104 free CompTIA A+ 220-1202 practice questions from the CertStash pack of 414, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 104 free here, all 414 in the pack, and each step includes the one before it.
Get all 414 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A technician needs to provide remote support for a legacy Linux-based operating system from their Windows laptop. The solution needs to allow the technician to see what the user is doing and provide the ability to interact with the user's session. Which of the following remote access technologies would support the use case?
Show answer and explanation
Correct answer: B. VNC
VNC (Virtual Network Computing) is the correct choice because it provides remote desktop access with GUI interaction capabilities, allowing the technician to see the user's screen and control the session. VNC works cross-platform, making it ideal for connecting from Windows to Linux systems. While SSH provides secure remote access, it is command-line only and does not provide the visual interaction required. VPN only encrypts network traffic but does not provide remote desktop capabilities. RDP is Windows-specific and would not natively support legacy Linux systems.
Why the other options are wrong
- A. VPN only provides encrypted network connectivity, not remote desktop or session interaction.
- C. SSH provides command-line access only, not the GUI visual interaction and control needed.
- D. RDP is designed for Windows systems and does not natively support Linux operating systems.
Question 2
A network technician notices that most of the company's network switches are now end-of-life and need to be upgraded. Which of the following should the technician do first?
Show answer and explanation
Correct answer: C. Propose the change.
Proposing the change is the first step in proper change management procedures. Before any approval, scheduling, or implementation can occur, the technician must formally propose the change to document the need, scope, and justification for upgrading the end-of-life switches. This establishes the change request that will then go through approval and scheduling workflows.
Why the other options are wrong
- A. Implementation cannot occur first; changes must be proposed, approved, and scheduled before implementation.
- B. Approval comes after the change has been proposed and documented.
- D. Scheduling occurs after the change is proposed and approved, not before.
Question 3
MFA for a custom web application on a user's smartphone is no longer working. The last time the user remembered it working was before taking a vacation to another country. Which of the following should the technician do first?
Show answer and explanation
Correct answer: A. Verify the date and time settings.
Verifying the date and time settings is the correct first step because MFA systems, particularly time-based authentication methods like TOTP, are highly sensitive to device time synchronization. When the user traveled to another country, their device may have retained the original timezone or incorrect time, causing MFA tokens to become invalid. This is a simple check that often resolves authentication issues before attempting more complex troubleshooting steps.
Why the other options are wrong
- B. Mobile OS patches may help but are not the first troubleshooting step for a time-sensitive MFA issue.
- C. Reinstalling the application is premature without checking basic time synchronization first.
- D. Escalation to the developer should occur only after basic troubleshooting steps have been exhausted.
Question 4
Which of the following is found in an MSDS sheet for a battery backup?
Show answer and explanation
Correct answer: B. Emergency procedures
An MSDS (Material Safety Data Sheet) sheet contains emergency procedures, which is critical information for hazardous materials like batteries. MSDS sheets are designed to provide safety information including hazard identification, first-aid measures, and emergency procedures. This is essential for battery backups due to their potentially hazardous chemical contents. Installation instructions, configuration steps, and voltage specifications are technical product information typically found in user manuals or technical documentation, not MSDS sheets.
Why the other options are wrong
- A. Installation instructions are found in user manuals or product documentation, not MSDS sheets.
- C. Configuration steps are technical specifications found in product guides, not MSDS sheets.
- D. Voltage specifications are electrical specifications found in technical datasheets, not MSDS sheets.
Question 5
The screen of a previously working computer repeatedly displays an OS Not Found error message when the computer is started. Only a USB drive, a keyboard, and a mouse are plugged into the computer. Which of the following should a technician do first?
Show answer and explanation
Correct answer: C. Check boot options.
Checking boot options is the first step when encountering an 'OS Not Found' error. The computer may be configured to boot from the wrong device or in the wrong order. With only a USB drive, keyboard, and mouse connected, the system might be attempting to boot from a device that no longer contains a valid OS. Checking and correcting the boot order in BIOS/UEFI is the quickest troubleshooting step before attempting data recovery, disk partitioning, or firmware changes.
Why the other options are wrong
- A. Data recovery tools are a last resort and should not be attempted first when basic boot configuration may be the issue.
- B. Repartitioning the disk would be destructive and should only be considered after confirming boot configuration issues.
- D. Switching UEFI to BIOS is not a first troubleshooting step and may not be necessary if boot options are correctly configured.
Question 6
A security administrator teaches all of an organization's staff members to use BitLocker To Go. Which of the following best describes the reason for this training?
Show answer and explanation
Correct answer: A. To ensure that all removable media is password protected in case of loss or theft
BitLocker To Go is specifically designed to encrypt removable media such as USB drives and external hard drives. Training staff on this tool ensures that if removable media is lost or stolen, the data remains protected through encryption. This addresses the critical security need of protecting sensitive data that leaves the organization. BitLocker To Go creates password-protected encrypted volumes on portable devices to prevent unauthorized access in case of loss or theft.
Why the other options are wrong
- B. Secure Boot and BIOS-level passwords are system-level security features, not the purpose of BitLocker To Go training.
- C. BitLocker To Go does not enforce VPN connectivity or involve hardware encryption modules for VPN.
- D. BitLocker To Go can work with TPM but is not specifically designed to configure laptop hard drives; it is primarily for removable media.
Question 7
Which of the following is used to detect and record access to restricted areas?
Show answer and explanation
Correct answer: B. Video surveillance
Video surveillance is the primary technology used to detect and record access to restricted areas. Security cameras provide continuous monitoring and recording of who enters and exits restricted zones, creating an audit trail of access events. This technology serves both as a deterrent and as evidence in security incidents. While badge readers control access, they do not detect or record visual access. Bollards and fences are physical barriers that prevent access but do not provide detection or recording capabilities.
Why the other options are wrong
- A. Bollards are physical barriers that prevent vehicle access but do not detect or record access attempts.
- C. Badge readers control access permissions but do not inherently detect or record visual access to areas.
- D. Fences are physical perimeter barriers that prevent access but do not detect or record unauthorized access attempts.
Question 8
An administrator received an email stating that the OS they are currently supporting will no longer be issued security updates and patches. Which of the following is most likely the reason the administrator received this message?
Show answer and explanation
Correct answer: B. The OS will be considered end of life.
When an operating system no longer receives security updates and patches, it has reached end of life status. End of life means the manufacturer is ceasing support and no longer issuing updates, security patches, or technical support for that OS version. This is an official lifecycle stage that indicates the OS version is aging out of support. While support expiration is related, the specific message about no longer issuing security updates directly indicates the OS has transitioned to end of life status.
Why the other options are wrong
- A. While related, 'support expiring' is less precise than 'end of life' which specifically refers to cessation of all updates and patches.
- C. Removal of built-in security software is a feature change, not the reason for ceasing security updates to the entire OS.
- D. A new OS version release is independent of the current OS reaching end of life, though they may occur around the same time.
Question 9
Which of the following is the best way to distribute custom images to 800 devices that include four device vendor classes with two types of user groups?
Show answer and explanation
Correct answer: D. Use a network-based remote installation tool.
For distributing custom images to 800 devices across multiple vendor classes and user groups, a network-based remote installation tool (such as Windows Deployment Services, SCCM, or similar solutions) is the most efficient and scalable approach. It allows centralized management, supports multiple device types, and can be configured with different profiles for different user groups without manual intervention on each device.
Why the other options are wrong
- A. xcopy is a file-copying utility designed for small-scale transfers, not bulk OS image deployment to hundreds of devices.
- B. robocopy is a file synchronization tool, not an imaging solution, and would not efficiently deploy complete OS images across 800 devices.
- C. Using a local tool on each device would be extremely time-consuming and impractical for 800 devices and would lack centralized control.
Question 10
Which of the following types of social engineering attacks sends an unsolicited text message to a user's mobile device?
Show answer and explanation
Correct answer: D. Smishing
Smishing is the specific term for SMS phishing, sending malicious or deceptive text messages to mobile devices to trick users into clicking links or providing information. It combines 'SMS' and 'phishing' and is the direct answer to unsolicited text message attacks.
Why the other options are wrong
- A. Impersonation is a general social engineering technique but does not specifically describe text message attacks.
- B. Vishing is voice phishing conducted through phone calls, not text messages.
- C. Spear phishing typically refers to targeted email attacks, not SMS-based attacks.
What people say about the full 220-1202 pack 4.9 from 10
Went through this and passed. If you are sitting this exam, get this dump. Passed all the certs I used this for! I study best by doing practice questions and this dump is exactly that. Closely aligned with the actual exam. Highly recommend for the 1202.
Passed and very happy! Studied through the dump on my phone. Simple and effective resource, highly recommend.
Passed my 1202! Solid dump. A lot came out in my exam including some performance based questions. For the price this is excellent.
Question 11
A technician is setting up a surveillance system for a customer. The customer wants access to the system's web interface on the LAN via the system’s IP address. Which of the following should the technician use to prevent external log-in attempts from the internet?
Show answer and explanation
Correct answer: A. Port mapping
Port mapping (or port forwarding) controls which ports are accessible from external networks. By not mapping the surveillance system's web interface port to the internet-facing router, external login attempts are prevented while the system remains accessible locally on the LAN via the internal IP address.
Why the other options are wrong
- B. Subnetting divides networks into segments but doesn't inherently prevent external access unless combined with firewall rules; it doesn't block internet login attempts.
- C. A static IP ensures consistent addressing but doesn't prevent external login attempts or restrict access from the internet.
- D. Content filtering controls the type of traffic allowed but is not the primary mechanism for preventing external access to a specific internal service.
Question 12
Which of the following is a Linux command that is used for administrative purposes?
Show answer and explanation
Correct answer: D. su
The 'su' command (substitute user) is the standard Linux administrative command used to switch to another user account, most commonly to root/superuser, enabling administrative tasks. It is the Linux equivalent of elevation of privilege.
Why the other options are wrong
- A. runas is a Windows command, not Linux.
- B. cmcl is not a recognized standard Linux administrative command.
- C. net user is a Windows command for user account management, not a Linux command.
