CompTIA A+ Core 2 220-1202 (220-1202) — Questions 526–600

Why this answer

How to eliminate wrong answers

Option A is wrong because installing a self-signed SSL certificate on the server does not enable HTTPS; the application itself must support HTTPS to use the certificate, and a legacy HTTP-only application cannot serve HTTPS without code changes. Option C is wrong because HSTS is an HTTP response header that enforces HTTPS connections from browsers, but it requires the server to already support HTTPS, which this legacy application does not. Option D is wrong because configuring the browser to use a proxy server only redirects traffic through an intermediary; it does not encrypt the traffic between the client and the proxy, leaving the HTTP data exposed on the network.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the hypervisor were in maintenance mode, VMs would be migrated or unable to start, but the error would typically be 'host unavailable' or 'maintenance in progress', not a resource quota exceeded message. Option B is wrong because the error specifically mentions 'resource quota exceeded', not 'storage full'; a full storage pool would cause write failures or provisioning errors, not a quota limit notification. Option D is wrong because a misconfigured virtual switch or VLAN would result in network connectivity issues (e.g., 'network not reachable'), not a resource quota error in the cloud portal.

Why this answer

How to eliminate wrong answers

Option A is wrong because reviewing VPN logs is a forensic step that does not stop ongoing unauthorized access; it should be performed after the immediate threat is neutralized. Option C is wrong because changing the VPN server's shared secret (a pre-shared key used for IPsec or L2TP) would not affect an attacker using a valid user account, as the shared secret is a server-level authentication parameter, not tied to individual user credentials. Option D is wrong because notifying the former employee is irrelevant and potentially dangerous; the account was compromised, and the former employee may be the attacker or unaware, but notification does not prevent further access and could tip off the attacker.

Why this answer

How to eliminate wrong answers

Option B is wrong because `ipconfig` is used to display IP configuration, not to set it; there is no `/setaddress` parameter in `ipconfig`. Option C is wrong because `netstat -r` displays the routing table, not configures IP settings. Option D is wrong because `ping 192.168.1.1` tests connectivity to the gateway but does not configure the IP address.

Why this answer

How to eliminate wrong answers

Option A is wrong because port forwarding alone does not solve the problem of a changing public IP; it only directs incoming traffic to a specific internal device, but users would still need to know the current IP address. Option C is wrong because assigning static IPs to employees on the office LAN does not affect the public IP address that remote users connect to; the public IP remains dynamic and still changes. Option D is wrong because a VPN with a static IP assigned by the ISP would require the business to purchase a static IP from the ISP, which is not mentioned in the scenario and is an additional cost; the question asks for a solution that works with the existing dynamic IP.

Why this answer

How to eliminate wrong answers

Option A is wrong because `net use` is used to manually connect or disconnect network shares, not to refresh Group Policy settings. Option B is wrong because `gpresult` displays the Resultant Set of Policy (RSoP) for a user or computer, but it does not apply or refresh policies. Option D is wrong because `nslookup` is a DNS query tool used to resolve hostnames to IP addresses, and it has no role in Group Policy processing.

Why this answer

How to eliminate wrong answers

Option A is wrong because an incorrect DNS server would cause name resolution failures for all internal resources, not selectively block file servers while allowing email access. Option B is wrong because VLAN membership is irrelevant for VPN concentrator routing; the concentrator can route to any subnet regardless of VLAN if a route exists. Option D is wrong because local logon permissions are not required for network file access; file server permissions are based on network shares and user credentials, not local logon rights.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a jailbroken device with a tweak interfering with authentication would likely cause broader instability or specific app crashes, not a consistent, system-level Apple ID password prompt that persists after correct entry. Option B is wrong because changing the Apple ID password and not syncing to all services would cause authentication failures on services using the old password, not repeated prompts after entering the correct password. Option D is wrong because a hardware fault in the Secure Enclave would manifest as inability to use Touch ID/Face ID or perform cryptographic operations, not as a repeated password prompt that works when entered.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling a pop-up blocker only prevents unwanted pop-up windows from appearing; it does not restrict the web application's access to system resources or provide any sandboxing. Option B is wrong because private browsing mode (e.g., Incognito in Chrome) only prevents the browser from storing local history, cookies, and form data; it does not isolate the application from the underlying operating system or other system resources. Option D is wrong because disabling JavaScript would break most modern web applications, but it does not create a sandboxed environment; it merely removes a scripting capability, leaving other attack vectors (e.g., HTML, CSS, or plugin exploits) uncontained.

