because the shutdown/restart/sleep/hibernate removal policy only affects power options in the Start menu and does not touch personalization settings. Option B is wrong because prohibiting access to Control Panel and PC settings would block the entire Settings app, not just gray out background options—the user would not be able to open Personalization at all. Option D is wrong because turning off Windows Spotlight features affects lock screen and wallpaper suggestions from Microsoft, not the ability to manually change the desktop background.

Why this answer

How to eliminate wrong answers

Option A is wrong because System File Checker (sfc /scannow) repairs corrupted system files, not the boot configuration data (BCD) store; it operates on protected system files like DLLs and executables, not boot manager metadata. Option C is wrong because DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows image (component store) for servicing issues, such as corruption in the system files used by Windows Update, and does not interact with the BCD store or boot sector. Option D is wrong because Diskpart is a disk partitioning tool used to manage volumes and partitions (e.g., create, delete, format), not to repair boot configuration data; running a script with `diskpart /s script.txt` would execute partition commands, not fix the BCD.

Why this answer

How to eliminate wrong answers

Option A is wrong because diskpart is a disk partitioning tool used to manage volumes and partitions, not to repair boot configuration files. Option C is wrong because sfc /scannow scans and repairs protected system files, but it cannot fix boot manager or BCD issues when the system cannot boot. Option D is wrong because chkdsk /f checks and repairs file system integrity on a volume, but it does not address boot configuration corruption.

Why this answer

How to eliminate wrong answers

Option A is wrong because Screen Sharing enables remote desktop access (VNC protocol), not file sharing, and would not allow the folder to appear as a network drive on Windows. Option C is wrong because Internet Sharing allows the Mac to share its internet connection with other devices (e.g., via NAT or bridging), not to share files as a network drive. Option D is wrong because Remote Login enables SSH access for command-line connections, not SMB-based file sharing, and Windows cannot natively mount a folder via SSH as a network drive.

Why this answer

How to eliminate wrong answers

Option A is wrong because the change was logged in the change management log as 'completed', which implies a change request was submitted and processed; the issue is not the absence of a request but the lack of validation after implementation. Option B is wrong because CAB approval is typically required for high-risk or significant changes, but the email server change was already approved and implemented; the skipped step is the verification of success, not the approval itself. Option D is wrong because while a rollback plan is important for reverting a failed change, the problem here is that the change was not fully tested and its impact was not assessed post-implementation; a documented rollback plan would not have prevented the intermittent service if the root cause was not identified during testing.

Why this answer

How to eliminate wrong answers

Option A is wrong because providing the password immediately without verification would violate security policies and could lead to a data breach by enabling an attacker. Option C is wrong because IT security teams may legitimately call about updates, especially during a breach, so ignoring the call could delay a critical response. Option D is wrong because changing the password and giving the new one still discloses credentials to an unverified caller, which does not mitigate the social engineering risk.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a quick format only clears the file system metadata (e.g., MFT or FAT) and does not overwrite the actual data sectors, leaving all client data recoverable with simple file recovery tools. Option B is wrong because a degausser uses a strong magnetic field to demagnetize the platters, which destroys the drive's ability to store data permanently, making the laptop non-functional for the next lessee. Option D is wrong because physically shredding the hard drive destroys the hardware entirely, which violates the requirement that the laptop remain functional for the next lessee.

Why this answer

How to eliminate wrong answers

Option A is wrong because port 443 is typically used for HTTPS or SSL/TLS-based VPNs (e.g., OpenVPN, SSTP), and if the home router were blocking it, the VPN client would fail to establish any connection at all, not just fail to reach the file server. Option C is wrong because a powered-off or failed file server would affect all users, not just a remote VPN user, and the user can access the internet, indicating the VPN tunnel itself is up. Option D is wrong because outdated VPN client software would typically cause connection failures or authentication errors, not a selective inability to reach a specific internal resource while internet access works.

Why this answer

How to eliminate wrong answers

Option A is wrong because Disk Management is used for partitioning, formatting, and managing drive letters, not for cleaning temporary files or system caches. Option B is wrong because Defragment and Optimize Drives (dfrgui.exe) reorganizes file fragments on a drive to improve performance but does not remove any files or free up space. Option D is wrong because Storage Spaces is a storage virtualization feature that pools physical drives into logical storage pools, and it does not provide a cleanup interface for temporary files or previous Windows installations.

