CompTIA A+ Core 2 220-1202 (220-1202) — Questions 226–300

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because using a step stool does not address the primary hazards of dust inhalation and poor visibility; it only helps with height, which is not the main concern in a cramped space. Option C is wrong because removing the server from the rack and placing it on the floor increases the risk of physical damage to the server and creates a tripping hazard, and it does not mitigate the dust or lighting issues. Option D is wrong because disconnecting all power cables in the rack is an extreme and unnecessary step that could disrupt other critical systems; the technician should only isolate the specific device they are working on, following proper lockout/tagout procedures.

Why this answer

How to eliminate wrong answers

Option A is wrong because agreeing to rush the installation ignores the necessary steps of user training and data migration, leading to potential user confusion and data loss, which violates professional responsibility. Option C is wrong because installing software without training or support leaves users to figure out the system on their own, which is unprofessional and can cause productivity loss and security risks. Option D is wrong because telling the manager that training is not part of the technician's job dismisses a core component of a full deployment and fails to communicate the technician's role in ensuring successful adoption.

Why this answer

How to eliminate wrong answers

Option A is wrong because Resource Monitor provides real-time monitoring of CPU, memory, disk, and network usage, but it does not generate a historical or health-focused battery report. Option B is wrong because Performance Monitor tracks system performance counters over time, but it lacks specific battery health and usage reporting capabilities. Option D is wrong because Windows Memory Diagnostic is designed to test RAM for errors, not to analyze battery performance or health.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'fs_usage' is a real-time file system monitoring tool that logs current system calls; it cannot locate or recover previously deleted files. Option C is wrong because Disk Utility First Aid repairs file system structure errors (e.g., directory corruption) but does not recover deleted files; it has no undelete capability. Option D is wrong because while third-party tools can sometimes recover deleted files from an SSD, they should not be attempted first if a Time Machine backup exists, as they may overwrite the very data they aim to recover and are less reliable on SSDs due to TRIM.

Why this answer

How to eliminate wrong answers

Option A is wrong because a CCTV camera is a detective control that records incidents after they occur; it does not prevent an attacker from gaining physical access with a cloned badge. Option C is wrong because a door sensor alarm is a detection mechanism that alerts to unauthorized entry but does not stop the attacker from entering the closet in the first place. Option D is wrong because requiring a second factor like a PIN still relies on the RFID badge as the first factor; if the badge is cloned, the attacker can still present the cloned badge and then enter a PIN (which could be observed or guessed), so it does not prevent the core cloning attack.

Why this answer

How to eliminate wrong answers

Option A is wrong because RDP (Remote Desktop Protocol) is a proprietary Microsoft protocol primarily used for remote GUI access to Windows systems, not Linux servers, and while it can be encrypted, it is not the native secure remote access method for Linux. Option B is wrong because VNC (Virtual Network Computing) typically transmits data in cleartext by default and requires additional tunneling (e.g., over SSH) to be secure; it is not inherently encrypted and is not the standard secure remote access technology for Linux servers. Option D is wrong because Telnet transmits all data, including credentials, in plaintext over TCP port 23, providing no encryption or security, and is obsolete for secure remote administration.

Why this answer

How to eliminate wrong answers

Option A is wrong because reimaging the computer immediately is a drastic step that should only be taken after less destructive remediation methods have failed, and it would destroy any forensic evidence needed to understand the infection. Option C is wrong because resetting browser settings only addresses browser-based symptoms like changed homepages or toolbars, but does not remove the underlying malware that is causing network activity. Option D is wrong because disabling startup programs in Task Manager only prevents known programs from launching at boot, but does not remove or disable the malware process that is already running or hidden from the startup list.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `ping -n 100` sends only 100 ICMP Echo Requests and then stops, which is insufficient for monitoring intermittent connectivity that may occur over hours or days. Option C is wrong because `tracert -d` performs a single route trace to the destination without continuous monitoring, and the `-d` flag only disables DNS resolution, not enabling persistence. Option D is wrong because `pathping` combines ping and traceroute but runs a fixed sequence of probes (default 100 hops and 300 seconds) and then exits, providing a one-time latency and loss report rather than continuous logging.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `netstat -a` shows all active connections and listening ports but does not include the associated process name, so you cannot link a connection to a specific executable. Option C is wrong because `tasklist /svc` lists running processes and their associated services, but it does not display network connections or ports. Option D is wrong because `ipconfig /displaydns` shows the contents of the DNS resolver cache, which lists domain names and their resolved IP addresses, not active network connections or processes.