Why this answer

How to eliminate wrong answers

Option A is wrong because while a hard hat provides head protection against accidental bumps or falling objects, it is not the most critical precaution when working near electrical hazards in a drop ceiling; the primary risk is electrical shock, not head injury. Option C is wrong because ventilation is not a primary concern when running Ethernet cables through a drop ceiling; the main hazards are electrical and physical, not airborne contaminants or lack of oxygen. Option D is wrong because anti-static gloves are used to prevent electrostatic discharge (ESD) damage to sensitive electronic components, but they do not protect against the immediate life-threatening risk of contact with live electrical wires in a drop ceiling environment.

Why this answer

How to eliminate wrong answers

Option A is wrong because `tasklist /v` only lists running processes with verbose details (e.g., session name, status) but does not terminate any process. Option C is wrong because `shutdown /r /t 0` initiates an immediate system restart, which does not terminate a specific process; it shuts down the entire OS. Option D is wrong because `regedit /e backup.reg` exports the entire registry to a file; it does not interact with running processes and is used for backup, not process termination.

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA2-PSK uses a pre-shared key, which does not support 802.1X authentication or smart cards; PEAP-MSCHAPv2 relies on passwords, not certificates, and is vulnerable to brute-force attacks. Option B is wrong because WPA3-Personal with SAE is designed for password-based authentication in home/small office networks, not for 802.1X enterprise authentication with smart cards. Option D is wrong because while WPA3-Enterprise supports 802.1X, EAP-TTLS typically uses a server-side certificate only and tunnels password-based inner methods (e.g., MSCHAPv2), which does not meet the requirement for smart card (certificate-based) authentication; EAP-TLS is the standard for client certificate authentication.

Why this answer

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan on an actively infected system can trigger the ransomware to accelerate encryption or delete files, and it does nothing to stop network propagation. Option C is wrong because backing up files to an external drive risks copying encrypted or infected data, and the act of connecting an external drive could allow the ransomware to encrypt that drive as well. Option D is wrong because restarting the computer and booting into Safe Mode does not disconnect the network interface; the ransomware may still have persistence mechanisms (e.g., scheduled tasks, services) that activate on boot, and the system remains a vector for lateral movement.

Why this answer

How to eliminate wrong answers

Option A is wrong because Guest Mode creates a separate user profile with limited access but still allows the user to switch profiles or access other apps within the guest session, so it does not lock the device to a single app. Option C is wrong because Developer Options > Force GPU Rendering is a debugging tool that forces apps to use GPU for 2D drawing, which can improve performance but does not restrict app access or prevent users from leaving the inventory app. Option D is wrong because Do Not Disturb only silences notifications and calls; it does not restrict app usage or prevent the user from navigating to other apps or settings.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing UPS batteries in a regular dumpster violates environmental regulations (e.g., RCRA) and can lead to soil and water contamination from leaked lead and acid. Option C is wrong because burning UPS batteries in an incinerator releases toxic fumes, including lead oxide and sulfur dioxide, and does not safely recover energy due to the hazardous nature of the materials. Option D is wrong because storing batteries indefinitely in a sealed container is not a disposal method and risks eventual leakage, corrosion, and non-compliance with waste management laws.