Why this answer

How to eliminate wrong answers

Option A is wrong because UDP ports 500 and 4500 are used for IPsec IKE traffic, and the user can already ping the VPN server, so firewall rules are not the immediate cause of an authentication error. Option C is wrong because reinstalling the VPN client software would not resolve an authentication error that occurs after credentials are entered; the client is functioning enough to reach the server. Option D is wrong because changing the encryption protocol would not fix an authentication error; it would only alter how data is secured after authentication succeeds.

Why this answer

How to eliminate wrong answers

Option A is wrong because a biometric fingerprint reader authenticates the user at login, but does not prevent the laptop from being physically taken from the desk; it only controls logical access after power-on. Option B is wrong because requiring a smart card to log in controls authentication, not physical theft; the laptop can still be stolen regardless of login requirements. Option D is wrong because full-disk encryption protects data confidentiality if the laptop is stolen, but does not prevent the theft itself; it is a data protection control, not a physical security control.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling split tunneling would allow internet-bound traffic to bypass the VPN, directly contradicting the requirement to always use the VPN for internet access. Option C is wrong because PPTP is an outdated and insecure protocol; the question asks about a security setting to force traffic through the VPN, not about the protocol choice. Option D is wrong because setting the VPN to connect only when accessing internal websites would not force all internet traffic through the VPN; it would only trigger the VPN for internal resource requests, leaving other internet traffic unprotected.

Why this answer

How to eliminate wrong answers

Option A is wrong because spear phishing is a highly targeted attack that uses personalized information (e.g., the recipient's name, job title, or specific account details) to increase credibility, whereas this email lacks any such personalization and contains generic errors. Option C is wrong because whaling is a specific form of spear phishing that targets high-profile executives or individuals with authority, not a general user receiving a mass email. Option D is wrong because vishing (voice phishing) is conducted over voice calls or VoIP, not via email with a clickable link.

Why this answer

How to eliminate wrong answers

Option B is wrong because downloading an app from a third-party website and opening it in Safari is not a supported installation method on iOS; iOS does not allow direct installation from arbitrary websites without enterprise distribution certificates or jailbreaking. Option C is wrong because emailing an app file (.ipa) to users does not work on iOS; the operating system blocks installation of apps from email attachments due to security restrictions. Option D is wrong because iOS does not have a general 'sideloading' toggle in Settings; sideloading via iTunes is limited to free Apple Developer accounts with a 7-day expiry and requires the app to be signed, making it impractical for permanent deployment to five company-owned iPads.

Why this answer

How to eliminate wrong answers

Option A is wrong because `nslookup example.com` queries an external DNS server directly, bypassing the local cache, and does not clear the cache. Option C is wrong because `netstat -r` displays the IP routing table, not DNS cache information. Option D is wrong because `ping -a 192.168.1.1` performs a reverse DNS lookup to resolve an IP address to a hostname, but it does not clear the DNS cache.

Why this answer

How to eliminate wrong answers

Option A is wrong because uninstalling the antivirus immediately removes security protection without confirming it is the cause, and the slowness could stem from a different issue like a pending update or driver conflict. Option B is wrong because it dismisses the user's frustration and is factually incorrect—modern antivirus programs can be tuned (e.g., excluding scheduled scans during peak usage, adjusting real-time protection settings) to minimize performance impact. Option D is wrong because remotely accessing the computer without first explaining the action and obtaining consent violates professional conduct and the user's privacy; the technician should first ask questions to narrow down the problem before taking invasive steps.

Why this answer

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan while the computer is still connected to the network allows active malware to continue communicating with its C2 server, potentially downloading more malicious code or exfiltrating data during the scan. Option C is wrong because rebooting into Safe Mode does not immediately stop network-based threats; the malware may still have network access in Safe Mode with networking, and the reboot itself could trigger destructive payloads. Option D is wrong because restoring from a recent backup should only be performed after confirming the backup is clean and the current infection is contained; doing it first risks reinfecting the system from the backup or missing active malware still on the network.