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Defender Firewall filters traffic based on ports and IP addresses, not domain names, and it cannot block specific malicious websites by URL. Option C is wrong because installing a browser extension requires software installation on each client, which violates the 'without installing software on each client' requirement. Option D is wrong because setting the browser security level to high only restricts browser features (e.g., scripts, ActiveX) and does not block access to specific malicious sites by domain or URL.

Why this answer

How to eliminate wrong answers

Option A is wrong because FileVault provides full-disk encryption to protect data at rest, not application or settings restrictions. Option C is wrong because the Guest User account allows temporary access with no persistent data but does not provide granular controls to restrict specific apps or prevent system setting changes. Option D is wrong because a firmware password prevents unauthorized users from booting from external devices or accessing recovery mode, but it does not restrict app usage or system settings within macOS.

Why this answer

How to eliminate wrong answers

Option A is wrong because replacing the toner cartridge does not address the safety hazard of high-voltage discharge and is a troubleshooting step, not a safety procedure. Option C is wrong because cleaning the corona wire with isopropyl alcohol is a maintenance task that should only be performed after power is disconnected and high voltage is discharged; doing it first risks electric shock. Option D is wrong because resetting to factory defaults is a software configuration step that does not eliminate the risk of high-voltage shock and does not resolve the physical safety concern.

Why this answer

How to eliminate wrong answers

Option A is wrong because `chmod 777` grants read, write, and execute permissions to everyone (owner, group, others), making the file world-writable and world-executable, which violates the security requirement. Option B is wrong because `chmod 644` grants read and write to the owner but read-only to group and others, meaning non-root users can still read the file, which does not meet the 'only root' condition. Option D is wrong because `chmod 400` grants read-only to the owner (root) and no permissions to group or others, but the requirement explicitly states the file must be both readable and writable by root, so write permission is missing.

Why this answer

How to eliminate wrong answers

Option A is wrong because a for loop is designed for iterating over a sequence or a fixed number of times, not for making a single conditional decision about a registry key's existence. Option B is wrong because a while loop repeats a block of code as long as a condition is true, which is unnecessary for a one-time check and could cause an infinite loop if misused. Option D is wrong because a try-catch block is used to handle exceptions (runtime errors) such as access denied or missing paths, not to test for the existence of a registry key before modification.

Why this answer

How to eliminate wrong answers

Option A is wrong because telling an upset user to 'calm down' can be perceived as dismissive and may escalate the situation; it does not address the technical problem. Option B is wrong because interrupting the user, even with a valid technical solution, can increase frustration and prevent the technician from gathering full details about the file deletion (e.g., whether it was permanently deleted or from a specific location). Option D is wrong because transferring a user solely for being upset avoids the technician's responsibility to handle emotional situations professionally and delays resolution; it should only be done if the issue is beyond the technician's scope or authority.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Task Manager Startup tab only manages programs that launch at user logon, not Windows services; the 'Workstation' service is a system service controlled via the Services console or SC command. Option B is wrong because Network and Sharing Center runs network troubleshooters that diagnose connectivity issues like IP configuration or DNS, but cannot start or stop Windows services. Option D is wrong because Device Manager is used to manage hardware drivers; reinstalling the network adapter driver would not resolve a service that is stopped, and the issue is not driver-related.