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA2-PSK uses a pre-shared key that is shared among all users, making it impossible to provide individual logins and vulnerable to passphrase cracking if the key is compromised. Option B is wrong because while WPA2-Enterprise with 802.1X and RADIUS supports individual logins, it relies on older encryption (CCMP/AES) and is susceptible to KRACK attacks and dictionary attacks on weak EAP methods; it does not mandate the 192-bit security suite required for the highest security. Option D is wrong because WPA3-Personal with SAE (Simultaneous Authentication of Equals) provides strong password-based authentication but still uses a single shared password for the SSID, not individual logins for each student.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling WPS, even for convenience, creates a backdoor that bypasses the strong WPA2-PSK passphrase; the WPS PIN can be brute-forced offline, compromising the network. Option B is wrong because disabling SSID broadcast only hides the network name from casual scans, but it does not prevent determined attackers from discovering it using packet sniffers (e.g., Wireshark) or tools like Kismet, and it can actually cause connectivity issues for legitimate clients. Option D is wrong because MAC address filtering is a weak security measure; MAC addresses can be easily spoofed using tools like SMAC or by modifying the network adapter settings, so it provides no real protection against a skilled attacker.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the host machine ran out of memory while the VM was running, the VM would typically crash or be paused by the hypervisor (e.g., Hyper-V would trigger a 'critical error' state), not cause a BSOD on the next startup; the BSOD is a guest OS issue, not a host resource exhaustion symptom. Option C is wrong because outdated Guest Additions (or Integration Services) can cause performance or driver issues, but they do not prevent the VM from booting or cause a BSOD on startup; the VM would still start, albeit with reduced functionality. Option D is wrong because the hypervisor version incompatibility would prevent the VM from starting at all (e.g., a configuration version mismatch error), not cause a BSOD after the VM has already booted successfully in the past.

Why this answer

How to eliminate wrong answers

Option A is wrong because overwriting with zeros does not meet HIPAA requirements for disposal of drives containing PHI; it is a sanitization method for reuse, not destruction, and does not provide a certificate of destruction. Option B is wrong because degaussing destroys the magnetic media but does not physically destroy the drive, and many recyclers will not accept degaussed drives as scrap metal without additional processing; more importantly, degaussing alone does not produce a certificate of destruction from a certified recycler. Option D is wrong because cryptographic erase only renders data inaccessible by destroying the encryption key, but the encrypted data remains on the drive and could potentially be recovered if the key is compromised or if the drive is later analyzed; it does not meet the physical destruction requirement for disposal and does not provide a certificate of destruction.

Why this answer

How to eliminate wrong answers

Option A is wrong because IaaS (Infrastructure as a Service) provides only virtualized compute, storage, and networking resources (e.g., Amazon EC2, Azure VMs), requiring the business to still deploy, configure, and manage the file server operating system and collaboration software, which does not reduce hardware maintenance costs to the degree needed. Option B is wrong because PaaS (Platform as a Service) offers a runtime environment for custom application development (e.g., AWS Elastic Beanstalk, Google App Engine), not a ready-to-use file server with built-in real-time collaboration features; the business would still need to build or integrate collaboration logic. Option D is wrong because DaaS (Desktop as a Service) delivers virtual desktops (e.g., Windows 365, Amazon WorkSpaces) that require users to connect to a full desktop environment, not a simple file-sharing service, and it does not inherently provide the real-time collaboration capabilities of a SaaS file-sharing application.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a BIOS password only prevents unauthorized booting of the system, but does not encrypt the data on the drive; an attacker could remove the hard drive and access the data directly. Option C is wrong because EFS (Encrypting File System) encrypts individual files or folders, not the entire drive, and it does not work transparently for all users—it requires user-specific certificates and can leave system files or temporary data unencrypted. Option D is wrong because a screensaver password only locks the screen after inactivity, but does not encrypt any data; an attacker could boot from a live USB or remove the drive to read the data.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because throwing toner cartridges in regular trash violates environmental regulations (e.g., RCRA) as residual toner is classified as hazardous waste, and plastics do not biodegrade in landfills. Option C is wrong because burning toner cartridges in an incinerator releases toxic fumes, including dioxins and heavy metals from the toner powder, and is not a standard energy-recovery method for e-waste. Option D is wrong because toner cartridges are not primarily scrap metal; they contain plastic, foam, and toner, making them unsuitable for scrap metal recycling, and a scrap metal dealer would reject them or improperly dispose of non-metal components.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Apps & features' is used to manage installed applications (uninstall, modify, or move them) but does not provide any option to set default applications or file associations. Option B is wrong because 'Personalization > Start' controls the appearance and behavior of the Start menu, such as which folders appear and whether to show recently added apps, and has nothing to do with default browser settings. Option D is wrong because 'Update & Security > Windows Update' is solely for managing Windows updates, including checking for, installing, and configuring update settings, and does not include any functionality for configuring default apps.