Why this answer

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan, even while logged off, does not immediately terminate the remote session; the RAT may still be active and the scan may not detect it, especially if it's a zero-day or polymorphic. Option C is wrong because changing the password and logging off does not necessarily kill the remote session; the attacker may have established persistence and could reconnect using other credentials or backdoors. Option D is wrong because restoring to a previous restore point is a recovery step, not an immediate containment action, and it may not remove the RAT if the restore point is after infection; also, it does not stop the current unauthorized access.

Why this answer

How to eliminate wrong answers

Option A is wrong because a quick format only clears the file system metadata (e.g., the partition table and directory structure) and does not overwrite the actual data on the drives, leaving the data recoverable with data recovery software. Option B is wrong because overwriting with zeros using a low-level format is a logical overwrite that may not reach all sectors on modern drives with internal remapping (e.g., G-List sectors), and it is less effective than degaussing for ensuring unrecoverability, especially against advanced recovery techniques. Option D is wrong because physically destroying drives with a hammer is not the most secure method—it can leave platter fragments from which data might be recovered using specialized equipment, and it is less reliable than degaussing for complete magnetic erasure.

Why this answer

How to eliminate wrong answers

Option A is wrong because security cameras are detective controls that record activity but do not physically prevent someone from following another person through a door. Option B is wrong because a biometric reader is an authentication control that verifies identity but does not stop a second person from entering behind an authenticated user. Option D is wrong because a badge reader is also an authentication control and is vulnerable to tailgating when someone slips in behind a badge-holder.

Why this answer

How to eliminate wrong answers

Option A is wrong because reinstalling the operating system is an extreme, time-consuming step that should only be taken after all other remediation methods have failed, and it does not address the root cause of the infection. Option C is wrong because disabling Windows Defender permanently would remove a critical layer of real-time protection, leaving the system vulnerable to further infections and violating best practices for security. Option D is wrong because clearing browser cache and cookies only removes temporary web data and cannot eliminate adware or malware that is running as a background process or service on the system.

Why this answer

How to eliminate wrong answers

Option B is wrong because Startup Repair is a more automated tool that attempts to fix common boot issues, but it may not specifically rebuild the BCD or repair the MBR in all cases, and it often fails when the BCD is severely corrupted or missing. Option C is wrong because 'sfc /scannow' (System File Checker) scans and repairs protected system files, but it does not repair the boot manager, MBR, or BCD store, which are the root cause of the 'Bootmgr is missing' error. Option D is wrong because System Restore reverts system files, settings, and registry to a previous restore point, but it does not repair the boot manager or BCD; if the boot configuration is corrupted, System Restore may not even run successfully without a functional boot loader.

Why this answer

How to eliminate wrong answers

Option B is wrong because performing a full system restore from a backup is a reactive, data-loss-prone step that should only be used after less invasive repairs fail; it does not diagnose the specific boot file corruption. Option C is wrong because Disk Cleanup only removes temporary files and does not repair system files or boot configuration, making it irrelevant to boot loops. Option D is wrong because reinstalling Windows via 'Reset this PC' is a last-resort destructive recovery that wipes applications and settings, and is not the first tool to use for boot file corruption.

Why this answer

How to eliminate wrong answers

Option A is wrong because a rootkit is designed to hide its presence and other malware from the operating system by modifying kernel-level functions, not to capture keystrokes or screenshots. Option B is wrong because a worm is a self-replicating malware that spreads across networks without user interaction, focusing on propagation rather than data theft via keystroke logging. Option D is wrong because ransomware encrypts files or locks the system to demand a ransom, and it does not typically exfiltrate keystrokes or screenshots to a remote server.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'goto :eof' is used to jump to the end of the current batch file, but it does not exit a subroutine that was called; it simply transfers control, which may not stop execution of the sub-script if there are more commands after the label. Option C is wrong because removing the 'exit' command entirely would leave the sub-script to continue executing any subsequent commands, potentially causing unintended behavior or an infinite loop. Option D is wrong because 'endlocal' only ends local variable scope set by 'setlocal'; it does not affect the termination behavior of the 'exit' command and does not prevent the parent batch from being terminated.