Question 13
Which of the following authentication methods is the best way to prevent users from frequently entering their credentials?
Show answer and explanation
Correct answer: B. Single sign-on
Single sign-on (SSO) allows users to authenticate once and gain access to multiple systems and resources without re-entering credentials. This directly addresses the goal of preventing frequent credential entry while maintaining security. Once authenticated to the SSO system, users access applications seamlessly.
Why the other options are wrong
- A. Access control lists define permissions but do not reduce credential entry frequency.
- C. Multifactor authentication increases security but requires additional authentication steps, actually increasing credential-related interactions.
- D. One-time passwords still require users to enter credentials each time, defeating the goal of reducing frequent entry.
Question 14
A user is renaming a .txt file to a .xml file. After renaming the file. Windows Explorer shows the filename as Document.xml. However, the document properties shows the type of file as: Text Document(.txt). Which of the following controls enables the user to correctly change the file type?
Show answer and explanation
Correct answer: D. Hide extensions
The issue is that file extensions are hidden by default in Windows Explorer. When extensions are hidden, renaming 'Document.txt' to 'Document.xml' appears to work in Explorer, but the file remains a .txt file internally because the full extension wasn't visible or changed. Disabling 'Hide extensions' in folder options reveals the true filename and allows proper extension modification.
Why the other options are wrong
- A. Indexing options controls search functionality, not file type display.
- B. There is no standard 'Format command' for changing file types in this context.
- C. Personalization settings control desktop appearance, not file extension visibility.
Question 15
A technician is 3-D printing high strength, carbon fiber-based filament parts for a customer order. Which of the following is the most important for the technician to use?
Show answer and explanation
Correct answer: B. Air filter mask
When 3D printing with carbon fiber-based filaments, the process generates fine particulate matter and potentially toxic fumes that can be inhaled. An air filter mask is the most critical safety equipment to protect the technician's respiratory system from these harmful particles and emissions.
Why the other options are wrong
- A. Steel-toed boots protect against dropped heavy objects but are not the primary concern for 3D printing operations.
- C. An ESD mat prevents static discharge damage to electronics; it is not relevant to the respiratory hazards of 3D printing.
- D. Antistatic bags protect components from static damage during storage and transport, not from inhalation hazards during printing.
Question 16
A user has been adding data to the same spreadsheet for several years. After adding a significant amount of data, they are now unable to open the file. Which of the following should a technician do to resolve the issue?
Show answer and explanation
Correct answer: B. Increase the amount of RAM.
Large spreadsheets with years of accumulated data consume significant memory. When the file becomes too large for available RAM, the spreadsheet application cannot load or process it. Increasing RAM allows the application to allocate sufficient memory to open and work with the large file.
Why the other options are wrong
- A. Reverting to a restore point would lose all the data the user has added, which is not an appropriate solution.
- C. Defragmentation affects file storage fragmentation but not memory availability for opening large applications.
- D. Network connection speed has no impact on a local application's ability to open a file stored on the user's computer.
Question 17
Which of the following is the most secure method of preventing someone from accessing a cell phone?
Show answer and explanation
Correct answer: C. Passphrase
A passphrase is the most secure method for protecting a cell phone because it combines multiple words into a longer, more complex authentication factor. Passphrases are resistant to brute-force attacks due to their length and entropy, and they are more secure than PINs (limited to numeric characters), swipe patterns (which can be observed and have limited variations), or simple patterns (which are visually vulnerable and have predictable sequences).
Why the other options are wrong
- A. PINs, while better than nothing, use only numeric characters and have limited entropy compared to passphrases.
- B. Swipe patterns are easily compromised through observation and have a limited number of possible combinations.
- D. Patterns are visually vulnerable, can be guessed through observation of finger movement, and offer fewer combinations than passphrases.
Question 18
A user receives a push notification to approve or deny a log-in request when using MFA. Which of the following describes this security measure?
Show answer and explanation
Correct answer: C. Authenticator application
An authenticator application is a mobile app that generates push notifications for login approval as part of MFA. When a user attempts to log in, the authenticator app sends a push notification asking the user to approve or deny the request, confirming their identity through a second factor of authentication.
Why the other options are wrong
- A. One-time passwords are typically numeric codes generated or sent separately, not push notifications requiring approval/denial actions.
- B. Zero Trust model is a security architecture framework, not a specific MFA mechanism involving push notifications.
- D. Privileged access management controls access to administrative resources but is not the mechanism that sends push notifications for login approval.
Question 19
A company is implementing the 3-2-1 backup rule. Which of the following should the company do?
Show answer and explanation
Correct answer: D. Use at least two different types of media.
The 3-2-1 backup rule specifies: 3 copies of data, 2 different storage media types, and 1 offsite location. Therefore, using at least two different types of media (D) directly implements one of the core requirements of this rule. Full and differential backups relate to backup strategy but not the 3-2-1 rule specifically. Testing integrity every three weeks is a best practice but not part of the 3-2-1 rule definition. Keeping all backups on site violates the requirement for an offsite copy.
Why the other options are wrong
- A. While full and differential backups are common strategies, they describe backup methodology rather than implementing the 3-2-1 rule itself.
- B. Testing backup integrity is a best practice but is not a requirement of the 3-2-1 backup rule.
- C. Keeping all backup media on site contradicts the 3-2-1 rule requirement of maintaining at least one copy offsite for disaster recovery.
Question 20
A computer frequently crashes after an OS patch. Which of the following actions should a technician take to prevent further crashes and look into the issue?
Show answer and explanation
Correct answer: B. Roll back the updates.
When crashes begin immediately after an OS patch, the most direct corrective action is to roll back those updates. This removes the problematic code that introduced the instability and restores the previous stable state. Rolling back is the standard first troubleshooting step before attempting more complex solutions.
Why the other options are wrong
- A. System Restore might work but is less direct than simply rolling back the specific problematic updates.
- C. Applying optional patches would add more code on top of an already broken patch, likely worsening the situation.
- D. Changing startup sequence does not address the root cause introduced by the patch itself.
Question 21
A customer’s computer does not have an active connection to the network. A technician goes through a few troubleshooting steps but is unable to resolve the issue. The technician has exhausted their knowledge. The customer expresses frustration at the time taken to resolve this issue. Which of the following should the technician do?
Show answer and explanation
Correct answer: A. Escalate the issue to a senior team member and provide next steps to the customer.
When a technician has exhausted their troubleshooting knowledge and the customer is frustrated, the professional response is to escalate the issue to a senior team member who may have additional expertise, while providing the customer with clear next steps and expectations. This demonstrates competence, respect for the customer's time, and a commitment to resolution.
Why the other options are wrong
- B. Dismissing the customer and rescheduling is disrespectful and leaves the issue unresolved.
- C. Interrupting the customer and making excuses worsens their frustration rather than addressing it constructively.
- D. While maintaining a positive attitude is good, continuing to ask questions when knowledge is exhausted wastes time and further frustrates the customer.
Question 22
A user calls the help desk to report potential malware on a computer. The anomalous activity began after the user clicked a link to a free gift card in a recent email. The technician asks the user to describe any unusual activity, such as slow performance, excessive pop-ups, and browser redirections. Which of the following should the technician do next?
Show answer and explanation
Correct answer: D. Instruct the user to disconnect the Ethernet connection to the corporate network.
Disconnecting the Ethernet connection to the corporate network is the critical first step to prevent potential malware from spreading to other systems. In a suspected malware situation, isolating the infected machine from the network is essential to protect corporate infrastructure and other users. This containment step should occur before remediation attempts, preventing lateral movement or data exfiltration.
Why the other options are wrong
- A. Running an anti-malware scan is a remediation step that should occur after isolation to prevent network spread.
- B. Rebooting to safe mode is a diagnostic step, but isolation from the network takes priority in incident response.
- C. Checking recently installed applications is helpful for investigation but should occur after the machine is isolated from the network.
Question 23
Which of the following is used in addition to a password to implement MFA?
Show answer and explanation
Correct answer: A. Sending a code to the user's phone
Multi-Factor Authentication requires two or more distinct verification methods. Sending a code to the user's phone (such as via SMS or authenticator app) is a common second factor used in addition to a password, providing authentication based on something the user has (their phone).
Why the other options are wrong
- B. Verifying date of birth is static information that users have and is not truly a separate authentication factor from a password.
- C. Solving a math problem is still something the user knows and doesn't constitute a separate factor from a password.
- D. A PIN is also something the user knows, which is the same category as a password and doesn't add a separate authentication factor.
Question 24
Which of the following is an example of an application publisher including undisclosed additional software in an installation package?
Show answer and explanation
Correct answer: C. Potentially unwanted program
A Potentially Unwanted Program (PUP) is software bundled into installation packages without clear disclosure or user consent. Publishers often include PUPs like toolbars, adware, or tracking software alongside legitimate applications, which is the definition of undisclosed additional software bundled in an installation package.
Why the other options are wrong
- A. A virus is malicious code that replicates and damages systems, not specifically software bundled within installation packages by publishers.
- B. Ransomware encrypts files for extortion; it's not characterized by being bundled as additional software in legitimate installation packages.
- D. A Trojan is malicious software disguised as legitimate, but the term doesn't specifically describe undisclosed bundled software in installation packages like PUPs do.
Question 25
A help desk team was alerted that a company-owned cell phone has an unrecognized password-cracking application. Which of the following should the help desk team do to prevent further unauthorized installations from occurring?
Show answer and explanation
Correct answer: D. Deploy MDM.
Mobile Device Management (MDM) solutions are specifically designed to manage, monitor, and secure company-owned mobile devices. MDM enforces security policies, restricts unauthorized app installations, manages permissions, and can remotely wipe devices, making it the appropriate solution to prevent future unauthorized installations on company cell phones.
Why the other options are wrong
- A. Group Policy is a Windows domain management tool and cannot manage iOS or Android mobile devices effectively.
- B. PAM (Privileged Access Management) controls administrative access to systems, not app installations on mobile devices.
- C. While anti-malware software helps detect threats, MDM is the comprehensive solution that prevents unauthorized installations through policy enforcement.
