CompTIA A+ Core 2 Practice Test – 419 Free Exam Questions with Answers

Correct answer: C. Server lock

A server lock physically secures the server chassis in a shared data center rack. An entry control roster is only an administrative sign-in sheet and cannot physically prevent someone from opening the server chassis.

Correct answer: A. Remove any proxy servers configured in their web browser

A malicious proxy server routes web traffic through a foreign location, causing localized sites to display incorrectly. Disabling the Windows Firewall worsens the issue and will not change how Google detects the browser's location.

Correct answer: C. Unattended

An unattended installation relies on an answer file to automate operating system deployments without manual input. Clean installs and upgrades are deployment scenarios, but they do not inherently require this file.

Correct answer: D. Linux

Ubuntu and Red Hat are popular distributions of the Linux operating system. Windows and macOS are alternative desktop operating systems, while Android is a mobile platform based on the Linux kernel.

Correct answer: C. AUP

An acceptable use policy dictates how employees may use corporate systems and requires a signature. A service level agreement focuses on expected support metrics rather than governing daily user behavior.

Correct answer: B. Zombie

A zombie is an infected computer controlled remotely by an attacker to launch attacks within a botnet. Zero-day refers to an undisclosed software vulnerability rather than the compromised machine itself.

Correct answer: B. In-place upgrade

An in-place upgrade installs the new operating system over the existing one while retaining applications, user profiles, and data. A clean installation completely wipes the drive, making it the wrong choice when preserving user data.

Correct answer: C. Hijacked email

A hijacked email account explains why unfamiliar or inappropriate messages were sent without the user knowing. Phishing and spear phishing are tactics used to steal credentials, but the resulting unauthorized access and sent emails are the hijacking itself.

Correct answer: C. nano

The nano utility is an easy-to-use command-line text editor used in Linux to modify configuration files. Remember that cat reads files, grep searches within files, and pwd only displays your current directory path.

Correct answer: A. passwd

The passwd command is used to change a user account password in Linux. As a helpful memory aid, chmod changes file permissions, chown changes file ownership, and pwd prints the current working directory.

Correct answer: C. Migrate the FTP server from the internal network to a screened subnet

Placing public-facing servers in a screened subnet isolates them from the internal network. Upgrading to SFTP encrypts traffic, but it does not protect the internal domain controller if the server is breached.

Correct answer: D. Evil twin

An evil twin attack creates a rogue wireless access point that mimics a legitimate network's SSID to steal information. While a rogue access point is unauthorized, an evil twin specifically involves impersonating a trusted corporate network.

Correct answer: A. A dedicated graphics card has its own memory, while an integrated graphics solution shares system RAM with other processes.

A dedicated graphics card includes its own independent video memory, known as VRAM. Integrated graphics relies on sharing the computer's system RAM, which reduces overall system memory available for other tasks.

Correct answer: C. Reboot the workstation into safe mode and roll back the recent security update

Booting into safe mode and rolling back the recent security update directly isolates the newly installed software as the root cause of the boot failure. Editing the registry is risky and less direct than simply uninstalling the problematic update.

Correct answer: B. Notify your immediate supervisor

When you discover policy violations like illegal or inappropriate materials, the first step is to escalate the issue to your supervisor or management. You must follow chain of custody and company procedures, avoiding unauthorized deletion.

Correct answer: A. Enable full device encryption · B. Configure the ability to perform a remote wipe

Full device encryption protects data at rest if a device is stolen, rendering the storage unreadable without the key. Remote wipe allows administrators to erase the compromised device over the network before data can be extracted.

Correct answer: C. VNC

Virtual Network Computing, or VNC, is an open-source remote access tool that provides graphical desktop sharing over a network. RDP is proprietary, and SSH with Telnet are command-line protocols without native graphical interfaces.

Correct answer: B. TACACS+

TACACS+ is a Cisco proprietary protocol providing authentication, authorization, and accounting services. RADIUS also provides these services, but it is an open standard and was not developed by Cisco.

Correct answer: D. Default administrative login credentials · F. WPS enabled

Wi-Fi Protected Setup uses an easily brute-forced PIN, and default credentials let attackers modify router settings. While outdated firmware is risky, it does not specifically explain the PIN-based initial access described.