Why this answer

How to eliminate wrong answers

Option B is wrong because `adduser` is a Perl script (not a standard Linux command on all distributions) that may create a home directory by default but does not set the password in the same command; it typically prompts for password separately, and on some systems it may not be available. Option C is wrong because `useradd jdoe` without the `-m` flag does not create a home directory by default (the home directory is only created if the system's default settings or the `-m` flag are used), so it fails the requirement to create a home directory. Option D is wrong because `usermod -m jdoe` modifies an existing user's home directory (moving its contents) and does not create a new user or set a password, making it entirely inappropriate for creating a new user.

Why this answer

How to eliminate wrong answers

Option A is wrong because EFS (Encrypting File System) encrypts individual files and folders on NTFS volumes, not entire removable drives, and it does not support encrypting USB flash drives for use on other systems without additional configuration. Option C is wrong because Windows Defender Firewall is a network security tool that filters incoming and outgoing traffic based on rules; it does not provide any data-at-rest encryption for storage devices. Option D is wrong because Device Manager is used to manage hardware drivers and device settings, not to perform encryption or security configurations on storage media.

Why this answer

How to eliminate wrong answers

Option A is wrong because `bootrec /fixmbr` rewrites the master boot record (MBR) to the system partition, which addresses boot sector corruption but does not repair the BCD store. Option B is wrong because `bootrec /fixboot` writes a new boot sector to the system partition, which fixes boot sector issues but does not rebuild the BCD store. Option D is wrong because `sfc /scannow` checks and repairs system file integrity, but it does not operate on the BCD store or boot configuration data.

Why this answer

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing involves sending deceptive emails or messages that trick users into revealing sensitive information or clicking malicious links, not directly calling and impersonating someone to reset a password. Option C (Tailgating) is wrong because tailgating is a physical security breach where an unauthorized person follows an authorized individual into a restricted area without proper authentication, not a phone-based impersonation. Option D (Shoulder surfing) is wrong because shoulder surfing involves directly observing someone's screen or keyboard to steal information like passwords, not fabricating a story over the phone.

Why this answer

How to eliminate wrong answers

Option A is wrong because pretexting involves fabricating a false identity or scenario to trick a victim into divulging information or performing an action, not physically following someone through a door. Option B is wrong because baiting relies on offering something enticing (e.g., a free USB drive or download) to lure the victim into a trap, not exploiting physical proximity at a secure door. Option D is wrong because phishing is a digital attack using deceptive emails, messages, or websites to steal credentials or install malware, not a physical entry technique.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a host firewall typically filters traffic based on IP addresses or ports, but since the VM uses a bridged adapter, it appears as a separate device on the network; the host firewall does not inherently block the VM's traffic unless explicitly configured to do so, and the question states the host is connected and browsing, making a host firewall block unlikely. Option C is wrong because if the virtual switch on the host were disabled, the host itself would likely lose network connectivity or the VM would not even start, but the host is working fine; the virtual switch is a software component that remains active as long as the hypervisor is running. Option D is wrong because a corrupted OS would typically cause boot failures, crashes, or application errors, not a sudden, isolated loss of network connectivity while the VM remains running; network stack corruption is possible but far less common than a DHCP lease issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because reinstalling the custom application does not address the root cause (the unauthorized Windows update) and may waste time if the update breaks the application again. Option C is wrong because leaving an unauthorized update in place bypasses change management controls and could cause further instability; a new change request should be submitted before, not after, the change is applied. Option D is wrong because permanently disabling Windows Update leaves the system vulnerable to security patches and is an overreaction; the proper response is to manage updates through an approved change process, not disable the service entirely.