Why this answer

How to eliminate wrong answers

Option A is wrong because a corrupt MDM profile would typically cause deployment failures (e.g., app not installing or configuration not applying), not a crash upon launch of an already-installed app. Option C is wrong because insufficient storage space would prevent installation or cause a different error (e.g., 'insufficient storage' message), not an immediate crash after the app is already installed and launched. Option D is wrong because an incorrect enterprise certificate would prevent the app from installing at all (due to signature verification failure), not cause a crash after successful installation and launch.

Why this answer

How to eliminate wrong answers

Option A is wrong because System Information provides a static hardware and software inventory (e.g., RAM type, serial numbers) but does not show real-time memory usage or process-level memory consumption, so it cannot diagnose the cause of a memory pressure event. Option B is wrong because while 'vm_stat' in Terminal shows virtual memory statistics (e.g., page-ins, page-outs), it does not provide a user-friendly, process-level view of memory usage or the 'Memory Pressure' graph, making it less practical for quickly identifying the offending application. Option D is wrong because Console displays system logs and diagnostic messages, which can show kernel panics or app crashes, but it does not offer a live, graphical overview of memory usage or process memory footprints, so it is not the primary tool for investigating memory pressure.

Why this answer

How to eliminate wrong answers

Option A is wrong because a 'for' loop with a counter is unnecessary; it would require manual index tracking and does not inherently skip empty rows without an additional conditional check, making it less efficient and more error-prone than a direct property test. Option B is wrong because a 'switch' statement is designed to match a single value against multiple patterns, not to test whether a property is empty or not; it would be overcomplicated and not the idiomatic choice for a simple null/empty check. Option D is wrong because a 'try/catch' block is used for exception handling during runtime errors (e.g., account creation failure), not for skipping rows based on data validation before processing.

Why this answer

How to eliminate wrong answers

Option A is wrong because System > About displays basic device specifications (e.g., processor, RAM, Windows edition) and does not manage startup programs. Option B is wrong because Devices > Bluetooth & other devices is used to pair and manage Bluetooth peripherals, not to control startup applications. Option C is wrong because Update & Security > Troubleshoot runs automated diagnostic tools for system issues like internet connectivity or audio, but it cannot disable startup programs.

Why this answer

How to eliminate wrong answers

Option A is wrong because power supply compatibility with the motherboard is determined by the form factor (e.g., ATX) and connector types, not by the ability to power on; an incompatible power supply would still typically power on but might not fit or provide correct voltages. Option B is wrong because if the power cord were not securely plugged in, the computer would not power on, but this is a physical connection issue, not a safety-related oversight—the question specifically asks for a safety-related oversight. Option D is wrong because a blocked fan would cause overheating after the system is powered on, not prevent the computer from powering on entirely; the power supply would still start and spin the fan briefly before thermal protection might kick in.

Why this answer

How to eliminate wrong answers

Option A is wrong because while the router may not support modern protocols, that is a limitation of the hardware, not an immediate security risk—the immediate risk is that WEP itself is broken. Option C is wrong because outdated firmware is a potential vulnerability, but it is not as immediate or certain as the guaranteed cryptographic weakness of WEP, which can be exploited without any firmware bugs. Option D is wrong because WEP does not need to support WPA2-PSK; clients can connect using WEP, and the issue is that WEP is insecure, not that it lacks compatibility with a different protocol.

Why this answer

How to eliminate wrong answers

Option A is wrong because booting from a Windows installation USB and selecting 'Repair your computer' is a valid way to access WinRE, but it requires external media and is not the most direct method from a running system; the question specifies 'from a running system,' making this an unnecessary extra step. Option B is wrong because pressing F8 during boot to access advanced boot options was deprecated in Windows 8 and later; modern Windows systems use a fast startup process that makes F8 unreliable, and it does not reliably lead to WinRE. Option D is wrong because opening the System Configuration tool (msconfig) and setting the boot to 'Safe Mode' under the Boot tab only configures the system to boot into Safe Mode on the next restart, not into WinRE, and it does not provide access to the advanced startup options needed to disable automatic restart on system failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because calling the toll-free number would connect the user to a malicious actor who would attempt to gain remote access or extract payment, directly falling for the social engineering attack. Option B is wrong because ignoring the pop-up and continuing working leaves the system vulnerable; the pop-up may be a symptom of an active infection or a drive-by download, and ignoring it does not address the underlying threat. Option D is wrong because rebooting the computer immediately may allow persistent malware (e.g., a rootkit or scheduled task) to reinitiate the scam pop-up upon startup, and it does not remove the malicious software.