Why this answer

How to eliminate wrong answers

Option A is wrong because username and password are both 'something you know' factors, representing only a single authentication factor, not two different factors. Option C is wrong because biometric fingerprint (something you are) and a PIN (something you know) are two different factors, but the question specifies a smart card and PIN as the correct combination; however, the trap is that biometrics are often considered a valid second factor, but the exam expects the specific pairing of smart card and PIN as the correct answer. Option D is wrong because two different passwords are still both 'something you know' factors, providing only one factor type and no second factor.

Why this answer

How to eliminate wrong answers

Option A is wrong because phishing is a digital social engineering attack that uses deceptive emails or messages to trick victims into revealing sensitive information or installing malware; it does not involve physical badge use or building entry. Option C is wrong because dumpster diving involves searching through trash for discarded documents or equipment containing sensitive information, not using a badge to enter a building. Option D is wrong because shoulder surfing is the act of looking over someone's shoulder to obtain passwords, PINs, or other confidential data; it does not involve using a physical badge to gain unauthorized physical access.

Why this answer

How to eliminate wrong answers

Option B is wrong because a quick format only erases the file system index or directory structure, not the underlying data on the tape; the financial data remains recoverable with forensic tools. Option C is wrong because simply deleting files or reusing the tapes after file deletion does not remove the residual magnetic signature of the original data, leaving it vulnerable to recovery using specialized equipment. Option D is wrong because while incineration would physically destroy the tapes, it is unnecessarily extreme, costly, and environmentally hazardous for LTO-5 cartridges; degaussing is the appropriate and sufficient method for magnetic media that does not require physical destruction.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling a smart card and issuing a temporary PIN without verifying the caller's identity violates security policy and could allow an attacker to gain unauthorized physical access. Option C is wrong because the technician cannot reset or test a smart card remotely; smart cards are physical tokens that require local interaction with a reader, and remote testing is not possible. Option D is wrong because sending a temporary PIN via email is insecure; email is not encrypted end-to-end by default and could be intercepted, and the PIN should be delivered through a secure out-of-band method.

Why this answer

How to eliminate wrong answers

Option A is wrong because a man-in-the-middle (MITM) attack involves the attacker intercepting and potentially altering communications between two parties in real time, typically by exploiting network-level vulnerabilities (e.g., ARP spoofing or rogue Wi-Fi), not by sending a deceptive email with a fake link. Option C is wrong because a ransomware attack encrypts the victim's files or locks their system and demands payment for decryption, which is not described here; the email does not contain malware or encryption. Option D is wrong because cross-site scripting (XSS) is a web application vulnerability that allows an attacker to inject malicious scripts into trusted websites, executed in the victim's browser; the attack described does not involve injecting scripts into a legitimate site but rather creating a fake login page.

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA3-SAE is a different security protocol for personal networks, not enterprise; it does not integrate with 802.1X and does not address roaming optimization. Option B is wrong because while using the same SSID is necessary for roaming, a shared passphrase is irrelevant for WPA2-Enterprise, which uses per-user credentials via 802.1X, not a pre-shared key. Option D is wrong because disabling WPS improves security by preventing brute-force attacks on PIN-based authentication, but it has no effect on roaming performance or seamless handoff between access points.

Why this answer

How to eliminate wrong answers

Option A is wrong because immediately opening the case and wearing a grounding strap without first draining residual charge from capacitors can expose the technician to a shock hazard; the power supply can hold a dangerous charge for minutes after being unplugged. Option C is wrong because spraying compressed air into the interior before discharging residual power can blow dust into sensitive areas and does not address the immediate safety step of draining stored energy. Option D is wrong because removing the CMOS battery does not discharge the main power supply capacitors; the CMOS battery only powers the real-time clock and BIOS settings, and its removal does not eliminate the high-voltage charge in the PSU.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Windows Defender Antivirus settings manage malware protection, not firewall rules; it cannot create or modify inbound connection rules. Option C is wrong because Group Policy Editor (gpedit.msc) is used to configure system-wide policies across a domain, not for per-workstation firewall rule management on a standalone Windows 10 PC. Option D is wrong because Network and Sharing Center is a network status and troubleshooting interface; it does not provide the advanced inbound rule configuration needed to block all incoming connections except specific applications.