Question 26
A technician is working on a complex, large-scale software deployment. In which of the following places would the technician most likely reference deployment instructions?
Show answer and explanation
Correct answer: D. Internal wiki
An internal wiki is the most appropriate place for complex, large-scale software deployment instructions. A wiki provides centralized, version-controlled, searchable documentation that can be easily updated and accessed by multiple technicians throughout the deployment process.
Why the other options are wrong
- A. A file server stores data files but is not the optimal location for organized, searchable deployment documentation.
- B. A user's desktop is not an appropriate location for shared deployment instructions that multiple technicians need to access.
- C. Email is not suitable for complex deployment instructions as it lacks version control, searchability, and centralized access.
Question 27
A user recently installed an application that accesses a database from a local server. When launching the application, it does not populate any information. Which of the following command-line tools is the best to troubleshoot the issue?
Show answer and explanation
Correct answer: C. netstat
netstat is the best tool to troubleshoot database connectivity issues. It displays active network connections, listening ports, and connection states, allowing the technician to verify whether the application is successfully establishing a connection to the local database server on the expected port.
Why the other options are wrong
- A. ipconfig displays IP configuration but does not show active connections or whether the application can reach the database server.
- B. nslookup is for DNS resolution; it would not help if the database server is accessed by IP or if DNS is not the issue.
- D. curl is a data transfer tool primarily for HTTP/HTTPS requests; it would not diagnose database connection issues on local servers.
Question 28
A user receives a notification indicating the antivirus protection on a company laptop is out of date. A technician is able to ping the user’s laptop. The technician checks the antivirus parent servers and sees the latest signatures have been installed. The technician then checks the user's laptop and finds the antivirus engine and definitions are current. Which of the following has most likely occurred?
Show answer and explanation
Correct answer: C. Adware
Adware is the most likely culprit when a user receives antivirus notifications but the actual antivirus engine and definitions are current on both the laptop and parent servers. This is a classic symptom of adware or potentially a rogue/fake antivirus application displaying false alerts to trick users. Ransomware would encrypt files; failed OS updates would cause system instability; and missing system files would prevent the system from functioning normally.
Why the other options are wrong
- A. Ransomware would encrypt files and cause data loss, not just alert notifications.
- B. Failed OS updates would cause broader system issues beyond antivirus notifications.
- D. Missing system files would prevent normal system operation, not generate false alerts.
Question 29
Which of the following file types would a desktop support technician most likely use to automate tasks for a Windows user log-in?
Show answer and explanation
Correct answer: A. .bat
Batch files (.bat) are the standard Windows native scripting format for automating tasks during user logon. They execute in the Windows command prompt and are commonly used in logon scripts, startup sequences, and scheduled tasks. While other languages can automate Windows tasks, .bat is the most direct and commonly deployed solution for Windows logon automation.
Why the other options are wrong
- B. .sh files are shell scripts for Unix/Linux systems, not Windows.
- C. .py files require Python interpreter installation and are not Windows-native.
- D. .js files are JavaScript, typically for web browsers or Node.js, not standard Windows logon automation.
Question 30
After new device software for a webcam is installed, a Windows PC is experiencing BSOD. The BSOD occurs during a videoconference call. Which of the following should the technician do next?
Show answer and explanation
Correct answer: C. Start in safe mode and roll back the device driver.
A BSOD occurring specifically during videoconference calls after new webcam driver installation indicates the driver is the culprit. The appropriate response is to boot into safe mode (to avoid driver loading) and roll back the problematic driver to the previous stable version. This directly addresses the root cause without unnecessary scanning or hardware reconnection.
Why the other options are wrong
- A. Malware scanning is unnecessary when the BSOD correlates directly with a specific driver installation.
- B. Filing a warranty claim skips all troubleshooting steps and is premature.
- D. Reconnecting the hardware does nothing to fix the faulty driver software.
Question 31
A technician installs VPN client software that has a software bug from the vendor. After the vendor releases an update to the software, the technician attempts to reinstall the software but keeps getting an error message that the network adapter for the VPN already exists. Which of the following should the technician do next to mitigate this issue?
Show answer and explanation
Correct answer: D. Delete hidden network adapters.
When VPN software reinstallation fails due to an existing network adapter error, the issue is typically caused by remnants of the previous installation, including hidden network adapters that weren't properly removed. Deleting these hidden adapters clears the conflict, allowing the new software to install successfully without the adapter already exists error.
Why the other options are wrong
- A. OS security updates do not address residual VPN adapter configurations from previous installations.
- B. Mapping the network adapter to new software is not a standard troubleshooting step and doesn't resolve adapter conflicts.
- C. Network adapter firmware updates are not relevant to resolving software installation conflicts caused by leftover adapter configurations.
Question 32
A user reports that their corporate mobile phone is lost. Which of the following protects the data locally on the phone from unauthorized access?
Show answer and explanation
Correct answer: C. Remote wipe
Remote wipe is a security feature that allows authorized users to erase all data on a lost or stolen mobile device remotely, protecting sensitive information from unauthorized access. When a phone is lost, remote wipe ensures that even if someone gains physical access to the device, the data cannot be accessed because it has been completely removed from the device's storage.
Why the other options are wrong
- A. Password manager stores and manages passwords but does not protect data from physical access to a lost device.
- B. Degaussing is a technique for erasing magnetic media and is not applicable to modern mobile phones or their local data protection.
- D. Antivirus protects against malware but cannot prevent unauthorized access to data on a lost phone without additional protections like remote wipe.
Question 33
A user created a document using online collaboration tools, and the document is not available on their laptop now. Which of the following should a desktop technician do to remediate the issue?
Show answer and explanation
Correct answer: A. Synchronize the remote folder with the user's laptop.
Online collaboration tools like OneDrive, Google Drive, or SharePoint store documents in the cloud and synchronize them to local devices. The document is not available on the laptop because synchronization has not been configured or is disabled. Setting up synchronization of the remote folder with the user's laptop will download and make the document available locally.
Why the other options are wrong
- B. Manually downloading and sending via instant messaging is inefficient and does not address the underlying synchronization issue.
- C. Word processing tools may already be installed; the issue is synchronization of the cloud-stored document, not software availability.
- D. Wi-Fi connectivity may be a prerequisite for initial setup but is not the primary remediation for synchronization configuration.
Question 34
A team member provides a link to an online slide deck presentation so other team members can add to the presentation. The link does not work for any of the other team members. Which of the following should the team check first?
Show answer and explanation
Correct answer: C. Viewing and sharing permissions
When a shared link doesn't work for other team members, the first thing to check is viewing and sharing permissions. The link creator may not have configured proper access permissions for other users, which is the most common reason shared links fail. This should be verified before investigating other potential causes like browser compatibility or version history.
Why the other options are wrong
- A. Version history is irrelevant to link access issues.
- B. Browser compatibility would affect all users similarly or show error pages, not prevent access entirely.
- D. License management would not typically prevent a user from accessing a shared presentation link.
Question 35
A company executive is currently attending a major music festival with a large number of attendees and is having trouble accessing a work email account. The email application is not downloading emails and also appears to become stuck during connection attempts. Which of the following is most likely causing the disruption?
Show answer and explanation
Correct answer: C. Too many devices in the same area are trying to connect to the mobile network.
At a large music festival with thousands of attendees, the mobile network is likely congested with too many devices attempting to connect simultaneously. This causes connection timeouts, failed downloads, and stuck connection attempts, exactly the symptoms described. Network congestion is a common issue in high-density areas.
Why the other options are wrong
- A. While storage space issues can prevent email downloads, they would not cause the application to become stuck during connection attempts.
- B. Corporate firewalls typically block internal/VPN access from unknown networks, but would not cause the specific stuck connection behavior at a festival venue.
- D. If the internet signal were completely blocked, the application would fail immediately rather than appear to get stuck during connection attempts.
Question 36
A user reports that their internally hosted CRM application splash screen attempts to load, pauses for a few seconds, and then disappears. A technician installs the application software on their computer and is able to recreate the issue. When checking the application logs, the technician sees the following: Windows could not start the CRM Service on Local Computer 10169. The service did not start due to a log-on failure. Which of the following would most likely cause this issue?
Show answer and explanation
Correct answer: D. The LDAP service account used by the service is disabled.
The error message 'The service did not start due to a log-on failure' indicates that the CRM Service cannot authenticate using its configured service account credentials. If the LDAP service account used by the service is disabled, the service will fail to start because it cannot log on. This matches the exact error reported and explains why the application splash screen appears then disappears.
Why the other options are wrong
- A. An incorrect user password would affect the user's ability to log in to the system, not the CRM Service startup.
- B. Insufficient bandwidth would cause slow loading or timeout errors, not a service startup failure with logon error.
- C. VLAN blocking would prevent network communication but would manifest differently; the service startup itself would fail, and the error would be network-related.
- E. Hardware specifications would cause runtime errors or poor performance, not a logon failure during service startup.
Question 37
A customer's laptop will not turn on. The customer is distraught and panicking because the laptop contains family pictures that can never be replaced. Which of the following communication techniques is most important for the technician to demonstrate in this situation?
Show answer and explanation
Correct answer: C. The technician should project confidence and maintain a positive attitude.
When a customer is distraught and panicking about irreplaceable data loss, the technician's primary responsibility is to project confidence and maintain a positive attitude. This demonstrates competence, reassures the customer, and establishes the foundation for effective problem-solving. Emotional support through confident demeanor is the most critical communication technique in high-stress situations.
Why the other options are wrong
- A. Providing an SLA agreement, while sometimes necessary, does not address the immediate emotional concern and may seem dismissive.
- B. Informing about costly replacement options before attempting recovery is premature and may increase the customer's distress.
- D. Professional attire helps but is secondary to demonstrating emotional intelligence and confidence through verbal communication and demeanor.
Question 38
A customer is upgrading their workstation from Windows 10 to Windows 11. They perform a clean installation from a USB drive. After the system restarts, the installer loads again. Which of the following should the user do to complete the installation?
Show answer and explanation
Correct answer: D. Remove the USB drive.