Why this answer

How to eliminate wrong answers

Option A is wrong because Programs and Features is used to uninstall, change, or repair installed programs, not to prevent applications from changing file associations or default programs. Option B is wrong because Default Programs in Control Panel allows users to manually set file associations and default programs, but it does not prevent other applications from changing them afterward. Option D is wrong because Registry Editor (regedit) can be used to manually modify association keys (e.g., HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations), but it does not provide a built-in mechanism to lock or prevent changes by other applications.

Why this answer

How to eliminate wrong answers

Option A (Vishing) is wrong because vishing involves voice calls or voicemail messages that trick victims into revealing information, not text messages with links. Option C (Pharming) is wrong because pharming redirects users from legitimate websites to fraudulent ones via DNS poisoning or local host file manipulation, without requiring the user to click a link in a message. Option D (Pretexting) is wrong because pretexting relies on fabricating a scenario (pretext) to obtain information, typically through direct conversation or impersonation, not via a link in a text message.

Why this answer

How to eliminate wrong answers

Option A is wrong because TKIP is an older, less secure encryption protocol that is also vulnerable to KRACK attacks and is deprecated in favor of AES. Option B is wrong because WPA2-Enterprise with 802.1X still uses the same WPA2 4-way handshake, which is susceptible to KRACK attacks; it changes authentication but not the underlying handshake vulnerability. Option D is wrong because MAC address filtering is a basic access control mechanism that does not encrypt traffic and provides no protection against KRACK or any encryption-based attack.

Why this answer

How to eliminate wrong answers

Option A is wrong as a first step because other laptops of the same model connect successfully, which rules out a model-wide driver incompatibility — updating the driver is a valid later step but not the first check. Option B is wrong because changing the router to WPA3 would affect all users and could break compatibility with older devices; it also does not address a single-laptop failure. Option D is wrong because the Windows firewall does not block Wi-Fi association — it filters traffic after the connection is established, so disabling it would not fix a 'can't connect' error.

Why this answer

How to eliminate wrong answers

Option A is wrong because clearing the browser cache and cookies removes local data like session tokens or stored form entries, but does not address credentials that were already sent to an attacker via the extension. Option B is wrong because running a full antivirus scan targets malware on the system, but the malicious extension has already been removed; the core issue is the theft of credentials, not persistent malware. Option C is wrong because resetting browser settings to default removes configurations and extensions, which is redundant after removal, but does not change passwords that were already compromised.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because EFS encrypts individual files or folders, not the entire hard drive, and does not require a pre-boot PIN; it operates at the file system level after the OS loads. Option B is wrong because a BIOS password only prevents unauthorized users from changing BIOS settings or booting the system, but it does not encrypt the hard drive, leaving data accessible if the drive is removed. Option D is wrong because third-party antivirus with encryption typically offers file-level or folder-level encryption, not full-disk encryption with pre-boot authentication, and antivirus software focuses on malware detection, not drive encryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because replacing the entire printer with a new Energy Star model is unnecessarily wasteful; the printer itself is likely still functional, and only the fuser unit needs replacement. Option C is wrong because continuing to use the printer until it fails completely poses a fire hazard from the overheating fuser and may cause further damage to other components, increasing waste and repair costs. Option D is wrong because disposing of all parts in general trash violates e-waste regulations and environmental guidelines, as printer components contain hazardous materials like lead and mercury that require proper recycling.

Why this answer

How to eliminate wrong answers

Option A is wrong because Performance Monitor is a tool for logging and analyzing performance counters over time, not for viewing real-time per-process CPU and memory usage in a simple list. Option B is wrong because Resource Monitor offers more detailed per-process resource data (including disk and network), but it is not the primary tool for a quick, immediate identification of top resource consumers; Task Manager is the first-line tool for this task. Option D is wrong because System Configuration (msconfig) is used to manage startup programs, boot options, and services, not to monitor current CPU or memory consumption of running processes.