Why this answer

How to eliminate wrong answers

Option A (Scarcity) is wrong because scarcity involves creating a false sense of urgency or limited availability (e.g., 'Only 5 licenses left!'), not leaving a physical device to be found. Option C (Pretexting) is wrong because pretexting requires the attacker to fabricate a false identity or scenario (e.g., pretending to be IT support) to extract information, not relying on the victim's curiosity about a found object. Option D (Tailgating) is wrong because tailgating involves an unauthorized person physically following an authorized person into a restricted area, not leaving a malicious device for the victim to pick up and use.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because phishing typically involves deceptive emails or websites that trick users into clicking a link or entering credentials, not a phone call requesting software installation. Option C is wrong because smishing uses SMS text messages to deliver malicious links or requests, not a live voice call. Option D is wrong because shoulder surfing relies on physically observing a user's screen or keystrokes, not a remote phone-based interaction.

Why this answer

How to eliminate wrong answers

Option B is wrong because System Settings > Profiles is only for viewing and manually installing profiles that are already signed, not for creating or signing them. Option C is wrong because the Terminal 'profiles' command can install, remove, or list profiles but cannot create or sign a new configuration profile from scratch. Option D is wrong because Profile Manager in macOS Server requires a running MDM service and is considered a third-party MDM solution, which the question explicitly excludes.

Why this answer

How to eliminate wrong answers

Option A is wrong because Network and Sharing Center is a GUI for viewing network status, setting up new connections, and managing sharing profiles; it does not display or allow control of individual Windows services like 'Function Discovery Resource Publication' or 'SSDP Discovery'. Option B is wrong because Device Manager is used to manage hardware drivers and devices, not software services; it has no interface for service state or startup type. Option D is wrong because Task Manager shows running processes and performance metrics, but it does not list system services by their service name or provide controls for service startup type; it only shows a limited view of processes under the 'Services' tab, not the full service management console.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Sticky Keys' and 'Ease of Access' settings are accessibility features that modify keyboard input behavior, not security or autologon mechanisms; they cannot automatically log on a user or launch a single app. Option C is wrong because the 'Shutdown: Allow system to be shut down without having to log on' policy (a local security policy) only controls whether the shutdown command is available on the logon screen, not autologon or application restriction. Option D is wrong because 'User Account Control: Run all administrators in Admin Approval Mode' is a UAC setting that affects how administrative privileges are elevated, but it does not enable automatic logon or enforce a single-app kiosk environment.

Why this answer

How to eliminate wrong answers

Option A is wrong because PowerShell is not required on the remote machine for Get-CimInstance; it uses WMI via WinRM, which only requires the WMI service to be running. Option C is wrong because the default namespace for Win32_OperatingSystem is root/cimv2, which is correct and not the cause of an access denied error. Option D is wrong because the Remote Management Users group is not required for WMI access; membership in the local Administrators group on the remote computer is sufficient for WMI queries.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Reliability Monitor tracks system stability and application failures, not security-related logon events. Option B is wrong because Performance Monitor focuses on system performance metrics like CPU and memory usage, not security audit logs. Option D is wrong because Group Policy Editor is used to configure system policies and security settings, not to view existing event logs.

Why this answer

How to eliminate wrong answers

Option B (Enter-PSSession) is wrong because it creates an interactive, persistent session with a single remote computer, which is not suitable for running a script against multiple remote machines and capturing output to a CSV file. Option C (Get-WmiObject) is wrong because while it can retrieve WMI data from remote computers using the -ComputerName parameter, it is not a cmdlet for executing arbitrary PowerShell commands or script blocks; it is a specific cmdlet for WMI queries. Option D (Out-File) is wrong because it is used to send output to a text file on the local machine, not to execute commands on remote computers.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `ls -la` lists files but does not filter by modification time; piping to `grep '24 hours'` would only match lines containing that literal string, not files modified in the last 24 hours. Option C is wrong because `-atime 0` checks access time (last read), not modification time, so it would list files accessed in the last 24 hours, not those modified. Option D is wrong because `locate` searches a pre-built database of file paths and does not support time-based filtering; `sort -m` merges sorted files, which is irrelevant to listing recently modified files.