When the Windows 11 installer restarts and loads again from the USB drive, it indicates the boot order has not changed or the USB drive is still the primary boot device. The user must remove the USB drive before the restart so the system boots from the internal drive where Windows 11 was installed, allowing the installation to complete normally.
Why the other options are wrong
- A. Running chkdsk from USB does not resolve the boot loop caused by the USB remaining in the boot sequence.
- B. TPM is a requirement for Windows 11 and disabling it would cause installation failure, not resolution.
- C. The system may already be using UEFI or changing this during installation completion is not the issue; the USB drive presence is the problem.
Question 39
A technician needs to map a shared drive from a command-line interface. Which of the following commands should the technician use?
Show answer and explanation
Correct answer: C. net use
The 'net use' command is the standard Windows command-line tool for mapping network drives and shared resources. It allows technicians to establish persistent or temporary connections to shared folders on remote servers from a command-line interface.
Why the other options are wrong
- A. Pathping tests network connectivity and routing but does not map network drives.
- B. Nslookup performs DNS name resolution lookups and does not map network drives.
- D. Tracert traces the route packets take to a destination but does not map network drives.
Question 40
Which of the following filesystems supports read and write operations for Windows, macOS, and Linux?
Show answer and explanation
Correct answer: A. exFAT
exFAT is the only filesystem that provides full read and write support across Windows, macOS, and Linux operating systems. It was specifically designed as a universal format for external storage devices and cross-platform compatibility.
Why the other options are wrong
- B. ReFS (Resilient File System) is proprietary to Windows and is not supported natively by macOS or Linux.
- C. NTFS is the Windows standard filesystem; while Linux can read/write NTFS with additional drivers, macOS has only read support.
- D. APFS (Apple File System) is proprietary to macOS and does not have native support in Windows or Linux.
- E. ext4 is the Linux standard filesystem and is not natively supported by Windows or macOS without additional software.
Question 41
Which of the following commands can a technician use to view the contents of a single file on a Linux terminal?
Show answer and explanation
Correct answer: B. cat
The cat (concatenate) command is the standard Linux utility for displaying the contents of a text file to the terminal. When given a filename as an argument, it outputs the entire file contents to standard output.
Why the other options are wrong
- A. chmod is used to change file permissions, not to view file contents.
- C. ls lists files and directories in a directory, not the contents of a single file.
- D. sudo is a command prefix that runs commands with elevated privileges; it does not view file contents by itself.
Question 42
Which of the following controls access to certain services to ensure that administrators are not automatically given elevated permissions?
Show answer and explanation
Correct answer: A. PAM
PAM (Privileged Access Management) controls and restricts elevated permissions for administrators by requiring separate authentication, approval workflows, and session monitoring. It ensures that administrators do not automatically receive elevated permissions but must explicitly request and justify access, creating accountability and reducing the risk of privilege abuse.
Why the other options are wrong
- B. MFA provides stronger authentication but does not control the assignment of elevated permissions.
- C. DLP (Data Loss Prevention) monitors and prevents unauthorized data exfiltration, not privilege escalation.
- D. SSO (Single Sign-On) simplifies authentication across multiple services but does not restrict elevated permission assignment.
Question 43
A company recently transitioned to a cloud-based productivity suite and wants to secure the environment from external threat actors. Which of the following is the most effective method?
Show answer and explanation
Correct answer: A. Multifactor authentication
Multifactor authentication (MFA) is the most effective method for securing cloud-based environments against external threat actors. MFA requires users to provide multiple forms of verification, making it extremely difficult for attackers to gain unauthorized access even if they obtain passwords, thereby protecting accounts from credential-based attacks.
Why the other options are wrong
- B. Encryption protects data confidentiality but does not prevent unauthorized access to accounts themselves.
- C. Backups provide data recovery capabilities but do not prevent external threat actors from accessing the system.
- D. Strong passwords alone are insufficient protection; they can still be compromised through phishing, brute force, or credential breaches.
Question 44
A technician must map a network drive on a piece of legacy equipment running an end-of-life OS. Which of the following is the best script to map the drive using simple Windows commands?
Show answer and explanation
Correct answer: B. Batch
Batch files (.bat) are the standard simple Windows scripting method for legacy systems and end-of-life operating systems. Batch scripts use simple DOS-style commands and are universally compatible with all Windows versions, including older systems. The 'net use' command is the standard batch command for mapping network drives.
Why the other options are wrong
- A. Shell scripts are primarily Unix/Linux tools and are not standard for Windows systems.
- C. VB (Visual Basic) requires more complex setup and runtime environments; it is not the simplest approach for legacy Windows systems.
- D. Java requires a runtime environment and is not a native Windows scripting solution for legacy systems.
Question 45
A help desk technician is using a local network server for image deployment. Which of following should the technician use to connect a workstation to the server and begin downloading the image?
Show answer and explanation
Correct answer: A. PXE
PXE (Preboot Execution Environment) is the standard protocol for booting workstations over a network and connecting to deployment servers to download system images. It allows a computer to boot from the network and begin the imaging process without requiring pre-installed OS or manual media. SFTP is for file transfer, SAN is storage infrastructure, and USB requires physical media.
Why the other options are wrong
- B. SFTP is a file transfer protocol but not the primary technology for network-based image deployment.
- C. SAN is a storage area network technology, not a boot or deployment protocol.
- D. USB deployment requires physical media and manual intervention, not network connectivity.
Question 46
A user's application only works with a legacy version of the OS. The OS is reaching its end of life date. For security reasons, the company is migrating to the current version of the OS. Which of the following is the most efficient way to complete the migration while maintaining accessibility to the application?
Show answer and explanation
Correct answer: D. Virtualization
Virtualization is the most efficient approach because it allows the legacy OS to run as a virtual machine on the new current OS, maintaining full application compatibility while keeping the host system secure and current. This avoids the complexity and inefficiency of other options while ensuring the application remains functional.
Why the other options are wrong
- A. Terminal server would work but requires additional infrastructure and ongoing licensing, less efficient than virtualization.
- B. Bare-metal server is an entirely separate physical machine, which is expensive and not scalable.
- C. Multiboot requires the user to reboot between operating systems, creating a cumbersome workflow and maintenance challenges.
Question 47
A technician is preparing to replace the batteries in rack-mounted UPS system. After ensuring the power is turned off and the batteries are fully discharged, the technician needs to remove the battery modules from the bottom of the rack. Which of the following steps should the technician take?
Show answer and explanation
Correct answer: B. Use appropriate lifting techniques and guidelines.
When replacing heavy batteries from a rack-mounted UPS system, the technician must prioritize safety by using appropriate lifting techniques and guidelines to prevent back injury or dropping batteries. This is a critical safety requirement when handling heavy components at the bottom of a rack.
Why the other options are wrong
- A. Fire suppression systems are not relevant to battery replacement procedures when power is off and batteries are discharged.
- C. While antistatic bags protect electronics from static discharge, batteries are not sensitive to static electricity and this is not the priority safety concern.
- D. A face mask is not necessary when batteries are fully discharged; harmful fumes are not a concern in this scenario.
Question 48
A technician is helping to create a desktop backup policy for the company. The requirements include ensuring that the backups work as intended and recovery is possible. Which of the following routine tasks should the technician include in the policy to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: C, F. Backup testing; Full backup
Backup testing verifies that backups work as intended and can be successfully recovered, directly meeting the stated requirements. Full backups are essential as part of a backup strategy to ensure complete data protection and successful recovery. Together, these address both verification of backup functionality and the ability to perform actual recovery operations.
Why the other options are wrong
- A. Incremental backup alone does not ensure complete backup verification or recovery capability.
- B. Backup reconfiguration is maintenance but does not test functionality or ensure recovery works.
- D. Differential backup is a backup method but does not itself test or verify backup functionality.
- E. Purging old backups is data retention management and does not verify backup functionality or recovery capability.
Question 49
A technician needs to change hibernation settings on a Windows computer by applying a batch file. Domain policies are unavailable. Which of the following is the best way to achieve this goal?
Show answer and explanation
Correct answer: D. Use the powercfg command in PowerShell.
The powercfg command is the proper utility for managing power settings including hibernation from the command line and can be executed in a batch file or PowerShell script. Since domain policies are unavailable, using powercfg directly is the best approach to configure hibernation settings programmatically without relying on Group Policy.
Why the other options are wrong
- A. Control Panel Power Options is a GUI tool, not suitable for batch file automation.
- B. Firmware updates are not the method for changing hibernation settings.
- C. gpupdate applies Group Policy, but the question states domain policies are unavailable.
Question 50
An application's performance is degrading over time. The application is slowing, but it never gives an error and does not crash. Which of the following tools should a technician use to start troubleshooting?
Show answer and explanation
Correct answer: C. Resource monitor
Resource Monitor provides real-time visibility into CPU, memory, disk, and network usage by individual processes and applications. When an application is slowing without errors or crashes, Resource Monitor is the best tool to identify which system resources are being consumed excessively, guiding further investigation.
Why the other options are wrong
- A. Reliability history shows system crashes and warnings but not real-time resource consumption or gradual performance degradation without errors.
- B. Computer Management is a general administration tool useful for services and processes but does not provide detailed real-time resource monitoring.
- D. Disk defragmentation is a maintenance operation and not a diagnostic tool; it also assumes the issue is disk-related without investigation.
Question 51
A help desk technician needs to remove RAM from retired workstations and upgrade other workstations that have applications that use more memory with this RAM. Which of the following actions would the technician most likely take?
Show answer and explanation
Correct answer: B. Use antistatic bags for storage and transport.
When removing and reusing RAM from retired workstations, the technician must protect the memory modules from electrostatic discharge (ESD) damage during storage and transport. Antistatic bags are the industry standard for this purpose, preventing static electricity from damaging the sensitive electronic components on the RAM modules.
Why the other options are wrong
- A. Demagnetization is not a security procedure for RAM and would not protect the memory modules.
- C. Grounding workstations via power supply is unnecessary for RAM removal and does not protect the memory modules themselves.