Correct answer: A. Users

The Task Manager Users tab displays all active user sessions on the workstation. The Processes tab shows running applications, but it does not cleanly identify the different logged-in user accounts.

Correct answer: D. MSDS

A Material Safety Data Sheet, now commonly called a Safety Data Sheet, provides safe handling and disposal instructions for chemical products. SOW and MOU documents outline project scopes and business agreements, not chemical hazards.

Correct answer: D. Inaccuracies

The generated guides contain incorrect or outdated procedures, which directly describes an issue with AI inaccuracies. Hallucination involves the AI generating entirely fabricated content rather than simply relying on outdated information.

Correct answer: B. Performance monitor

Performance Monitor tracks detailed system resource usage over time to help identify bottlenecks causing poor performance. Device Manager is only used to manage hardware drivers, while Task Scheduler automates routine background tasks.

Correct answer: B. Administrator

An administrator account has the necessary permissions to modify system files, change user permissions, and install applications. Power Users have limited administrative abilities and cannot modify core operating system files.

Correct answer: B. The computer has been compromised and is participating in a botnet DDoS attack

High resource usage combined with thousands of unexpected outbound connections indicates the machine is part of a botnet. Corrupted drivers or standard Windows updates typically connect to specific vendor servers, not random IP addresses.

Correct answer: D. The users are still mapped to the old share drive

The error indicates the desktop shortcut still points to the decommissioned server rather than the new NAS. Users need their drive mappings updated to reflect the new network share path and resolve the access issue.

Correct answer: C. Clear the application's cache and data

Clearing the application cache and data removes corrupted temporary files that commonly cause single apps to crash on launch. Reinstalling the app is a more disruptive step best reserved if clearing the cache fails.

Correct answer: D. Corrosion of the servers

High humidity introduces excess moisture into the air, which leads to condensation and component corrosion. Low humidity creates the opposite problem, increasing the risk of accidental electrostatic discharge around sensitive electronics.

Correct answer: B. The smartphone is using a lot of processing power

A device generating excessive heat and draining its battery quickly in your pocket indicates runaway background processes or malware using heavy processing power. A faulty charging port would only cause issues while plugged in, making it the strongest distractor here.

Correct answer: A. NTFS

NTFS is the default and native file system for Windows installations, providing security and large partition support. FAT32 and exFAT are mainly used for external flash drives, while APFS is designed specifically for Apple operating systems.

Correct answer: A. "Can you tell me more about the problem? What do you mean by 'it is acting slow'?"

Asking an open-ended question clarifies the customer issue without being dismissive or defensive, adhering to troubleshooting best practices. Telling a customer nothing is wrong dismisses their concern, which violates professional communication standards.

Correct answer: A. Public

Selecting the public network profile disables network discovery and file sharing to protect the device on untrusted networks. The private profile is used for trusted networks where you want to share files and discover other devices.

Correct answer: B. Messages are sent instantly, allowing quick communication.

Instant messaging provides real-time communication that allows teams to collaborate efficiently. Unlike asynchronous email, messages appear immediately without delay. Employees can communicate from anywhere over the internet, and chat histories can generally be deleted by users.

Correct answer: A. SOP

A standard operating procedure provides the detailed, step-by-step instructions required to perform routine organizational tasks like software installation. A statement of work defines project deliverables, while an acceptable use policy dictates network usage rules.

Correct answer: D. Enable network discovery

Enabling network discovery allows a Windows workstation to find other computers and devices on the network. While file sharing lets users exchange data, discovery is the specific feature required to visually browse neighboring workstations in the network directory.

Correct answer: D. Dictionary

A dictionary attack uses a predefined list of common words and passwords to guess credentials. A brute-force attack tries every possible combination of characters, while a hybrid attack appends extra characters to a standard dictionary list.

Correct answer: D. WEP

WEP is the weakest wireless security protocol because it uses a flawed initialization vector that is easily cracked. WPA3 is currently the most secure option, followed by WPA2 and WPA, which all provide significantly stronger encryption and key management.

Correct answer: D. Least privilege

The principle of least privilege grants users only the minimum access required to perform their specific job duties. Separation of duties divides critical tasks among multiple people, preventing a single individual from controlling an entire sensitive process.