Why this answer

How to eliminate wrong answers

Option A is wrong because degaussers use a strong magnetic field to erase data on magnetic media (HDDs), but SSDs store data electrically in NAND flash cells and are not affected by magnetic fields; degaussing will not destroy the data and may leave the SSD physically intact. Option B is wrong because a secure erase command requires the SSD to be powered on and functional to execute the ATA Secure Erase command via the SATA interface; a non-functional SSD cannot communicate or execute any command. Option D is wrong because overwriting with a data wiping tool requires the SSD to be connected to another computer and powered on to write new data over the existing data; a dead SSD cannot be recognized or written to.

Why this answer

How to eliminate wrong answers

Option B is wrong because disabling UAC globally would remove the elevation prompt, but the application would still run with the user's limited privileges, not administrative rights, and it weakens system security. Option C is wrong because adding a standard user to the local Administrators group grants permanent administrative rights to the entire user account, which is excessive and violates the principle of least privilege; it is not a targeted solution for a single application. Option D is wrong because 'Run as different user' allows running an application under a different user account, but it does not automatically grant administrative privileges; the specified user must already have the necessary rights, and it requires manual intervention each time.

Why this answer

How to eliminate wrong answers

Option A is wrong because standing silently for an indefinite period wastes technician time and does not proactively manage the support queue; it fails to balance efficiency with customer service. Option C is wrong because interrupting the user's call is unprofessional and could escalate frustration, violating the principle of respecting the user's current engagement. Option D is wrong because closing the ticket as 'user not available' without attempting to reschedule abandons the support request prematurely, which is poor practice and could lead to unresolved issues and negative user experience.

Why this answer

How to eliminate wrong answers

Option A is wrong because remotely reinstalling the driver is a corrective action that should only be taken after confirming the driver is actually the cause; doing it first skips the diagnostic step and may waste time or disrupt the user. Option C is wrong because asking the user to bring the laptop in is premature and inconvenient when basic information gathering can be done remotely first. Option D is wrong because escalating to the network team immediately bypasses standard troubleshooting and may be unnecessary if the issue is local to the laptop.

Why this answer

How to eliminate wrong answers

Option A is wrong because degaussers use a strong magnetic field to erase data on magnetic media (e.g., hard drives, tapes), but optical discs like CDs and DVDs store data as physical pits and lands on a reflective layer, not magnetically, so a degausser has no effect on them. Option B is wrong because scratching the surface with a key only damages a small portion of the disc; data can still be read from unscratched areas using specialized software, leaving patient information recoverable. Option D is wrong because microwaving discs for 10 seconds may cause physical damage but is unreliable and dangerous—it can create toxic fumes, fire hazards, and may not fully destroy all data layers, especially on dual-layer DVDs, leaving residual data potentially recoverable.

Why this answer

How to eliminate wrong answers

Option B is wrong because Invoke-Command -ScriptBlock {Get-Service} returns service objects from remote computers, but Select-Object Status only outputs the Status property, omitting the service name required by the task. Option C is wrong because Get-WmiObject Win32_Service uses the State property (not Status) to check if a service is running, and the condition {$_.State -eq 'Running'} is incorrect; the correct property value is 'Running' but the property name is 'State', not 'Status', and the cmdlet is deprecated in favor of Get-CimInstance. Option D is wrong because Format-Table -AutoSize only formats the output for display but does not filter for running services; it would output all services regardless of their status, failing to meet the requirement to check only where the service is running.

Why this answer

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware drivers and devices, not software licensing or activation. Option C is wrong because Programs and Features is for uninstalling or modifying installed applications, not for managing Windows activation or product keys. Option D is wrong because User Accounts handles user profile settings, passwords, and credentials, but does not provide any interface for Windows license activation or product key entry.