- D. Installing memory in identical pairs is a best practice for some systems but is not the primary action when initially removing and storing RAM.
Question 52
A user reports getting a BSOD error on their computer at least twice a day. Which of the following should the technician use to determine the cause?
Show answer and explanation
Correct answer: A. Event Viewer
Event Viewer is the Windows system tool that logs detailed information about system errors, including Blue Screen of Death (BSOD) events. It records crash information, error codes, and system events that help technicians identify the underlying cause of recurring BSOD errors.
Why the other options are wrong
- B. Performance Monitor tracks system performance metrics but does not specifically record BSOD crash information.
- C. System Information displays hardware and software configuration details but does not log error events.
- D. Device Manager shows installed hardware and drivers but does not log system crash events or BSOD information.
Question 53
A user needs to install and uninstall software on their Windows laptop but does not need to manage user accounts. The company follows least-privilege principles. Which of the following account types meets these requirements?
Show answer and explanation
Correct answer: B. Power user
Power User accounts have sufficient privileges to install and uninstall software while maintaining least privilege principles, they have more permissions than standard users but fewer than administrators. This meets the requirement without granting unnecessary administrative access.
Why the other options are wrong
- A. Guest accounts have minimal privileges and cannot install software.
- C. Service accounts are for running services and background processes, not for user software installation.
- D. Administrator accounts provide full system access, violating the least privilege principle for this task.
Question 54
An end user's laptop is having network drive connectivity issues in the office. The end user submits a help desk ticket, and a support technician is able to establish a remote connection and fix the issue. The following day, however, the network drive is disconnected again. Which of the following should the technician do next?
Show answer and explanation
Correct answer: C. Escalate the ticket to the next level.
When an issue recurs immediately after resolution, it indicates a persistent underlying problem that requires deeper investigation beyond the initial fix. Escalation to a higher support level ensures the root cause is identified rather than applying temporary solutions repeatedly.
Why the other options are wrong
- A. Simply reconnecting remotely to verify current status does not address the recurring nature of the problem.
- B. Documentation for end-user self-service is inappropriate when a technical issue demonstrates a pattern requiring professional diagnosis.
- D. Keeping the ticket open without action and closing it arbitrarily does not resolve the recurring issue.
Question 55
A technician follows the proper procedure for malware removal on an infected computer. However, the technician is unable to remove all the malware and decides to reload the OS. Which of the following should the technician select?
Show answer and explanation
Correct answer: D. Clean install
A clean install completely reformats the hard drive and reinstalls the operating system from scratch, removing all malware and any persistent infections. This is the appropriate action when standard malware removal procedures fail, ensuring a completely clean system.
Why the other options are wrong
- A. Version upgrade updates the existing OS to a newer version while preserving files and settings, which would retain any malware.
- B. System restore reverts the system to a previous checkpoint but does not eliminate malware that may have been present at that checkpoint.
- C. OS repair attempts to fix existing OS issues without removing malware or completely wiping the drive.
Question 56
A user is unable to use the latest version of an application on a legacy, personal tablet. Which of the following is most likely the reason?
Show answer and explanation
Correct answer: A. The OS is end-of-life.
An end-of-life operating system cannot support newer application versions because developers stop providing backward compatibility. Legacy tablets running outdated OS versions lack the necessary APIs, security features, or system libraries required by modern applications. This is the most common and fundamental reason a legacy device cannot run the latest software.
Why the other options are wrong
- B. Storage space is a manageable issue that users can address by deleting files; it would not prevent installation if space were freed.
- C. MDM blocking is typically an enterprise control and less likely on a personal tablet without organizational management.
- D. Malware would generally not prevent application installation; users could still download and install apps even on an infected device.
Question 57
Which of the following file extensions are commonly used to install applications on a macOS machine? (Choose three.)
Show answer and explanation
Correct answer: B, D, G. .pkg; .dmg; .app
.pkg is a standard macOS installer package format, .dmg is a disk image file commonly used to distribute macOS applications, and .app is the macOS application bundle format. These three are the primary file extensions used for installing and running applications on macOS systems.
Why the other options are wrong
- A. .mac is not a standard macOS application format.
- C. .deb is the Debian/Linux package format, not used on macOS.
- E. .msi is the Windows installer format, not compatible with macOS.
- F. .appx is the Windows application package format, not used on macOS.
- H. .apk is the Android application format, not used on macOS.
Question 58
A technician is working on a user's computer. The technician wants to log in to the intranet on the computer without logging the current user out. Which of the following should the technician do?
Show answer and explanation
Correct answer: C. Use private browsing.
Private browsing mode allows the technician to access the intranet with different credentials without affecting the current user's login session. Private browsing maintains a separate, isolated session with independent cookies and authentication. Configuring a proxy server affects all connections, enabling pop-up blockers is unrelated to authentication, and clearing cache does not isolate sessions.
Why the other options are wrong
- A. Configuring a proxy server does not isolate browsing sessions or authentication.
- B. A pop-up blocker has no relationship to logging in separately or maintaining session isolation.
- D. Clearing the browser cache does not create an isolated session for separate authentication.
Question 59
An administrator must rename the administrator account on a Windows desktop. Which of the following tools is best for this task?
Show answer and explanation
Correct answer: A. lusrmgr.msc
lusrmgr.msc (Local Users and Groups Manager) is the correct MMC snap-in for managing local user accounts on a Windows system, including renaming the administrator account. devmgmt.msc manages devices, gpedit.msc handles group policy settings, and eventvwr.msc displays event logs, none of which are designed for user account management.
Why the other options are wrong
- B. devmgmt.msc is Device Manager, used for hardware device management, not user accounts.
- C. gpedit.msc is Group Policy Editor, used for applying policies, not renaming user accounts.
- D. eventvwr.msc is Event Viewer, used for viewing system logs, not managing user accounts.
Question 60
A customer asks a help desk technician for help in selecting new computers. The customer would like to avoid expensive licensing fees but would like all files to be kept locally. Which of the following operating systems should the technician recommend?
Show answer and explanation
Correct answer: A. Linux
Linux is a free, open-source operating system that eliminates expensive licensing fees while allowing all files to be stored and managed locally. It meets both requirements: no licensing costs and local file storage without cloud dependency.
Why the other options are wrong
- B. Chrome OS is designed around cloud storage and online services, not local file storage as a primary model.
- C. Windows requires paid licensing, which contradicts the requirement to avoid expensive licensing fees.
- D. macOS requires licensing through Apple hardware purchase and is not the most cost-effective solution.
Question 61
Which of the following methods involves requesting a user's approval via a push notification to verify the user's identity?
Show answer and explanation
Correct answer: B. Authenticator
An authenticator app (such as Microsoft Authenticator or Google Authenticator) is the method that specifically sends push notifications to a user's device requesting approval to verify identity. This is push-based notification authentication, distinct from other MFA methods.
Why the other options are wrong
- A. Call-based verification involves voice interaction, not push notifications.
- C. Hardware tokens typically generate time-based codes rather than sending push notifications for approval.
- D. SMS delivers codes or links via text message but does not use push notifications to the user's application.
Question 62
During a routine security audit, an employee's smartphone is flagged with several security alerts. The alerts indicate that there have been multiple failed login attempts and that an unverified application was recently downloaded. Which of the following actions should a technician take first on the employee's smartphone?
Show answer and explanation
Correct answer: C. Scan the smartphone for malware.
When a smartphone is flagged with security alerts including multiple failed login attempts and an unverified application download, the first action should be to scan for malware. This diagnostic step will identify whether malicious software is present and causing the alerts. Once the malware status is determined, further remediation steps (like OS reinstallation or reset) can be taken if necessary.
Why the other options are wrong
- A. Updating security settings is a preventive measure, but it does not address the existing threat or provide information about current compromise.
- B. Reinstalling the OS is a more drastic step that should occur after confirming malware presence; it's not the first diagnostic action.
- D. A remote reset should be a last resort after determining that malware is present and cannot be cleaned; it destroys all data and should not be the first response.
Question 63
A customer must access the contents of the AppData folder, which is in the local user profile. Which of the following should a technician configure so the customer can easily navigate to this location?
Show answer and explanation
Correct answer: B. File Explorer Options
File Explorer Options allows users to configure view settings, including the ability to show hidden files and folders like AppData, which is hidden by default on Windows systems. This is the control panel where file visibility and navigation preferences are managed.
Why the other options are wrong
- A. Indexing improves search functionality but does not control folder visibility in File Explorer.
- C. Privacy settings control data sharing and permissions but do not configure file visibility options.
- D. Ease of Access provides accessibility features for users with disabilities, not file navigation configuration.
Question 64
Which of the following threats is shoulder surfing an example of?
Show answer and explanation
Correct answer: C. Social engineering
Shoulder surfing is a classic example of social engineering, where an attacker obtains information by observing a user without their knowledge. This human-directed attack manipulates people rather than exploiting technical vulnerabilities.
Why the other options are wrong
- A. A zero-day is a software vulnerability, not a social engineering technique.
- B. An evil twin is a rogue access point, which is a network-based attack, not social engineering.
- D. Brute-force is an automated password attack technique, not a social engineering method.
Question 65
Various alerts on a user’s Windows 11 laptop are continually interrupting the user during videoconference calls. Which of the following should a support technician recommend to best solve the issue?
Show answer and explanation
Correct answer: D. Set Windows Notifications settings to Do Not Disturb.
Setting Windows Notifications to Do Not Disturb mode is the best solution because it suppresses all system and application alerts during a specified period, allowing uninterrupted videoconference calls while maintaining security and functionality. This is a built-in Windows 11 feature specifically designed for this scenario.
Why the other options are wrong
- A. Using multiple sound output devices does not prevent notifications from appearing and interrupting the user visually.
- B. Disabling notifications application-by-application is time-consuming and less efficient than using the built-in Do Not Disturb feature.
- C. Setting No Sounds in Control Panel only silences audio but does not prevent visual notification popups from interrupting the call.
Question 66
A help desk technician is setting up speech recognition on a Windows system. Which of the following settings should the technician use?