Why this answer

How to eliminate wrong answers

Option B is wrong because a strong BIOS/UEFI password only prevents unauthorized booting or changes to firmware settings, but it does not encrypt the hard drive; an attacker can remove the drive and read its data directly from another machine. Option C is wrong because a screensaver password with a short timeout only locks the user session when idle, but it does not protect data if the laptop is stolen while powered off or if the drive is removed; it also does not encrypt the drive. Option D is wrong because EFS (Encrypting File System) encrypts only individual files and folders at the file system level, not the entire drive, and it relies on the user's Windows profile, which can be bypassed if the drive is removed or if the user account is compromised; it also does not protect system files or the pagefile.

Why this answer

How to eliminate wrong answers

Option A is wrong because free wiping tools may not overwrite data to a secure standard (e.g., only a single pass or not covering hidden areas like HPA/DCO), and donating drives still risks residual data exposure if the tool fails or is misused. Option C is wrong because physically breaking drives with a drill does not guarantee complete destruction of all platters or chips, and disposing of them in regular trash violates environmental laws and can lead to data recovery from remaining fragments. Option D is wrong because a quick format only removes the file system pointers, leaving all data intact and easily recoverable with forensic tools, and selling drives online exposes proprietary software and client data to unauthorized parties.

Why this answer

How to eliminate wrong answers

Option A is wrong because a BIOS password only prevents unauthorized booting or BIOS changes but does not encrypt the drive; the data can still be read by removing the drive and connecting it to another system. Option C is wrong because antivirus with anti-theft features typically provides location tracking, remote lock, or wipe capabilities, but it does not encrypt the drive at rest, so data remains accessible if the drive is removed. Option D is wrong because a cloud backup service protects against data loss but does not prevent an attacker from reading data already stored on the laptop's drive.

Why this answer

How to eliminate wrong answers

Option A is wrong because Samsung DeX is a desktop-like interface for productivity, not a mass provisioning or enrollment feature. Option B is wrong because Google Backup is designed to restore personal user data (e.g., contacts, app data) from the cloud, not to enforce enterprise-wide policies or install a consistent set of apps across multiple devices. Option D is wrong because Developer Options > OEM Unlocking is used to unlock the bootloader for custom ROMs or rooting, which is a security risk and irrelevant to enterprise enrollment and policy deployment.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing virtual CPUs would increase CPU scheduling overhead and could worsen performance, especially when the bottleneck is memory, not CPU. Option C is wrong because changing from thin to thick provisioning affects disk I/O performance and storage allocation, not the immediate memory pressure causing the slowness. Option D is wrong because enabling hyper-threading on the host CPU improves parallel processing but does not address the host’s 90% memory usage; it could even increase memory contention if more threads compete for the same limited RAM.

Why this answer

How to eliminate wrong answers

Option A is wrong because `net user` is used to manage local user accounts, not to map network drives; the `/add` switch adds a user account, making this command entirely unrelated to drive mapping. Option C is wrong because `chkdsk` checks the file system integrity of a volume and cannot map a network share; the `/f` flag fixes errors on a local disk, not a remote path. Option D is wrong because `ipconfig /renew` renews the DHCP lease for a network adapter, which does not map a drive or create a persistent connection to a shared folder.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the office network has a 100 Mbps symmetrical connection, and oversubscription would cause slowness for all users, not just this remote user; the question states only this user is experiencing slowness. Option B is wrong because high latency would cause lag or delay, not necessarily slowness in throughput; the user's speed test shows adequate download/upload speeds, and latency is not measured in Mbps. Option D is wrong because outdated encryption protocols (e.g., PPTP) can cause security vulnerabilities but do not inherently cause slowness; modern VPNs with AES encryption have negligible performance impact compared to bandwidth limitations.