Correct answer: D. 8.8.8.8

Pinging an external IP address like a public DNS server tests general internet connectivity without relying on domain name resolution. If numbers succeed but website names fail, the issue is definitely DNS. Private IP addresses only test local network routing.

Correct answer: D. ping diontraining.com

The ping command tests reachability by sending ICMP echo requests to a target host. For the exam, remember ipconfig displays TCP/IP settings, while sfc repairs system files.

Correct answer: C. sfc

The system file checker scans for and restores corrupted Windows system files. The chkdsk command scans the file system for logical and physical errors on the disk.

Correct answer: B. PII

Personally identifiable information includes data like social security numbers used to identify an individual. Protected health information relates to medical records, distinguishing it from standard employment data.

Correct answer: B. MAC filtering

MAC filtering creates an allow list of specific devices permitted to connect to the open network. Quality of Service prioritizes bandwidth, but it does not restrict unauthorized network access.

Correct answer: C. GPO

A Group Policy Object centrally manages and deploys configuration settings across Windows devices in an Active Directory environment. Patch management focuses on operating system updates, not configurations.

Correct answer: D. A resource-intensive application may slow down overall system performance for users.

A resource-intensive application consumes heavy CPU and memory, which slows down overall system performance. Applications do not automatically optimize system settings, and meeting requirements does not guarantee flawless execution.

Correct answer: D. Task manager

The Task Manager Startup tab allows users to easily disable programs launching during the Windows boot process. Event Viewer is used for reviewing system logs rather than managing active startup applications.

Correct answer: B. Network-based anti-malware

A network-based anti-malware appliance scans incoming traffic at the network edge to protect all clients without requiring local software installations. Remember that host-based solutions require agents, while cloud-based solutions rely on off-site processing rather than an on-premise rack appliance.

Correct answer: D. Temporarily disable the vulnerable plug-in within browser settings.

Temporarily disabling the vulnerable plug-in immediately protects the browser from active exploitation. While increasing browser security settings helps generally, it does not directly address or neutralize a specific plug-in vulnerability like disabling it does.

Correct answer: D. bootrec /rebuildbcd

The bootrec /rebuildbcd command scans for valid Windows installations and adds them to the Boot Configuration Data store. The /fixmbr and /fixboot commands repair the master boot record and boot sector, respectively, but do not rebuild the BCD.

Correct answer: A. The dedicated graphics card has its own memory, reducing strain on system RAM when rendering videos.

A dedicated graphics card utilizes its own VRAM, freeing up system RAM for smoother video editing and rendering. Integrated graphics actually share system memory, making the system more efficient for general tasks rather than graphically intense workloads.

Correct answer: C. PCI-DSS

The Payment Card Industry Data Security Standard, or PCI-DSS, applies to any organization accepting credit card payments. PII and PHI are data classifications, while GDPR focuses on European Union privacy regulations.

Correct answer: C. Rollback the video card driver and wait for a new driver to be released

Rolling back the video card driver addresses failures directly caused by recently applied updates. Safe Mode only bypasses the issue temporarily, whereas the System File Checker validates core Windows files rather than resolving driver incompatibilities.

Correct answer: D. Investigate for malware and run a full security scan on the device

Sudden connectivity loss paired with a high traffic warning strongly indicates malware hijacking the network interface. Basic steps like toggling airplane mode or rebooting the router ignore the underlying security threat flagged by the notification.

Correct answer: C. MAC filtering

MAC filtering blocks or allows network connections based on a device's unique hardware address. Port forwarding or passwords handle broader network routing and access, but they do not target one specific device identifier.

Correct answer: C. To temporarily improve browser performance or security.

Disabling extensions directly removes background processes and potential vulnerabilities, improving browser performance and security. Extensions do not manage cookies or browser updates, so disabling them won't affect those functions.

Correct answer: A. Disable the user accounts at the end of each summer

Disabling accounts temporarily revokes access while preserving user data for their return. Deleting accounts permanently removes access and configurations, while login hour restrictions only limit daily access.

Correct answer: D. Patch management

Patch management directly fixes known software vulnerabilities by applying updates. Policies and detection systems might warn or guide users, but they do not eliminate the underlying code flaws.

Correct answer: C. Task scheduler

Task Scheduler automates scripts and applications to run at specific times like 3:00 AM. Event Viewer reviews past logs, while MSConfig manages startup items, not scheduled scans.