Show answer and explanation
Correct answer: D. Ease of Access
Speech recognition is an accessibility feature in Windows and is configured through the Ease of Access settings. This is where users can enable and configure speech recognition, voice commands, and other accessibility options designed to assist users with disabilities or accessibility needs.
Why the other options are wrong
- A. Time and Language settings control regional preferences, language packs, and input methods, not speech recognition.
- B. Personalization settings manage themes, colors, lock screen, and start menu appearance, not accessibility features.
- C. System settings cover general device information, storage, and power options, not speech recognition configuration.
Question 67
A user decides to switch to Windows from Linux and is trying to migrate data using an external USB hard disk. However, when the user connects the cable to the Windows machine, an error message appears stating the device must be formatted before it can be used. The hard disk works as expected when connected to the Linux machine. Which of the following should the user do to resolve this issue?
Show answer and explanation
Correct answer: D. Update the file allocation system to exFAT.
The external hard drive likely uses a Linux-native file system (such as ext4) that Windows cannot natively read or write to. Updating the file allocation system to exFAT, which is compatible with both Windows and Linux, will allow the Windows machine to recognize and use the drive without requiring formatting to a Windows-only file system.
Why the other options are wrong
- A. Windows firewall controls network traffic, not file system compatibility for external USB drives.
- B. The cable is not the issue since the drive works fine on Linux; the problem is file system compatibility.
- C. A firmware update from the PC manufacturer will not resolve a file system compatibility issue between operating systems.
Question 68
Which of the following should a technician consider when adding ten new high-end graphic design and animation desktops at a client site?
Show answer and explanation
Correct answer: D. The electrical circuit’s power consumption
When deploying ten new high-end graphic design and animation desktops, the electrical circuit's power consumption is a critical infrastructure consideration. High-end graphics workstations with powerful GPUs, processors, and multiple monitors draw substantial power; the technician must verify that the electrical circuit can handle this increased load without overloading or requiring upgrades.
Why the other options are wrong
- A. The local area's ambient temperature is important for HVAC planning but is not the primary technical consideration for the IT technician.
- B. Hazardous fumes are not typically associated with standard computer equipment deployment.
- C. Humidity levels are a facility management consideration, but power consumption is the more immediate and critical technical factor for this deployment.
Question 69
A small town’s clerk wants to work from home on a town-issued laptop. The clerk needs to be able to access documents on the town hall server. Which of the following solutions does a technician need to set up for the clerk?
Show answer and explanation
Correct answer: C. VPN
A VPN (Virtual Private Network) is the appropriate solution for securely connecting a remote home computer to a company network and accessing internal resources like file servers over the public internet. VNC and RDP are remote desktop protocols used for direct screen sharing rather than secure network access to file servers. SSH is for secure command-line access, not general file server access from a remote client.
Why the other options are wrong
- A. VNC is a remote desktop viewer that allows screen sharing but is not the proper solution for secure network connectivity to access file servers.
- B. RDP is a remote desktop protocol for interactive sessions but is not designed for general secure network connectivity to access shared resources.
- D. SSH is a secure shell protocol for command-line access and is not the typical solution for a non-technical user to access file servers.
Question 70
Which of the following is the best reason for a network engineering team to provide a help desk technician with IP addressing information to use on workstations being deployed in a secure network segment?
Show answer and explanation
Correct answer: C. DHCP services are not enabled for this subnet.
If DHCP services are not enabled for a subnet, workstations cannot automatically receive IP addresses and must be manually configured with static IP addressing information provided by the network engineering team. This is the primary reason to provide specific IP addressing details for secure network segment deployments.
Why the other options are wrong
- A. DNS server restrictions relate to outbound access policies, not the core reason for providing IP addressing information to help desk technicians.
- B. Network allow lists typically work with configured addresses regardless of how those addresses were obtained, not the primary reason for manual IP assignment.
- D. NAC server security update policies are unrelated to the need for manual IP addressing configuration.
Question 71
After clicking on an advertisement, a user reports that their browser is slow. A technician looks at the network connections for the machine and notices a large number of outbound connections. Which of the following actions should the technician take next?
Show answer and explanation
Correct answer: D. Quarantine the system.
When a user reports slow browser performance after clicking an advertisement and shows suspicious outbound connections, this indicates a potential malware infection. The immediate appropriate action is to quarantine the system to prevent further spread and data exfiltration while investigation occurs. This protects the network before running scans or other remediation steps.
Why the other options are wrong
- A. Enabling the firewall alone does not address an already-infected system and won't stop malware already running on the device.
- B. Running antivirus scans should occur after quarantine to prevent the malware from spreading to other systems during the scan process.
- C. Rebooting may temporarily disrupt the malicious activity but does not address the underlying infection and may allow it to persist.
Question 72
A technician is troubleshooting an issue in which a service runs momentarily and stops at certain points in the process. The technician needs to determine the root cause of this issue. Which of the following tools should the technician use?
Show answer and explanation
Correct answer: A. Event Viewer
Event Viewer is the primary Windows tool for diagnosing service failures and interruptions. It logs detailed information about services stopping unexpectedly, including error codes and timestamps that help identify the root cause of why a service stops at certain points in its execution.
Why the other options are wrong
- B. Task Manager shows running processes and performance but doesn't provide the detailed diagnostic logs needed to understand why a service fails at specific points.
- C. Internet Options configures browser settings and has no relevance to troubleshooting service failures.
- D. Process Explorer shows process details and relationships but lacks the historical event logging necessary to determine why a service stops intermittently.
Question 73
An organization is creating a new application. As part of the deployment, the roles and responsibilities for supporting the application need to be documented. Which of the following is designed to contain this information?
Show answer and explanation
Correct answer: A. SOP
A Standard Operating Procedure (SOP) is designed to document roles, responsibilities, and procedures for supporting applications and services. An SOP provides detailed step-by-step instructions and accountability assignments for personnel involved in application support and maintenance.
Why the other options are wrong
- B. An NDA (Non-Disclosure Agreement) is a legal contract about confidentiality, not operational procedures or roles.
- C. DRM (Digital Rights Management) refers to technology protecting intellectual property, not organizational documentation.
- D. A EULA (End User License Agreement) is a software license agreement, not an internal documentation of support roles.
Question 74
An administrator is investigating a technical outage. The management team wants information that includes the summary of the outage and actions taken. Which of the following documentation should the administrator provide to the management team?
Show answer and explanation
Correct answer: C. Incident report
An incident report is the appropriate documentation that summarizes what happened during a technical outage, the impact, and the actions taken to resolve it. This is exactly what management needs to understand the scope and resolution of the incident.
Why the other options are wrong
- A. A knowledge base article is typically used for ongoing reference and troubleshooting guides, not for reporting specific incidents to management.
- B. A non-disclosure agreement is a legal document for protecting confidential information, not for documenting outage details.
- D. A standard operating procedure outlines how to perform routine tasks, not how to report completed incidents.
Question 75
A technician thinks a computer is not receiving some settings from the corporate domain. Which of the following tools should the technician use to gather more relevant information?
Show answer and explanation
Correct answer: C. gpresult
The gpresult tool displays Group Policy information applied to a computer and user, including which policies have been applied, which have failed, and why. This is the direct tool for diagnosing domain policy application issues. It provides detailed information about Group Policy processing and is specifically designed for this troubleshooting scenario.
Why the other options are wrong
- A. chkdsk checks disk integrity and file system errors, unrelated to domain policy application.
- B. systeminfo provides general system information but does not show Group Policy application details.
- D. nslookup is used for DNS name resolution testing, not for troubleshooting Group Policy settings.
Question 76
A small office reported a phishing attack that resulted in a malware infection. A technician is investigating the incident and has verified the following: All endpoints are updated and have the newest EDR signatures. Logs confirm that the malware was quarantined by EDR on one system. The potentially infected machine was reimaged. Which of the following actions should the technician take next?
Show answer and explanation
Correct answer: B. Discuss the cause of the issue and educate the end user about security hygiene.
After verifying that the technical controls (EDR, patching) are working properly and the infected machine has been remediated, the next critical step is to educate the user about the root cause (phishing in this case) and proper security hygiene. This addresses the human vulnerability that allowed the attack to succeed in the first place and prevents recurrence.
Why the other options are wrong
- A. Network security tools are not the next step when EDR already caught the malware; the issue was user susceptibility to phishing, not file download capability.
- C. Firmware flashing is unnecessary and does not address the phishing vulnerability that caused the incident.
- D. More advanced security software is not needed when current controls (EDR with latest signatures) already successfully quarantined the threat.
Question 77
A technician recently installed a program that uses several anti-piracy technologies. When the program is launched, it briefly opens and then closes. Which of the following is most likely the reason?
Show answer and explanation
Correct answer: D. USB key not plugged in
Anti-piracy technologies often require hardware dongles (USB keys) to verify legitimate software licenses. When the USB key is not present, the program cannot authenticate and immediately closes. This is a common protection mechanism that prevents unauthorized use rather than a system compatibility or driver issue.
Why the other options are wrong
- A. 32-bit programs run fine on 64-bit systems with compatibility mode; they don't instantly close silently.
- B. CPU incompatibility would cause crashes or errors, not a quick silent closure on launch.
- C. Outdated video drivers would cause display issues or crashes during use, not immediate program termination.
Question 78
When a user navigates to comptiaa.org, pop-up messages indicate that the computer is infected with adware. A technician scans the computer for malware and does not find an infection. Which of the following should the technician do before returning the computer to the user?
Show answer and explanation
Correct answer: A. Clear the browser's cached data and recent history.
Clearing the browser's cached data and recent history is the appropriate step when pop-up messages appear but no malware is detected. This indicates a browser-based issue such as malicious cached content or misleading advertisements, which is resolved by clearing browser data before returning the computer to the user.
Why the other options are wrong
- B. Signing into the company's cloud workspace is unrelated to removing browser-based pop-up messages and would not address the issue.
- C. Installing corporate DNS security software is a preventative measure but is not necessary before returning the computer when the issue is localized to the browser.
- D. Enabling private mode does not resolve existing cached malicious content and would not address past infections.