Why this answer

How to eliminate wrong answers

Option B is wrong because it suggests scheduling the reboot for after hours, which may not be feasible if the security update requires an immediate reboot to close a critical vulnerability that is actively being exploited; delaying the reboot even a few hours could expose the network to attack. Option C is wrong because citing 'IT policy' without explaining the technical reason fails to build trust or address the manager's productivity concern, and it does not provide the necessary context for why the reboot cannot be deferred. Option D is wrong because allowing a one-week delay for a critical security update is irresponsible; the vulnerability could be exploited in the wild within hours, and delaying the patch violates security best practices and potentially compliance requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan on all workstations simultaneously does not stop the worm from actively spreading through network shares during the scan; the worm can continue to infect new systems while scans are running, and scanning without isolation is ineffective for containment. Option C is wrong because updating antivirus definitions on one workstation and scanning only that single system ignores the fact that the worm is already on multiple workstations and actively spreading via network shares; this does not contain the outbreak. Option D is wrong because rebooting all workstations into Safe Mode with Networking still leaves network shares enabled and the workstations connected to the network, allowing the worm to continue spreading via SMB; Safe Mode with Networking does not disable file sharing or isolate the systems.

Why this answer

How to eliminate wrong answers

Option A is wrong because spyware typically collects browsing habits or personal data without necessarily intercepting keystrokes, and a standard antivirus scan is often ineffective against kernel-level drivers that hide from the OS. Option C is wrong because ransomware encrypts files and demands payment, not exfiltrates data via keystroke interception; restoring from backup does not remove the hidden driver. Option D is wrong because adware displays unwanted ads and is usually removed via Control Panel, but a hidden driver keylogger requires specialized tools like anti-rootkit scanners, not simple uninstallation.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because checking if the VPN client software is up to date is a secondary step; outdated client software typically causes compatibility or feature issues, not authentication failures, and the user's ability to browse indicates the client is at least launching. Option C is wrong because restarting the VPN server at the data center is a drastic, disruptive action that should only be taken after ruling out client-side and authentication issues; it is not a first-line troubleshooting step for a single user. Option D is wrong because reinstalling network adapter drivers addresses hardware or driver-level connectivity problems, but the user's internet is working, so the network adapter is functioning correctly.

Why this answer

How to eliminate wrong answers

Option A is wrong because malware is not a typical consequence of an official OS update from the device manufacturer or carrier; a factory reset is an extreme and unnecessary step for temporary post-update battery drain. Option B is wrong because OS updates do not reset battery optimization settings; they may change default app permissions or background restrictions, but the core optimization settings remain intact. Option D is wrong because a battery does not suddenly fail due to a software update; battery degradation is gradual and unrelated to OS version changes.

Why this answer

How to eliminate wrong answers

Option A is wrong because while a botnet infection is possible, the immediate and most likely consequence of a tech support scam is credential theft via a keylogger, not necessarily DDoS participation. Option C is wrong because BIOS corruption requires specific, targeted firmware-level access and is not a typical outcome of a remote desktop session; the attacker would need to reboot into a special mode or use a BIOS flashing tool. Option D is wrong because physical hard drive damage cannot occur through remote access; the symptoms are caused by malicious software, not hardware failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because thick provisioning pre-allocates the entire virtual disk size at creation, consuming maximum storage immediately and defeating the goal of minimizing storage usage. Option C is wrong because a fixed-size disk is synonymous with thick provisioning, requiring the full allocated space upfront with no ability to grow dynamically. Option D is wrong because 'dynamic disk' is a Windows disk management concept unrelated to virtual disk provisioning; the correct VMware/Hyper-V term for on-demand allocation is thin provisioning.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling the screensaver prevents the screen from locking or turning off, but it does not affect the Remote Desktop idle session timeout, which is controlled by RDSH policies, not display settings. Option C is wrong because changing the power plan to High Performance prevents the computer from sleeping or reducing power, but the idle disconnect is a session-level timeout set in Remote Desktop services, not a power management feature. Option D is wrong because Network Level Authentication (NLA) is a security feature that requires pre-authentication before a full RDP connection is established; it does not control session disconnection due to inactivity.