Correct answer: D. yum

The yum command is a package manager used to install, update, and remove software on RPM-based Linux distributions. For the exam, associate yum and apt with package installation, while commands like grep and cat are used for reading and searching text.

Correct answer: B. Recycling electronic equipment through certified disposal service providers.

Using certified disposal service providers ensures proper hardware recycling and adherence to environmental compliance standards. Donating equipment without data sanitization poses a significant security risk and violates data privacy regulations.

Correct answer: A. Multiple users are overwriting changes at the same time.

When multiple users edit a shared document simultaneously, they can easily overwrite each other's changes if collaboration features are not syncing properly. Modern word processors do not automatically reset to older versions or have a strict limit on saved edits.

Correct answer: B. PCI DSS

The Payment Card Industry Data Security Standard, or PCI DSS, is the specific framework that regulates how credit card transactions are processed and secured. PHI and PII are data classifications, not regulatory standards themselves.

Correct answer: B. The network file share's permission has been modified

Email clients often map shared inboxes or archives to network file shares, so if those share permissions change, the folders disappear even though standard mail send and receive still work. Client security settings would usually block all mail synchronization, making that a weaker distractor.

Correct answer: A. PII

Personally identifiable information, or PII, is a key form of regulated data that technicians must secure according to laws and company policies. The other options are security policies, copyright laws, or protection technologies.

Correct answer: D. Install the latest security updates and patches to the server

Installing the latest security patches ensures known vulnerabilities are closed before exposing the server to remote access. Antivirus updates are helpful but secondary to patching critical system exploits.

Correct answer: B. On-path attack

An on-path attack intercepts communications between two parties by spoofing identities to appear as a trusted endpoint. However, ARP poisoning also relies heavily on spoofing, making this question slightly ambiguous.

Correct answer: A. Configure it as a shared printer connected to one of the four workstations

Connecting the printer to one workstation and sharing it provides a quick fix when all switch ports are occupied. While a dedicated print server is a better enterprise solution, it is unavailable because the office lacks extra hardware.

Correct answer: B. Use dedicated channels to keep messages organized.

Dedicated channels organize conversations, keeping important updates visible and preventing them from being buried in busy chat logs. Disabling group chats entirely or simply reducing user counts negatively impacts collaboration without solving the visibility problem.

Correct answer: E. Modify the AutoRun settings · F. Lockout the account after 3 failed login attempts

Modifying AutoRun settings prevents malicious code on USB storage from executing automatically. Configuring an account lockout directly defeats password guessing by disabling logins after failed attempts. While good security practices, the other options do not solve these specific USB and brute force vulnerabilities.

Correct answer: C. Verify that auto-rotate is enabled

Verifying the auto-rotate setting is the simplest first step because users frequently toggle this accidentally. Restarting the device is a logical second step if the setting is already enabled.

Correct answer: C. Uninstall the app, reboot the phone, and reinstall the app

Uninstalling and reinstalling the problematic app is the best first step when a recent installation causes performance issues. A factory reset is an extreme measure that should only be used as a last resort.

Correct answer: C. User training and awareness

Regular user training and awareness mitigates social engineering and phishing, which are the biggest threats to a network. Penetration testing might find vulnerabilities but doesn't actively prevent them from being exploited like educating your users does.

Correct answer: D. Power spikes

A power spike is a brief, massive over-voltage event that can severely damage server room equipment. A surge lasts slightly longer than a spike, while under-voltage events and blackouts involve power drops or total losses.

Correct answer: A. Incident report

An incident report is the correct way to document a single user issue like an email outage. A knowledge base is used for reference, while an asset database tracks hardware, making neither suitable for documenting a specific support call.

Correct answer: A. Disable unnecessary programs from automatically starting up

Disabling unnecessary startup programs directly speeds up the boot process. Reinstalling Windows or rebuilding profiles are drastic measures, and Safe Mode is only a diagnostic tool.

Correct answer: D. Gestures

Gestures are the trackpad motions used to perform actions like Smart Zoom in macOS. The other terms describe basic movements but are not the macOS features used for trackpad configuration.

Correct answer: A. .py

Python scripts use the .py extension and can run cross-platform on Linux, macOS, and Windows using an interpreter. The other extensions are generally limited to specific operating systems, such as .ps1 for Windows PowerShell.