Question 79
A customer is unable to open some files on their system. Each time the customer attempts to open a file, the customer receives a message that the file is encrypted. Which of the following best describes this issue?
Show answer and explanation
Correct answer: B. Ransomware
Ransomware specifically encrypts user files and displays messages demanding payment or action to decrypt them. This is the defining characteristic of ransomware attacks. The scenario directly describes encrypted files with system messages, which is the hallmark ransomware behavior.
Why the other options are wrong
- A. Keyloggers record keystroke input; they do not encrypt files or display messages about encryption.
- C. Phishing is a social engineering attack via email or messages; it does not encrypt files on the system.
- D. Cryptominers use system resources to mine cryptocurrency but do not encrypt user files or generate encryption-related messages.
Question 80
Technicians are failing to document user contact information, device asset tags, and a clear description of each issue in the ticketing system. Which of the following should a help desk management team implement for technicians to use on every call?
Show answer and explanation
Correct answer: C. Standard operating procedures
Standard operating procedures (SOPs) establish consistent, documented guidelines and checklists that technicians must follow on every call. SOPs specifically address documentation requirements such as contact information, asset tags, and issue descriptions, ensuring consistency across all help desk interactions.
Why the other options are wrong
- A. Service-level agreements define response and resolution time targets but do not establish documentation procedures or requirements.
- B. Call categories are classification systems for organizing ticket types but do not mandate specific documentation fields or processes.
- D. Knowledge base articles provide solutions and reference information but do not establish documentation standards or requirements for technicians.
Question 81
A secretary receives an email from the company's chief executive officer with a request to pay a vendor immediately. After the payment is made, the chief executive officer tells the secretary that they never sent that email. Which of the following social engineering tactics best describes this type of attack?
Show answer and explanation
Correct answer: B. Impersonation
This attack involves someone impersonating the CEO through email to trick the secretary into taking action. The attacker assumed the identity of a trusted executive without targeting based on specific research. Impersonation is the broad term for assuming someone else's identity to gain trust and manipulate actions.
Why the other options are wrong
- A. Evil twin refers to a rogue wireless network, not email-based identity spoofing.
- C. Whaling is a spear phishing variant targeting high-value targets like executives, but here the secretary is being tricked into helping the attacker, not the executive being targeted.
- D. Spear phishing involves researched targeting of specific individuals with personalized attacks; this is simpler impersonation without evidence of detailed reconnaissance.
Question 82
A support technician receives a computer with a non-responsive touch pad. The touch pad does not appear to be physically damaged. Which of the following tools should the technician use to check the touch pad driver?
Show answer and explanation
Correct answer: B. Device Manager
Device Manager is the correct tool to check and troubleshoot hardware drivers in Windows. It allows technicians to view installed drivers, check for errors, update drivers, or reinstall them. Since the touchpad has no physical damage, a driver issue is the likely cause, and Device Manager is the standard Windows utility for managing device drivers.
Why the other options are wrong
- A. System Configuration is used to manage startup programs and services, not device drivers.
- C. Event Viewer logs system events and errors but is not the primary tool for checking device drivers.
- D. Local Users and Groups manages user accounts and permissions, not hardware drivers.
Question 83
A technician is setting up a Windows server to allow remote desktop connections for multiple users. Which of the following should the technician configure on the workstation?
Show answer and explanation
Correct answer: A. Firewall
To enable Remote Desktop connections, the technician must configure the Windows Firewall to allow inbound Remote Desktop Protocol (RDP) traffic on port 3389. Without firewall configuration, the firewall will block incoming RDP connection attempts, preventing remote users from accessing the server.
Why the other options are wrong
- B. Computer Management is used for system administration tasks but Remote Desktop is enabled through firewall rules and system settings, not Computer Management.
- C. User Accounts may need to be configured for permissions, but the primary configuration for Remote Desktop connectivity is firewall-related.
- D. Ease of Access provides accessibility features but is not involved in configuring Remote Desktop connections.
Question 84
Performance on a user's smartphone is degrading. Applications take a long time to start, and switching between windows also takes a long time. Which of the following diagnostic steps should a mobile technician take first?
Show answer and explanation
Correct answer: B. Restart the phone.
Restarting the phone is the first and most basic troubleshooting step for performance issues. A restart clears temporary memory, stops background processes, and often resolves sluggishness caused by software glitches or memory leaks. This should always precede more drastic measures like factory reset or uninstalling applications.
Why the other options are wrong
- A. Factory reset is too drastic as a first step and will erase all user data; it should only be attempted after simpler solutions fail.
- C. While battery state could affect performance, checking it is less likely to resolve the described application launching delays compared to a restart.
- D. Uninstalling applications is a valid troubleshooting step but should follow a restart, which may resolve the issue without data loss.
Question 85
A support specialist needs to decide whether to install a 32-bit or 64-bit OS architecture on a new computer. Which of the following specifications will help the specialist determine which OS architecture to use?
Show answer and explanation
Correct answer: A. 16GB RAM
16GB of RAM is the key specification for determining OS architecture. 64-bit operating systems can address and utilize significantly more RAM than 32-bit systems (which are limited to 4GB). With 16GB of RAM, a 64-bit architecture is necessary. The CPU, storage, and network specifications do not directly determine which architecture to use.
Why the other options are wrong
- B. Both 32-bit and 64-bit OS can run on an Intel i7 CPU; the CPU alone does not determine architecture choice.
- C. Storage capacity does not determine whether to use 32-bit or 64-bit architecture.
- D. Network speed does not influence the choice between 32-bit and 64-bit operating systems.
Question 86
A technician notices that the weekly backup is taking too long to complete. The daily backups are incremental. Which of the following would most likely resolve the issue?
Show answer and explanation
Correct answer: D. Running synthetic full weekly backups
Synthetic full backups create a complete backup image by combining the previous full backup with all incremental backups, without requiring a full re-scan of source data. This process is faster than a traditional full backup while maintaining the efficiency of incremental daily backups, making it the best solution for reducing lengthy weekly backup windows.
Why the other options are wrong
- A. Changing the backup window only shifts when the backup runs; it does not address the underlying performance issue.
- B. Performing incremental weekly backups would reduce backup size but increases complexity in recovery and does not address restoration speed.
- C. Increasing backup storage capacity does not reduce the time required for the backup process to complete.
Question 87
A technician is helping a remote user. The technician asks the user to open a specific folder on the root directory of the computer. The user cannot find a folder with that name. The technician explains that a few settings are needed to allow the folder to appear. Which of the following should the user do to be able to see the folder? (Choose two.)
Show answer and explanation
Correct answer: B, F. Open File Explorer; Check the box to view hidden files.
To view hidden folders in Windows, a user must open File Explorer and configure the view settings to display hidden files and folders. Option B (Open File Explorer) is necessary to access the folder view, and option F (Check the box to view hidden files) enables the visibility of hidden system folders that are not shown by default.
Why the other options are wrong
- A. Display properties control monitor resolution and appearance, not file visibility in File Explorer.
- C. Root drive properties do not provide an interface for changing file visibility settings.
- D. System settings is too vague and does not specifically address file visibility configuration in File Explorer.
- E. View extensions relate to showing file extensions (.txt, .exe, etc.), not displaying hidden files and folders.
Question 88
The battery on a user’s smartphone discharges quickly when the user travels. The smartphone was replaced two weeks ago. Which of the following should a technician do first?
Show answer and explanation
Correct answer: D. Look for applications that are reporting the highest utilization.
When a newly replaced smartphone experiences rapid battery drain, the first diagnostic step should be to identify software causing excessive resource utilization, as this is a common cause of accelerated battery depletion. Only after ruling out software issues should hardware solutions like replacing the battery or port inspection be considered. Providing an external battery is a workaround, not a root cause diagnosis.
Why the other options are wrong
- A. Replacing the battery assumes a hardware defect without first investigating software causes, and a new device's battery should not require immediate replacement.
- B. Providing an external battery addresses symptoms without identifying the underlying cause of rapid discharge.
- C. While the charging port could be faulty, software-related battery drain is far more common and should be investigated first on a newly replaced device.
Question 89
Which of the following describes an attack in which an attacker sets up a rogue AP that tricks users into connecting to the rogue AP instead of the legitimate network?
Show answer and explanation
Correct answer: B. Evil twin
An evil twin is a rogue access point that mimics a legitimate wireless network's SSID and characteristics to trick users into connecting. Attackers use this technique to intercept traffic or perform man-in-the-middle attacks. The name 'evil twin' directly describes this impersonation attack method.
Why the other options are wrong
- A. Stalkerware is surveillance software installed on a device, not a network attack.
- C. Tailgating involves physical access exploitation, not wireless network impersonation.
- D. Shoulder surfing is observing someone's screen or keyboard, not a wireless attack.
Question 90
A user is unable to log in to the network. The network uses 802.1X with EAP-TLS to authenticate on the wired network. The user has been on an extended leave and has not logged in to the computer in several months. Which of the following is causing the login issue?
Show answer and explanation
Correct answer: A. Expired certificate
In 802.1X with EAP-TLS authentication, the client certificate is essential for network access. After several months of leave, the user's certificate has likely expired. EAP-TLS requires a valid client certificate to complete the authentication handshake; an expired certificate will cause authentication failure. This is the most common cause of login issues in certificate-based 802.1X environments after extended periods of inactivity.
Why the other options are wrong
- B. OS updates would affect system functionality broadly, not specifically certificate-based authentication.
- C. The 802.1X supplicant service would need to be configured, but the primary issue is the expired certificate.
- D. Application crashes would cause different symptoms; 802.1X failure occurs at the authentication layer.
- E. Profile rebuild is not necessary if the certificate is simply expired; renewing or obtaining a new certificate resolves the issue.
Question 91
An end user discovers a virus on their computer. A technician quarantines the computer, scans for viruses, and remediates the infection. Which of the following is the next step the technician should take?
Show answer and explanation
Correct answer: B. Educate the end user.
After quarantining, scanning, and remediating a virus infection, the technician should educate the end user about how the infection occurred and what practices to follow to prevent future infections. This prevents recurrence and improves overall security awareness.