Why this answer

How to eliminate wrong answers

Option A is wrong because `-perm -6000` uses a minus sign, which requires all bits in 6000 (both SUID and SGID) to be set simultaneously, not just one of them; this would miss files with only SUID or only SGID. Option B is wrong because it uses `-o` (OR) without grouping parentheses, causing the `-user root` condition to apply only to the first expression, so it would list files with SGID set regardless of owner. Option C is wrong because `ls -la | grep '^...s'` only matches files with SUID set (the 's' in the owner execute position) and misses files with only SGID set (where the 's' appears in the group execute position), plus it relies on parsing `ls` output which is fragile and not recommended for scripting.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Services.msc allows you to start, stop, or restart the Windows Search service, but it does not provide a direct option to rebuild the search index; rebuilding requires the Indexing Options interface. Option C is wrong because Task Manager is used to manage running processes, monitor performance, and start/stop applications, but it has no capability to manage or rebuild the search index. Option D is wrong because Windows Settings > Privacy & security > Searching Windows controls privacy-related search settings (e.g., whether to include cloud content or history), but it does not include a rebuild option for the local search index; the rebuild function is exclusively in the legacy Indexing Options control panel.

Why this answer

How to eliminate wrong answers

Option A is wrong because an outdated firmware would not cause a sudden failure immediately after changing the security mode; the issue is directly tied to the authentication method change, not firmware version. Option B is wrong because WPA2-Enterprise can use the same encryption ciphers (AES/CCMP) as WPA2-PSK; device support for the cipher is not the problem—the problem is the missing authentication server. Option D is wrong because the SSID was not changed according to the question; the customer only changed the security mode, and an SSID change would cause devices to not see the network, not fail authentication.

Why this answer

How to eliminate wrong answers

Option B is wrong because it includes a judgmental phrase ('people don't manage their inbox') that can be perceived as condescending, which may provoke a confrontational user and violates professional communication standards. Option C is wrong because increasing the mailbox quota without addressing the underlying storage issue is a temporary workaround that could lead to future problems (e.g., exceeding server limits or violating organizational email retention policies), and it fails to educate the user on proper mailbox management. Option D is wrong because it dismisses the user's concern by stating 'your email isn't broken,' which invalidates their experience and can escalate tension; the technician should acknowledge the issue while explaining the cause professionally.

Why this answer

How to eliminate wrong answers

Option A is wrong because on-demand self-service refers to a user's ability to provision computing resources automatically without human interaction, which is not directly affected by a DDoS attack. Option B is wrong because broad network access describes the ability to access cloud services over standard network protocols (e.g., HTTP/HTTPS) from various devices, and while the attack uses the network, it does not directly impact this characteristic. Option D is wrong because resource pooling involves the provider's ability to serve multiple customers from shared physical resources using multi-tenancy, which is a cost-efficiency model, not a measure of service accessibility.

Why this answer

How to eliminate wrong answers

Option B is wrong because MAC address filtering is a separate feature from security protocol support; if the router's firewall were blocking MAC addresses, the laptops would not even see the network or would be explicitly denied, but the issue is specifically about authentication after the upgrade to WPA3. Option C is wrong because TKIP is an encryption cipher used with WPA and WPA2, not WPA3; WPA3 uses AES-CCMP or GCMP-256, and while older laptops might use TKIP with WPA2, the core incompatibility here is the protocol version itself, not the cipher. Option D is wrong because a hidden SSID does not prevent a client from connecting if the SSID is manually entered; the problem is the authentication handshake failure due to WPA3 incompatibility, not network discovery.

Why this answer

How to eliminate wrong answers

Option B is wrong because 'sfc /scannow' scans and repairs protected system files, but it does not stop the Windows Update service or delete temporary update files; it addresses file corruption, not update stuck states. Option C is wrong because 'dism /online /cleanup-image /restorehealth' repairs the Windows system image and component store corruption, but it does not stop the update service or remove the temporary update files that cause repeated failed attempts. Option D is wrong because 'taskkill /IM svchost.exe /F' forcefully terminates all svchost.exe processes, which would crash critical system services including the Windows Update service, but it is a brute-force method that can destabilize the system and does not safely stop the service or clean up the temporary files.

Why this answer

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee the decryption key will be provided; attackers often take the money and disappear, and paying funds further criminal activity. Option B is wrong because ransomware decryption tools from reputable sources are only effective for specific, known ransomware variants; the infection could use a unique or custom encryption algorithm, making such tools useless. Option D is wrong because reinstalling the operating system only wipes the system drive; it does not decrypt or recover the encrypted personal files, which remain encrypted on the storage media.