Correct answer: A. bootrec /fixboot

The bootrec /fixboot command writes a new boot sector to the system partition, resolving the missing BOOTMGR error. You can memorize bootrec commands for the exam since utilities like diskpart and chkdsk handle partitions and file errors instead.

Correct answer: D. An uninterruptible power supply (UPS)

An uninterruptible power supply provides instant battery backup during a power failure, bridging the gap until the backup generator starts. A line conditioner only regulates voltage but cannot supply power during a complete outage.

Correct answer: C. Repair installation

A repair installation replaces corrupted operating system files while keeping user data and applications intact. This is ideal for systems with severe performance issues or unisolated software corruption. An in-place upgrade moves you to a newer operating system version.

Correct answer: B. Windows 10

Windows 10 is the best recommendation because it meets the strict hardware requirements and is still supported. Windows 11 requires four gigabytes of RAM and a sixty-four-gigabyte drive, making it incompatible with this laptop.

Correct answer: B. Use social engineering to trick a user into opening a malicious APK

Tricking a user into installing a malicious APK is the most reliable method to exploit an Android device. Since mobile devices are usually protected against remote web-based exploits, social engineering is often required to bypass the operating system's security controls.

Correct answer: D. Reboot the computer

Rebooting the computer ensures the newly registered DLLs and service changes take full effect across the operating system. Restarting network services or rolling back drivers will not properly initialize the Windows Update components after modifying these core system files.

Correct answer: A. Degauss each of the hard drives

Degaussing quickly wipes magnetic drives using a strong electromagnetic field. However, physical destruction is often preferred for high-security military disposal because degaussing SSDs is ineffective, making both viable.

Correct answer: A. A virtual machine has less downtime than a physical server

Virtual machines can be restored or spun up rapidly from backups, minimizing downtime compared to physical servers. Rebuilding a physical server requires hardware replacements and driver configurations.

Correct answer: C. pwd

The pwd command displays the present working directory path on a Linux system. The chown and chmod commands are used to change file ownership and permissions, while passwd changes user account passwords.

Correct answer: D. chmod

The chmod command modifies file and directory permissions in Linux. The chown command changes file ownership, pwd displays the current directory, and sudo executes commands with root privileges.

Correct answer: B. Privacy screen

A privacy filter narrows the monitor viewing angle so bystanders cannot easily read the screen, directly countering shoulder surfing. Hardware tokens and biometric locks protect access but do not stop someone from looking at an active display.

Correct answer: C. ps

The ps command lists currently running processes along with their process IDs and resource usage. The kill command terminates processes, ls lists directory contents, and grep searches text, so they do not provide the active process list.

Correct answer: A. Rainbow table

A rainbow table uses a precomputed database of hashes to reverse cryptographic hash functions quickly. Brute-force and dictionary attacks generate hashes in real-time, making them much slower than using a precomputed lookup table.

Correct answer: D. Regularly clear the browser cache to remove stored temporary data.

Clearing the browser cache removes conflicting temporary files that prevent previously visited websites from loading properly. Updating the browser or blocking unknown scripts improves security but does not resolve stored cache corruption.

Correct answer: A. iCloud

iCloud is Apple's proprietary cloud storage service natively integrated into macOS and iOS for syncing data. OneDrive and Google Drive are first-party solutions for Microsoft and Google, while Dropbox is a popular third-party alternative.

Correct answer: C. Restart the Windows Explorer process using Task Manager

Restarting the Windows Explorer process quickly restores the desktop shell without altering system state. Since the cursor remains active, monitor connections are fine, making driver reinstalls or system restores premature and unnecessarily disruptive.

Correct answer: C. Password policy

A password policy directly governs knowledge-based authentication factors by defining complexity, length, and expiration rules. Acceptable use policies govern how employees utilize company resources, while an asset management policy tracks inventory.

Correct answer: C. Environmental variables

Environment variables are used to pass configuration data and system preferences to child processes within scripts. Regular variables only store temporary values locally, whereas comments are ignored by the interpreter entirely during execution.

Correct answer: A. Restore the device to factory settings to remove the jailbreak

Restoring the device to factory settings completely removes the jailbreak and reinstates official iOS security protections. Simply revoking app permissions is insufficient because jailbreaking bypasses built-in system security restrictions entirely, leaving the device compromised.