Why the other options are wrong
- A. While a secondary scan may be performed, user education is the more critical next step to prevent future infections.
- C. Reimaging is generally not necessary if the virus has been successfully quarantined and remediated.
- D. Reviewing system logs may be useful for investigation, but educating the user is the priority to prevent future incidents.
Question 92
A technician needs to configure settings for password complexity and failed log-in attempts before a user is locked out. These settings cannot be changed by standard users. Which of the following MMC snap-ins should the technician use?
Show answer and explanation
Correct answer: D. gpsdit
The Group Policy Editor (gpedit.msc, referenced as gpsdit) is the MMC snap-in used to configure password complexity requirements and account lockout policies. These are domain/local security policies that standard users cannot modify. The Group Policy Editor allows administrators to set password rules and lockout thresholds at the system level.
Why the other options are wrong
- A. taskschd (Task Scheduler) manages automated tasks and scheduled jobs, not password or lockout policies.
- B. lusrmgr (Local Users and Groups) manages user accounts but does not configure password complexity or lockout policies at the system level.
- C. perfmon (Performance Monitor) tracks system performance metrics, not security policies.
Question 93
Which of the following prevents forced entry into a building?
Show answer and explanation
Correct answer: D. Bollard
A bollard is a physical barrier (typically a post or pillar) that prevents vehicles and people from forcibly entering a building by blocking entry points. It provides active physical obstruction against forced entry. The other options provide detection or access control but not actual physical prevention of forced entry.
Why the other options are wrong
- A. PIV cards provide logical access control for authorized personnel but do not prevent forced physical entry.
- B. Motion-activated lighting is a deterrent and detection tool but does not prevent actual forced entry.
- C. Video surveillance records entry but does not prevent someone from forcibly entering the building.
Question 94
Which of the following grants a user the minimum level of permissions necessary to perform duties?
Show answer and explanation
Correct answer: A. Least privilege
Least privilege is the security principle that grants users only the minimum permissions necessary to perform their job duties. This reduces exposure to unauthorized actions and limits potential damage from compromised accounts. Zero Trust is a broader security framework; SSO (Single Sign-On) is an authentication method; and MFA (Multi-Factor Authentication) is an additional authentication layer, none define the principle of minimal necessary permissions.
Why the other options are wrong
- B. Zero Trust is a comprehensive security architecture, not a permissions principle.
- C. SSO is an authentication convenience feature, not a permissions concept.
- D. MFA is an authentication security layer, not a permissions principle.
Question 95
A Windows 11 Home device is receiving constant pop-ups about an urgent need to update antivirus software in order to remove a detected threat. The user has been clicking the "X" button in the window frame, but it always reappears. The pop-up includes an "OK" button to install the update and remove the threat. Which of the following should the user do next?
Show answer and explanation
Correct answer: D. Verify the current status and settings of protection measures.
The recurring pop-ups characteristic of a scareware attack, which uses fake threats to trick users into downloading malware. The user should not click OK (which installs malicious software) or trust the pop-up message. Instead, they should verify the actual status of their antivirus and security settings through the Windows Security or Control Panel to determine if a real threat exists. This allows them to distinguish between genuine alerts and scareware attacks.
Why the other options are wrong
- A. Clicking OK likely installs malware or unwanted software; scareware attacks trick users into this exact action.
- B. Reinstalling Windows is premature without first determining if a genuine threat exists or if this is a scareware attack.
- C. System File Checker addresses system file corruption, not the scareware pop-up issue or potential malware threats.
Question 96
Which of the following is used to store passwords in macOS?
Show answer and explanation
Correct answer: B. Keychain
Keychain is macOS's native password management and credential storage system. It securely stores passwords, encryption keys, certificates, and other sensitive authentication information. Users can access stored credentials without re-entering them, and applications can retrieve credentials from Keychain with user permission.
Why the other options are wrong
- A. FileVault is macOS's full-disk encryption feature, not a password storage mechanism.
- C. Accessibility is a system feature for accessibility settings and assistive technology, not credential storage.
- D. Mission Control is a window and workspace management feature in macOS, unrelated to password storage.
Question 97
A malicious actor uses multiple endpoints that are spread across multiple locations to target a single endpoint. Which of the following describes this threat?
Show answer and explanation
Correct answer: D. Distributed denial of service
A distributed denial of service (DDoS) attack occurs when multiple endpoints from different locations attack a single target simultaneously. This distributed nature is the defining characteristic that distinguishes it from other attack types.
Why the other options are wrong
- A. An on-path attack intercepts communications between two parties, not a multi-source attack on a single endpoint.
- B. SQL injection exploits database vulnerabilities through input manipulation, not a multi-endpoint attack.
- C. A brute-force attack attempts to guess credentials through repeated attempts, typically from fewer sources and not distributed across multiple locations.
Question 98
A technician is reviewing an organization's current incident management policy. The organization uses a third-party vendor to protect the organization's assets with multiple tools. Which of the following service types is the organization using?
Show answer and explanation
Correct answer: C. MDR
MDR (Managed Detection and Response) is a service where a third-party vendor monitors, detects, and responds to security threats on behalf of an organization using multiple security tools. This matches the description of using a third-party vendor with multiple tools to protect the organization's assets.
Why the other options are wrong
- A. PaaS (Platform as a Service) is a cloud computing model for developing applications, not for threat detection and response.
- B. EDR (Endpoint Detection and Response) is a tool/product for endpoint security, not a managed service type provided by vendors.
- D. XDR (Extended Detection and Response) is an advanced detection platform but is typically a product rather than a managed service model as described.
Question 99
A user wants to dispose of a failed hard drive in a way that ensures the data is unrecoverable. Which of the following is the best at-home method?
Show answer and explanation
Correct answer: E. Drilling
Drilling through a hard drive destroys the physical platters and read/write heads, making data recovery impossible even with specialized equipment. This is the most practical at-home method that provides absolute certainty of data destruction for a failed drive.
Why the other options are wrong
- A. Standard formatting does not prevent forensic recovery of data from the drive.
- B. Low-level formatting can be reversed or bypassed with specialized recovery tools.
- C. Shredding requires industrial equipment and is impractical for at-home use.
- D. Degaussing requires specialized equipment and modern hard drives with encryption may still retain recoverable data.
Question 100
When a corporate laptop is connected to the company network, the laptop is able to reach external websites. However, when the laptop tries to reach any internal websites the following error message appears: Hmm... Cannot reach this page. Which of the following should a technician configure?
Show answer and explanation
Correct answer: B. DNS settings
The laptop can reach external websites but not internal websites, which indicates a DNS resolution problem. Internal website hostnames cannot be resolved because the laptop is not configured to use the company's internal DNS servers. Configuring the correct DNS settings will allow the laptop to resolve internal hostnames to their IP addresses.
Why the other options are wrong
- A. Subnet mask issues would prevent communication on any network, not just internal websites.
- C. Default gateway issues would prevent access to any external resources, which is working in this scenario.
- D. DHCP issues would result in no IP address or connectivity problems across all networks, not selective internal access failure.
Question 101
A technician needs to download and install a new web browser on a desktop computer. Which of the following should the technician use to verify the installer is an authentic version?
Show answer and explanation
Correct answer: B. Hash
A cryptographic hash (such as SHA-256) is the standard method to verify that a downloaded installer is authentic and unmodified. The vendor provides an official hash value, and the technician can compute the hash of the downloaded file; if they match, the installer is confirmed as genuine and uncorrupted. This is far more reliable than other attributes.
Why the other options are wrong
- A. The date alone cannot verify authenticity; malicious files can have any date.
- C. File size can be spoofed and does not guarantee authenticity without cryptographic verification.
- D. The filename can be easily copied by attackers and provides no security verification whatsoever.
Question 102
After a user installs a mobile application from an advertisement, the phone’s battery dies a few hours later, and it is hot to touch, even when not in use. Which of the following should a technician do first?
Show answer and explanation
Correct answer: C. Run a mobile malware scan on the phone.
A third-party app installed from an advertisement causing rapid battery drain and heat generation is classic malware behavior. Running a mobile malware scan is the appropriate diagnostic first step to identify whether malicious code is consuming resources and causing the device to overheat. This must occur before making assumptions about MDM policies or contacting developers.
Why the other options are wrong
- A. Device administrators should be checked, but malware scanning is the more immediate priority when symptoms point to active malicious code.
- B. Contacting the developer is premature; the issue could be malware rather than a legitimate software defect.
- D. MDM policy application is a preventive measure, not a diagnostic action for an already-infected device.
Question 103
Which of the following filesystems is a successor to NTFS?
Show answer and explanation
Correct answer: A. ReFS
ReFS (Resilient File System) is Microsoft's successor to NTFS, designed to provide improved reliability, scalability, and performance. It includes features like built-in redundancy, corruption detection, and repair capabilities, making it the modern replacement for NTFS on Windows systems.
Why the other options are wrong
- B. XFS is a filesystem native to Linux/UNIX systems, not a Windows NTFS successor.
- C. APFS is Apple's filesystem for macOS and iOS, not a successor to the Windows NTFS filesystem.
- D. exFAT is a simplified filesystem for removable media and is not an advancement over NTFS; it lacks NTFS features.
Question 104
Which of the following malware types typically has very high computing resource usage?
Show answer and explanation
Correct answer: B. Cryptominer
Cryptominers are malware designed to use the infected computer's processing power to perform cryptocurrency mining operations, which requires sustained high CPU and GPU utilization. Rootkits focus on stealth and privilege maintenance, boot sector viruses target the boot process, and Trojans perform various malicious functions, but none characteristically demand the continuous intensive computing resources that cryptominers require.
Why the other options are wrong
- A. Rootkits prioritize stealth and persistence rather than resource-intensive operations.
- C. Boot sector viruses primarily focus on the boot process and do not require sustained high resource usage.
- D. Trojans perform various functions but are not characteristically associated with very high resource consumption.
That was 104 of 414.
The full CompTIA A+ 220-1202 pack has all 414 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 207 free as one PDF by email. Get the Half Pack →