Why this answer

How to eliminate wrong answers

Option A is wrong because reattaching the virtual hard disk to the SCSI controller is unnecessary; the IDE controller is fully capable of booting a VM, and the error is not caused by the controller type. Option C is wrong because increasing memory allocation addresses performance or out-of-memory issues, not boot failures related to missing operating system detection. Option D is wrong because restoring from a snapshot should be a last resort after simpler checks like boot order, as snapshots can cause data loss and the issue may be a simple configuration change.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because System File Checker (sfc /scannow) repairs corrupted system files, not the boot configuration data (BCD) store; it operates on protected system files like DLLs and executables, not boot manager metadata. Option C is wrong because DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows image (component store) for servicing issues, such as corruption in the system files used by Windows Update, and does not interact with the BCD store or boot sector. Option D is wrong because Diskpart is a disk partitioning tool used to manage volumes and partitions (e.g., create, delete, format), not to repair boot configuration data; running a script with `diskpart /s script.txt` would execute partition commands, not fix the BCD.

Why this answer

How to eliminate wrong answers

Option A is wrong because diskpart is a disk partitioning tool used to manage volumes and partitions, not to repair boot configuration files. Option C is wrong because sfc /scannow scans and repairs protected system files, but it cannot fix boot manager or BCD issues when the system cannot boot. Option D is wrong because chkdsk /f checks and repairs file system integrity on a volume, but it does not address boot configuration corruption.

Why this answer

How to eliminate wrong answers

Option A is wrong because WEP (Wired Equivalent Privacy) uses a static RC4 encryption key that can be cracked in minutes with readily available tools, offering no real security. Option B is wrong because WPA2-TKIP (Temporal Key Integrity Protocol) is a legacy mode that is deprecated and vulnerable to attacks like MIC key recovery; it is not the strongest available standard. Option D is wrong because WPA2-Enterprise, while secure, requires a RADIUS authentication server and is not necessary for a law firm's mixed client environment where WPA3-Personal provides stronger encryption with simpler deployment.

Why this answer

How to eliminate wrong answers

Option A is wrong because Screen Sharing enables remote desktop access (VNC protocol), not file sharing, and would not allow the folder to appear as a network drive on Windows. Option C is wrong because Internet Sharing allows the Mac to share its internet connection with other devices (e.g., via NAT or bridging), not to share files as a network drive. Option D is wrong because Remote Login enables SSH access for command-line connections, not SMB-based file sharing, and Windows cannot natively mount a folder via SSH as a network drive.

Why this answer

How to eliminate wrong answers

Option A is wrong because the change was logged in the change management log as 'completed', which implies a change request was submitted and processed; the issue is not the absence of a request but the lack of validation after implementation. Option B is wrong because CAB approval is typically required for high-risk or significant changes, but the email server change was already approved and implemented; the skipped step is the verification of success, not the approval itself. Option D is wrong because while a rollback plan is important for reverting a failed change, the problem here is that the change was not fully tested and its impact was not assessed post-implementation; a documented rollback plan would not have prevented the intermittent service if the root cause was not identified during testing.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because providing the password immediately without verification would violate security policies and could lead to a data breach by enabling an attacker. Option C is wrong because IT security teams may legitimately call about updates, especially during a breach, so ignoring the call could delay a critical response. Option D is wrong because changing the password and giving the new one still discloses credentials to an unverified caller, which does not mitigate the social engineering risk.

Why this answer

How to eliminate wrong answers

Option A is wrong because a quick format only clears the file system metadata (e.g., MFT or FAT) and does not overwrite the actual data sectors, leaving all client data recoverable with simple file recovery tools. Option B is wrong because a degausser uses a strong magnetic field to demagnetize the platters, which destroys the drive's ability to store data permanently, making the laptop non-functional for the next lessee. Option D is wrong because physically shredding the hard drive destroys the hardware entirely, which violates the requirement that the laptop remain functional for the next lessee.