Why this answer

How to eliminate wrong answers

Option B is wrong because resetting network settings clears Wi-Fi passwords and cellular settings but does not remove installed configuration profiles, which are stored separately in the device management area. Option C is wrong because restoring from a backup would reintroduce the problematic profile if it was included in that backup, failing to resolve the issue. Option D is wrong because disabling iCloud Keychain affects password and credit card syncing, not the installation or removal of configuration profiles.

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA3-SAE is not backward compatible with WPA-TKIP legacy devices; those devices would be unable to connect at all. Option B is wrong because using WPA2-PSK with TKIP encryption forces all devices to use the weaker TKIP protocol, which is deprecated and vulnerable to attacks, and does not maximize security for modern devices. Option C is wrong because configuring WPA2-PSK with AES and enabling WPA-TKIP as a fallback typically forces the router to support a mixed mode (WPA2/WPA mixed) that allows TKIP connections on the same SSID, which can downgrade security for all clients due to TKIP's known weaknesses and the potential for compatibility issues with 802.11n and higher data rates.

Why this answer

How to eliminate wrong answers

Option A is wrong because `lusrmgr.msc` (Local Users and Groups MMC) is a graphical management console, not a command-line tool, and the question explicitly requires a command-line solution. Option B is wrong because `net user` manages individual user account properties (like password, account expiry) but cannot directly add or remove a user from a local group like Administrators; it lacks the `/add` or `/delete` group membership switches. Option D is wrong because `diskpart` is a disk partitioning tool used for managing disks, volumes, and partitions, and has no functionality for user account or group management.

Why this answer

How to eliminate wrong answers

Option A is wrong because port forwarding exposes specific services directly to the internet, creating a large attack surface and requiring manual configuration for each service, which is neither secure nor scalable for multiple users. Option C is wrong because Remote Desktop Protocol (RDP) provides only per-user, per-session access to individual workstations, which is not designed for network-level resource sharing and introduces significant management overhead for 10 users. Option D is wrong because client-to-site VPN requires each user to install and maintain a VPN client, which adds administrative burden and is less scalable than a site-to-site VPN that centralizes the connection at the network edge.

Why this answer

How to eliminate wrong answers

Option A is wrong because Find My iPhone location tracking only helps locate a device — it does not prevent reactivation after an erase. Option C is wrong because iCloud Keychain with 2FA protects credential syncing, not device reactivation. Option D is wrong because Lost Mode locks and displays a message on the device but does not by itself prevent reactivation after an erase; that protection comes from Activation Lock.

Why this answer

How to eliminate wrong answers

Option A is wrong because holding the power button performs a forced shutdown, which is overly aggressive and can cause data loss or file system corruption; a normal restart via Apple menu or keyboard shortcut is preferred, but even that is unnecessary when the Finder can be relaunched. Option B is wrong because force quitting the WindowServer process would terminate the entire windowing system, causing all graphical elements (including open applications) to disappear and requiring a login window restart, which is excessive for a Finder-only issue. Option D is wrong because 'sudo killall Dock' only restarts the Dock process, which manages the application dock and not the desktop icons or menu bar; the desktop and menu bar are controlled by the Finder, not the Dock.

Why this answer

How to eliminate wrong answers

Option A is wrong because Performance Monitor is designed to collect performance counters and system resource usage data, not to log user activity or web browsing history; it cannot provide a timeline of user actions. Option B is wrong because Task Scheduler only shows scheduled tasks and their execution history, not arbitrary user-initiated activities like web browsing or application usage. Option D is wrong because Local Users and Groups is used to manage user accounts and group memberships, not to audit or review past user activity.

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Easy Transfer was deprecated starting with Windows 8 and is not available for migrating from Windows 7 to Windows 10; it was a consumer tool that did not support cross-version migrations in later OS releases. Option B is wrong because File History is a backup feature that only protects personal files in libraries, not user profiles or application settings, and is not designed for migrating to a new PC. Option D is wrong because Windows Backup and Restore creates system image backups or file backups but does not specifically migrate user profiles and application settings to a new operating system version; it is intended for disaster recovery, not user state transfer.