Correct answer: D. Port forwarding

Port forwarding maps an external port to a different internal port and IP address. Static NAT simply maps a public IP address to a private IP address one-to-one, whereas dynamic DNS updates name records and does not translate ports.

Correct answer: D. RDP

Remote Desktop Protocol provides a graphical interface so you can fully interact with a remote Windows desktop. Secure Shell only provides a text-based command-line interface, which is less helpful for troubleshooting general operating system issues visually.

Correct answer: D. Attempt to restore to a test server from one of the backup files to verify them

Performing a test restoration to a non-production server is the only definitive way to verify backup integrity. Setting up scripts to retry failed jobs only ensures the backup completes, while copying files off-site provides redundancy but not validity.

Correct answer: B. It allows users to install apps from third-party sources

Android allows users to freely install applications from third-party sources through sideloading. iOS strictly limits installations to the official App Store unless the device is jailbroken, making Apple's ecosystem much more restrictive by design.

Correct answer: A. Autorotate is disabled

The autorotate feature being disabled prevents the screen orientation from switching between portrait and landscape modes. You can easily toggle this by accessing the Control Center and tapping the rotation lock icon.

Correct answer: A. Samba

Samba enables cross-platform file and print sharing between Linux servers and Windows workstations. Yum is a package manager used for software installation, while Pathping is a Windows utility used to diagnose network routing issues.

Correct answer: B. BIOS password required

A BIOS or UEFI password prevents unauthorized users from entering the firmware to change the boot order. While Secure Boot ensures only trusted operating systems load, it does not physically stop someone from changing the boot sequence.

Correct answer: B. dd

The dd command is used to clone disks or wipe data by overwriting block devices with zeros. Basic file operations like cp, rm, and mv cannot write directly to the disk to perform a low-level wipe.

Correct answer: C. Contracting with certified electronics recyclers to manage disposal processes.

Contracting with certified electronics recyclers ensures hardware is disposed of safely according to local environmental regulations. Throwing equipment in standard commercial bins or sending it to landfills violates e-waste rules.

Correct answer: C. Worm

A worm actively self-replicates across networks without requiring user interaction or a host application. Viruses and macro malware require human action, while Trojans disguise themselves inside seemingly harmless applications.

Correct answer: C. Certificate manager

The Certificate Manager utility imports, exports, and manages digital certificates, including those in the x.509 format. Device Manager strictly handles hardware devices, not software-based cryptographic certificates.

Correct answer: D. Deploy a new group policy

Deploying a new Group Policy Object is the easiest way to mass-update configurations across a Windows domain network. Manually changing settings on 1,250 machines would be highly inefficient and prone to error.

Correct answer: B. Telnet

Telnet transmits data, including passwords, as unencrypted plain text, making it a major security risk. Secure Shell provides encrypted remote management and completely replaces Telnet in corporate networks.

Correct answer: D. gpresult

The gpresult command displays the Resultant Set of Policy, showing exactly which Group Policies apply to a specific user. In contrast, gpupdate is only used to force an immediate refresh of these policies.

Correct answer: C. Plug the device into a charger and retry the update

Mobile operating system updates require a minimum battery threshold or external power to prevent bricking. Since the tablet only has 25 percent battery, it must be plugged into a charger. Destructive actions like factory resets should always be a last resort.

Correct answer: B. netstat

The netstat command displays active TCP connections, routing tables, and listening ports, making it ideal for incident response. Tracert shows the path packets take to a destination, while arp and route manage MAC address and routing tables respectively.

Correct answer: D. Clean install

A clean install completely wipes the existing operating system, data, and applications during installation. An in-place upgrade preserves user data and settings, while repair and refresh installations attempt to fix the existing system.

Correct answer: D. Dumpster diving

Dumpster diving involves searching through physical trash or recycling to find sensitive documents and information during reconnaissance. Phishing and whaling are digital email-based attacks, while impersonation involves pretending to be another person.

Correct answer: B. Activating the built-in pop-up blocker feature in the browser settings.

Activating the browser's built-in pop-up blocker directly prevents disruptive advertisement windows from opening automatically. Clearing cookies updates software versions, and disabling extensions are good security practices but do not directly stop website pop-ups.