Why this answer

How to eliminate wrong answers

Option A is wrong because port 443 is typically used for HTTPS or SSL/TLS-based VPNs (e.g., OpenVPN, SSTP), and if the home router were blocking it, the VPN client would fail to establish any connection at all, not just fail to reach the file server. Option C is wrong because a powered-off or failed file server would affect all users, not just a remote VPN user, and the user can access the internet, indicating the VPN tunnel itself is up. Option D is wrong because outdated VPN client software would typically cause connection failures or authentication errors, not a selective inability to reach a specific internal resource while internet access works.

Why this answer

How to eliminate wrong answers

Option A is wrong because Disk Management is used for partitioning, formatting, and managing drive letters, not for cleaning temporary files or system caches. Option B is wrong because Defragment and Optimize Drives (dfrgui.exe) reorganizes file fragments on a drive to improve performance but does not remove any files or free up space. Option D is wrong because Storage Spaces is a storage virtualization feature that pools physical drives into logical storage pools, and it does not provide a cleanup interface for temporary files or previous Windows installations.

Why this answer

How to eliminate wrong answers

Option A is wrong because UDP ports 500 and 4500 are used for IPsec IKE traffic, and the user can already ping the VPN server, so firewall rules are not the immediate cause of an authentication error. Option C is wrong because reinstalling the VPN client software would not resolve an authentication error that occurs after credentials are entered; the client is functioning enough to reach the server. Option D is wrong because changing the encryption protocol would not fix an authentication error; it would only alter how data is secured after authentication succeeds.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a biometric fingerprint reader authenticates the user at login, but does not prevent the laptop from being physically taken from the desk; it only controls logical access after power-on. Option B is wrong because requiring a smart card to log in controls authentication, not physical theft; the laptop can still be stolen regardless of login requirements. Option D is wrong because full-disk encryption protects data confidentiality if the laptop is stolen, but does not prevent the theft itself; it is a data protection control, not a physical security control.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling split tunneling would allow internet-bound traffic to bypass the VPN, directly contradicting the requirement to always use the VPN for internet access. Option C is wrong because PPTP is an outdated and insecure protocol; the question asks about a security setting to force traffic through the VPN, not about the protocol choice. Option D is wrong because setting the VPN to connect only when accessing internal websites would not force all internet traffic through the VPN; it would only trigger the VPN for internal resource requests, leaving other internet traffic unprotected.

Why this answer

How to eliminate wrong answers

Option A is wrong because spear phishing is a highly targeted attack that uses personalized information (e.g., the recipient's name, job title, or specific account details) to increase credibility, whereas this email lacks any such personalization and contains generic errors. Option C is wrong because whaling is a specific form of spear phishing that targets high-profile executives or individuals with authority, not a general user receiving a mass email. Option D is wrong because vishing (voice phishing) is conducted over voice calls or VoIP, not via email with a clickable link.

Why this answer

How to eliminate wrong answers

Option B is wrong because downloading an app from a third-party website and opening it in Safari is not a supported installation method on iOS; iOS does not allow direct installation from arbitrary websites without enterprise distribution certificates or jailbreaking. Option C is wrong because emailing an app file (.ipa) to users does not work on iOS; the operating system blocks installation of apps from email attachments due to security restrictions. Option D is wrong because iOS does not have a general 'sideloading' toggle in Settings; sideloading via iTunes is limited to free Apple Developer accounts with a 7-day expiry and requires the app to be signed, making it impractical for permanent deployment to five company-owned iPads.

Why this answer

How to eliminate wrong answers

Option A is wrong because `nslookup example.com` queries an external DNS server directly, bypassing the local cache, and does not clear the cache. Option C is wrong because `netstat -r` displays the IP routing table, not DNS cache information. Option D is wrong because `ping -a 192.168.1.1` performs a reverse DNS lookup to resolve an IP address to a hostname, but it does not clear the DNS cache.

Why this answer

How to eliminate wrong answers

Option A is wrong because uninstalling the antivirus immediately removes security protection without confirming it is the cause, and the slowness could stem from a different issue like a pending update or driver conflict. Option B is wrong because it dismisses the user's frustration and is factually incorrect—modern antivirus programs can be tuned (e.g., excluding scheduled scans during peak usage, adjusting real-time protection settings) to minimize performance impact. Option D is wrong because remotely accessing the computer without first explaining the action and obtaining consent violates professional conduct and the user's privacy; the technician should first ask questions to narrow down the problem before taking invasive steps.