Why this answer

How to eliminate wrong answers

Option A is wrong because an outdated firmware (system software) typically causes security vulnerabilities or performance issues, but it does not directly cause pop-up ads to appear; adware behavior is tied to app-level permissions, not firmware version. Option C is wrong because a Wi-Fi network infected with malware would typically intercept or redirect web traffic, not inject pop-up ads into the Android UI layer; pop-ups that appear without a browser open are a client-side overlay issue, not a network-level attack. Option D is wrong because ghost touches from a hardware defect would cause random taps and interactions, not the display of structured pop-up ads with specific content; ghost touches cannot generate ad windows with text and images.

Why this answer

How to eliminate wrong answers

Option A is wrong because Settings > Personalization > Start only controls Start menu appearance and layout, not the ability to lock down the entire user experience or prevent desktop access. Option B is wrong because Control Panel > User Accounts > Manage User Accounts is used for standard user account management (creating, deleting, changing passwords) and does not provide any kiosk or restricted shell configuration. Option D is wrong because Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings deals with security policies like password policies, audit policies, and user rights assignments, not the assigned access kiosk mode which is configured via Settings or the 'Set up a kiosk' wizard.

Why this answer

How to eliminate wrong answers

Option A is wrong because `fuser /path/to/script` shows the PID(s) of processes using the file, but it does not distinguish between a file being open for reading/writing and a file being executed (text segment busy), and it may not reliably detect the 'Text file busy' condition on NFS mounts. Option B is wrong because `ps aux | grep script` only shows processes whose command line contains 'script', but it does not directly confirm that the file itself is open or being executed by another process. Option D is wrong because `strace -p $(pgrep script)` attaches to a process with 'script' in its name and traces its system calls, but it does not show whether the script file is busy; it also requires the script process to be running and named exactly 'script', which may not be the case.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because checking the user's email for phishing messages addresses a different attack vector (email-based social engineering), but the incident here involved direct physical access, not a phishing link. Option B is wrong because verifying the delivery person's identity with the shipping company is a non-technical, administrative step that does not address the immediate technical threat of malware or unauthorized system changes already present on the workstation. Option D is wrong because permanently disabling the user's network access is an overreaction and violates the principle of least disruption; a temporary network isolation (e.g., disabling the NIC or blocking the port) is appropriate, but permanent access removal is not a diagnostic or containment step.

Why this answer

How to eliminate wrong answers

Option A is wrong because turning off the display after 5 minutes does not lock the workstation; the session remains active and no password is required to resume. Option C is wrong because the 'Require password on wakeup' setting in the power plan applies to sleep/hibernate, not to screen saver lock, and it does not enforce a 5-minute inactivity lock. Option D is wrong because setting the computer to sleep after 5 minutes and requiring a password on wake does lock the session, but sleep is a power state that may disrupt user workflows and is not the standard method for screen lock policy; the screen saver method is the correct configuration for inactivity lock.

Why this answer

How to eliminate wrong answers

Option A is wrong because pretending to understand risks missing critical details about the problem, leading to ineffective or even harmful troubleshooting steps that could escalate the issue or violate service-level agreements. Option C is wrong because transferring the call without first attempting to clarify the issue is unprofessional and may not resolve the communication barrier; it also wastes time and shifts responsibility unnecessarily. Option D is wrong because telling the user their accent is hard to understand is disrespectful and unprofessional, and asking them to email the problem bypasses real-time interaction, potentially delaying resolution and frustrating the user.

Why this answer

How to eliminate wrong answers

Option A is wrong because physically shredding the drives destroys them, contradicting the requirement to reuse them in test environments. Option B is wrong because a standard format and OS reinstall only overwrites file system metadata and does not securely erase the underlying encrypted data; the original media encryption key remains intact, and data could potentially be recovered from the encrypted sectors. Option D is wrong because using a degausser applies a strong magnetic field that destroys the drive's firmware, servo tracks, and the self-encrypting capability, making the drive permanently unusable and violating the reuse requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because replacing the network cable would only fix physical connectivity issues, not software-based browser hijacking or redirects caused by extensions or proxy settings. Option C is wrong because updating the network adapter driver addresses hardware-level network communication problems, not browser-level configuration or add-on issues. Option D is wrong because reinstalling the operating system is an extreme, time-consuming measure that is unnecessary when the problem is isolated to the browser; resetting browser settings is a far more targeted and efficient first step.