Why this answer

How to eliminate wrong answers

Option A is wrong because Infrastructure as a Service (IaaS) provides virtualized computing resources (e.g., VMs, storage) but not a pre-built email application; the company would still need to install and manage the email server software and configure encryption themselves. Option B is wrong because Platform as a Service (PaaS) provides a development and deployment environment (e.g., runtime, database) but not a ready-to-use email application; the company would have to build or deploy their own email solution on the platform. Option D is wrong because Desktop as a Service (DaaS) delivers virtual desktops to end-users, not a specific application like email; it focuses on providing a full desktop OS experience, not a managed email service.

Why this answer

How to eliminate wrong answers

Option A is wrong because while a rogue AP can cause RF interference, that is a performance issue, not a security risk, and the question specifically asks about the most immediately concerning security risk. Option C is wrong because power consumption from a single small AP is negligible and does not represent a meaningful security threat. Option D is wrong because a DHCP conflict is a network configuration problem that can cause connectivity issues, but it is not a security vulnerability; the open SSID allowing unauthorized network access is far more critical.

Why this answer

How to eliminate wrong answers

Option A is wrong because a firmware update is a planned change that would be documented in change management; it is not a typical outcome of a maintenance window and would not suddenly cause a connectivity issue without prior notice. Option C is wrong because an expired password would prevent authentication but not block network connectivity to the file server; the user would still be able to ping or reach the server at the transport layer. Option D is wrong because a hard drive failure would cause the file server to become unresponsive or fail to boot, but the user would likely see a 'server not found' error rather than a simple connectivity loss, and such a failure is unrelated to the scheduled maintenance window.

Why this answer

How to eliminate wrong answers

Option A is wrong because ignoring a bulging capacitor can lead to electrolyte leakage, short circuits, or catastrophic failure that may damage the new power supply or other components. Option B is wrong because shorting capacitor leads with a screwdriver can cause a dangerous spark, electric shock, or damage to the motherboard traces; capacitors should be discharged through a proper resistor or allowed to self-discharge. Option D is wrong because applying electrical tape does not address the internal failure, and the capacitor may still leak, burst, or cause a short circuit under load.

Why this answer

How to eliminate wrong answers

Option A is wrong because `chmod 755 file` sets permissions to -rwxr-xr-x, which would give read and execute to everyone, including users outside the intended group, and does not address the group ownership mismatch. Option B is wrong because `chmod g+r file` adds read permission for the current group owner ('admin'), not for the 'staff' group; the user is in 'staff', so this command does not grant access to the user's group. Option D is wrong because `chown user:staff file` changes both the owner and group to 'user' and 'staff', which is excessive and could disrupt other access controls; the requirement is only to change the group ownership to 'staff', not the file owner.

Why this answer

How to eliminate wrong answers

Option A is wrong because proceeding without approval violates change management policy and could cause unexpected failures in the legacy application due to the unplanned registry modification. Option B is wrong because skipping the registry change may break the new software deployment, as the script likely depends on that key for functionality, and modifying the script without authorization is also a change management violation. Option D is wrong because documenting the change after deployment bypasses the required pre-approval process and does not mitigate the risk of impacting the legacy application during the rollout.

Why this answer

How to eliminate wrong answers

Option A is wrong because Device Manager is used to manage hardware drivers and devices, not to monitor or control software services consuming CPU. Option C is wrong because Event Viewer shows system logs and error events, but does not provide real-time CPU usage per process or service. Option D is wrong because Performance Monitor can create data collector sets for long-term performance analysis, but it is not the quickest or most direct tool for identifying a specific service consuming excessive CPU; the Services console is more immediate.

Why this answer

How to eliminate wrong answers

Option A is wrong because a worm self-replicates and spreads across networks without user interaction, whereas this malware required the user to download and install it alongside a PDF converter. Option C is wrong because ransomware typically encrypts files and demands payment for decryption, not opening a backdoor for remote control. Option D is wrong because a rootkit hides deep in the operating system, often at the kernel level, and requires a clean installation to ensure removal; however, this program is a user-level Trojan that can be removed via Safe Mode scanning without full reinstallation.