Why this answer

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan while the computer is still connected to the network allows active malware to continue communicating with its C2 server, potentially downloading more malicious code or exfiltrating data during the scan. Option C is wrong because rebooting into Safe Mode does not immediately stop network-based threats; the malware may still have network access in Safe Mode with networking, and the reboot itself could trigger destructive payloads. Option D is wrong because restoring from a recent backup should only be performed after confirming the backup is clean and the current infection is contained; doing it first risks reinfecting the system from the backup or missing active malware still on the network.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a quick format only clears the file system metadata (e.g., the partition table and directory structure) and does not overwrite the actual data on the drives, leaving the data recoverable with data recovery software. Option B is wrong because overwriting with zeros using a low-level format is a logical overwrite that may not reach all sectors on modern drives with internal remapping (e.g., G-List sectors), and it is less effective than degaussing for ensuring unrecoverability, especially against advanced recovery techniques. Option D is wrong because physically destroying drives with a hammer is not the most secure method—it can leave platter fragments from which data might be recovered using specialized equipment, and it is less reliable than degaussing for complete magnetic erasure.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because reinstalling the operating system is an extreme, time-consuming step that should only be taken after all other remediation methods have failed, and it does not address the root cause of the infection. Option C is wrong because disabling Windows Defender permanently would remove a critical layer of real-time protection, leaving the system vulnerable to further infections and violating best practices for security. Option D is wrong because clearing browser cache and cookies only removes temporary web data and cannot eliminate adware or malware that is running as a background process or service on the system.

Why this answer

How to eliminate wrong answers

Option B is wrong because Startup Repair is a more automated tool that attempts to fix common boot issues, but it may not specifically rebuild the BCD or repair the MBR in all cases, and it often fails when the BCD is severely corrupted or missing. Option C is wrong because 'sfc /scannow' (System File Checker) scans and repairs protected system files, but it does not repair the boot manager, MBR, or BCD store, which are the root cause of the 'Bootmgr is missing' error. Option D is wrong because System Restore reverts system files, settings, and registry to a previous restore point, but it does not repair the boot manager or BCD; if the boot configuration is corrupted, System Restore may not even run successfully without a functional boot loader.

Why this answer

How to eliminate wrong answers

Option B is wrong because performing a full system restore from a backup is a reactive, data-loss-prone step that should only be used after less invasive repairs fail; it does not diagnose the specific boot file corruption. Option C is wrong because Disk Cleanup only removes temporary files and does not repair system files or boot configuration, making it irrelevant to boot loops. Option D is wrong because reinstalling Windows via 'Reset this PC' is a last-resort destructive recovery that wipes applications and settings, and is not the first tool to use for boot file corruption.

Why this answer

How to eliminate wrong answers

Option A is wrong because a rootkit is designed to hide its presence and other malware from the operating system by modifying kernel-level functions, not to capture keystrokes or screenshots. Option B is wrong because a worm is a self-replicating malware that spreads across networks without user interaction, focusing on propagation rather than data theft via keystroke logging. Option D is wrong because ransomware encrypts files or locks the system to demand a ransom, and it does not typically exfiltrate keystrokes or screenshots to a remote server.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'goto :eof' is used to jump to the end of the current batch file, but it does not exit a subroutine that was called; it simply transfers control, which may not stop execution of the sub-script if there are more commands after the label. Option C is wrong because removing the 'exit' command entirely would leave the sub-script to continue executing any subsequent commands, potentially causing unintended behavior or an infinite loop. Option D is wrong because 'endlocal' only ends local variable scope set by 'setlocal'; it does not affect the termination behavior of the 'exit' command and does not prevent the parent batch from being terminated.

Why this answer

How to eliminate wrong answers

Option A is wrong because `/passive` displays a progress bar and only minimizes user interaction, not eliminating it entirely; the installation is not fully silent. Option C is wrong because `/qb` shows a basic progress dialog (a basic UI), which still requires user interaction and does not meet the silent requirement. Option D is wrong because `/l* log.txt` only enables verbose logging to a file; it does not control the installation's user interface or silence it, so the installer would run with its default UI.