Correct answer: B. Developer mode

Enabling developer mode unlocks Android diagnostic tools needed to debug applications and inspect network activity. Sideloading only installs the APK, while rooting or jailbreaking grants administrative access that is unnecessary for standard troubleshooting.

Correct answer: C. Verify the smartphone has adequate signal strength

Checking cellular signal strength first follows standard troubleshooting methodology by identifying the simplest environmental cause. Dropping bars inside an apartment explains the bandwidth drop, making aggressive resets or OS updates premature at this stage.

Correct answer: C. The technician should ask open-ended questions to properly identify the issue by narrowing down the possible symptoms or causes

Asking open-ended questions helps efficiently narrow the scope while showing empathy and professionalism to a frustrated user. Citing strict procedures or dismissing the user can escalate tension rather than resolve the underlying technical issue.

Correct answer: B. WEP

Wired Equivalent Privacy uses a 24-bit initialization vector, making its encryption highly vulnerable to compromise. Modern protocols like WPA and WPA2 replaced it, so remember WEP only for legacy contexts on the exam.

Correct answer: A. 3-2-1 backup

The 3-2-1 backup rule specifically requires storing data on two different media types. The other options, such as Grandfather-father-son and Tower of Hanoi, are rotation schemes that dictate tape reuse schedules without enforcing diverse media types.

Correct answer: C. Asset ID

An asset ID provides a unique, persistent identifier for all tracked hardware components, including those without network connectivity like monitors. IP and MAC addresses are unreliable for general asset tracking because they can change or apply only to network adapters.

Correct answer: B. Acceptable use policy

An acceptable use policy outlines the rules and constraints for using corporate resources like networks and laptops. Password policies cover authentication rules, while a knowledge base contains technical troubleshooting documentation rather than user guidelines.

Correct answer: C. The browser was infected with adware or a browser hijacker malware

Unauthorized changes to the homepage, search engine, and unknown browser extensions are classic symptoms of a browser hijacker. Browser updates and DNS changes do not secretly install malicious extensions or alter browser preferences without user consent.

Correct answer: D. Disk defragmenter

Running a disk defragmenter on a solid-state drive causes unnecessary write cycles, reducing the drive's lifespan without improving performance since SSDs do not need defragmentation. Tools like Disk Cleanup and Device Manager are completely safe for SSD maintenance.

Correct answer: B. Enterprise · C. Education · D. Pro

Remote Desktop Host is supported on Windows 10 Pro, Enterprise, and Education editions. The Home edition does not support hosting an RDP session, so third-party tools are required to remotely access a Windows 10 Home machine.

Correct answer: B. Image deployment

Image deployment captures a master Windows configuration to simultaneously push it to multiple target machines. Repair installations and in-place upgrades only operate on a single existing system and cannot mass-deploy to fifty workstations at once.

Correct answer: A. File permission change

Malware often changes file permissions to block users from launching security tools, which generates the access denied alert. Renamed system files or missing executable components would instead trigger a file not found error.

Correct answer: B. Using degaussing to disrupt the magnetic fields within drives.

Degaussing uses a powerful magnetic field to permanently destroy data on spinning hard drives, ensuring confidential patient information cannot be recovered. Drilling physically damages drives but leaves remaining intact platters vulnerable to specialized forensic extraction.

Correct answer: C. Avoid entering sensitive details until the certificate issue is resolved.

Avoiding sensitive data entry protects against potential man-in-the-middle attacks when a certificate is invalid. Disabling warnings or ignoring the alert exposes the user to risk, while updating the browser will not fix a site-side certificate failure.

Correct answer: D. Attempt to open the document in Safe Mode

Opening the application in Safe Mode bypasses problematic add-ins or corrupted settings that might cause a single file to crash. Reinstalling the software or updating the operating system are inefficient first steps for an isolated document issue.

Correct answer: B. DoS

A denial-of-service attack floods a server with malicious traffic, increasing load without generating legitimate financial transactions. ARP spoofing targets local network traffic, while phishing and bluejacking rely on social engineering or Bluetooth.

Correct answer: C. Require authentication on wake-up

Requiring authentication on wake-up ensures that anyone approaching the public computer must enter credentials to access the network. Disabling single sign-on or altering the guest account does not physically secure an unattended, active session.