Why this answer

How to eliminate wrong answers

Option A is wrong because the power plan sleep timeout controls when the system enters a low-power sleep state, not the lock screen; a computer can be idle and unlocked without sleeping. Option C is wrong because Windows Update installation status does not affect the screen saver or lock timeout behavior; missing updates would not prevent automatic locking. Option D is wrong because Fast Startup is a boot optimization feature that affects shutdown and startup, not idle-time locking; disabling it has no impact on the lock timeout.

Why this answer

How to eliminate wrong answers

Option A is wrong because Terminal is a command-line interface that requires prior knowledge of specific commands (e.g., `top`, `kill`, `fs_usage`) and is not the first diagnostic tool for a GUI-level hang; it is more advanced and less accessible for initial triage. Option C is wrong because Disk Utility is used for repairing disk permissions, verifying disk integrity, and managing volumes, but the issue here is a process hang, not a filesystem corruption or disk error. Option D is wrong because System Information provides hardware and software configuration details but does not show real-time process activity or resource usage, making it useless for diagnosing a spinning beach ball caused by a stuck application.

Why this answer

How to eliminate wrong answers

Option A is wrong because warranty information is irrelevant to the immediate task of replacing a failed hard drive; it would be consulted after the fact for potential RMA, not before the procedure. Option C is wrong because a network topology diagram shows how devices are connected but does not contain the authorization, risk assessment, or rollback steps needed for a planned hardware change. Option D is wrong because the employee handbook covers company policies and conduct, not the technical change management documentation required for server maintenance.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because placing CRT monitors in a regular dumpster violates environmental regulations due to the leaded glass and other hazardous substances, which can leach into landfills and contaminate soil and groundwater. Option B is wrong because selling CRT monitors to a scrap metal dealer is not compliant unless the dealer is a certified e-waste recycler; general scrap dealers often lack the permits and processes to handle the toxic components safely, and the monitors may contain non-metallic hazardous materials. Option D is wrong because removing the glass and disposing of the plastic casing separately does not address the hazardous nature of the leaded glass, which still requires proper e-waste recycling; moreover, this practice is typically illegal without proper certification and equipment to prevent environmental release.

Why this answer

How to eliminate wrong answers

Option A is wrong because while testing in a staging environment is a best practice, the question explicitly states there is 'no formal change management process,' and the primary violation is the lack of communication and documentation, not the absence of a staging environment. Option B is wrong because a Change Advisory Board (CAB) is a formal governance body typically used in larger organizations; a small business without a formal process would not have a CAB, so failing to get CAB approval is not the most clearly violated principle. Option D is wrong because although a rollback plan is important, the technician could have avoided the conflict entirely by simply communicating the change to stakeholders; the lack of a rollback plan is a secondary issue, not the core violation of change management principles.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Defer feature updates' delays the installation of non-security feature updates, not critical security updates, and does not control restart timing. Option C is wrong because setting the connection as metered prevents all automatic downloads of updates, including critical ones, which violates the policy requiring automatic installation. Option D is wrong because 'Notify to schedule restart' only alerts the user to schedule a restart but does not enforce automatic installation of critical updates; it relies on user action, which may delay installation and violate the policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because high availability (HA) focuses on eliminating single points of failure within a single provider's infrastructure (e.g., redundant servers, storage, or network paths) to ensure service uptime, but it does not provide data accessibility from a different provider if the entire primary provider fails. Option C is wrong because load balancing distributes incoming traffic across multiple servers or resources to optimize performance and availability, but it does not replicate data to another provider or ensure data access during a provider-wide outage. Option D is wrong because a disaster recovery plan (DRP) outlines the processes and procedures for recovering data and IT infrastructure after a disaster, but it is a broader strategy that may include cloud federation; the specific concept that enables cross-provider data accessibility is cloud federation, not the plan itself.