Correct answer: C. Branch

An IF THEN ELSE statement represents a branch, which controls script flow based on a logical condition. A loop repeats actions until a condition is met, while variables and constants simply store changeable or fixed data values.

Correct answer: B. Hijacked email

Receiving automated replies for emails you did not write indicates your email account was hijacked and used to send spam. Phishing and vishing are social engineering tactics designed to trick you, rather than automatically sending emails.

Correct answer: A. Log off the workstation

The shutdown command with the /l switch logs off the current user on a Windows workstation. For the exam, remember that /s shuts down the machine, /r reboots it, and /h initiates hibernation or sleep mode.

Correct answer: D. ip

The ip command displays network address and subnet mask information on a Linux system. Use ipconfig specifically for Windows networking details, while netstat shows active connections and nslookup troubleshoots DNS resolution issues.

Correct answer: C. Finder

Finder is the macOS file manager used to navigate folders and files, equivalent to Windows File Explorer. Mission Control manages multiple desktops, Spotlight handles search functions, and the Dock provides application shortcuts.

Correct answer: D. BYOD

Bring your own device (BYOD) allows personal devices to access corporate networks, which can introduce vulnerabilities because IT has less control over patching and security. For the exam, remember that MDM, COPE, and CYOD provide centralized management, whereas BYOD relies heavily on end-user compliance.

Correct answer: D. Chain of custody

A chain of custody tracks the handling, transfer, and physical possession of evidence to preserve its integrity for legal proceedings. A legal hold only preserves data from deletion, while financial responsibility and secure copy protocol do not track evidence handling at all.

Correct answer: A. Tickets used to identify authenticated users

Kerberos relies on a system of encrypted tickets to prove user identity over an unsecured network. While single sign-on is supported by both Kerberos and RADIUS, the ticketing mechanism itself is the defining, exclusive feature of the Kerberos protocol on the exam.

Correct answer: B. Grandfather-father-son

The grandfather-father-son scheme is a three-tiered backup rotation using daily, weekly, and monthly cycles to ensure regular full backups. The 3-2-1 rule is a data preservation strategy, not a rotation schedule, and Tower of Hanoi relies on complex media set rotations.

Correct answer: D. Accidental static discharge

Low humidity increases the risk of accidental electrostatic discharge, which can severely damage sensitive server components. High humidity, conversely, promotes corrosion on metal contacts, so server rooms must maintain humidity levels between forty and sixty percent to balance both risks.

Correct answer: B. Rollback plan

A rollback plan provides the exact steps needed to restore a system to its previous state following a failed update or aborted implementation. A contingency plan handles broader disaster recovery, whereas a backup plan focuses strictly on restoring lost data, not reverting firmware changes.

Correct answer: A. Unauthorized microphone activation

Unauthorized microphone activation best matches the scenario because malware can silently use the phone's mic to eavesdrop. Unintended Bluetooth pairing fails since that involves unauthorized data connections rather than listening to conversations.

Correct answer: D. Whaling

Whaling is correct because it is a specialized phishing attack that targets high-profile executives like CEOs. Spear phishing is a strong distractor but covers any targeted individual rather than focusing specifically on senior leadership.

Correct answer: C. Repair installation

A repair installation replaces corrupted Windows system files while keeping user data and apps intact. An in-place upgrade is the strongest distractor, but it moves the system to a newer operating system version rather than simply repairing the current one.

Correct answer: B. msinfo32.exe

The msinfo32 utility creates a comprehensive list of hardware resources and the software environment. Device Manager is the strongest distractor, but it primarily displays status and drivers for hardware devices rather than a full system software summary.

Correct answer: B. FaceID

FaceID maps facial geography using infrared scanning to grant mobile device access. TouchID is a strong distractor because it is also biometric, but it relies on fingerprint mapping rather than analyzing facial features like the eyes, nose, and mouth.

Correct answer: B. Data source

Data source is correct because verified proprietary information directly improves AI reliability. Processor speed is a strong distractor, but hardware performance only affects how fast the model trains rather than the actual trustworthiness of the data.

Correct answer: A. Bollards

Bollards are heavy physical posts specifically designed to stop a vehicle from ramming into building entrances. An access control vestibule is the strongest distractor, but it primarily stops individuals from tailgating rather than stopping a moving car.

Correct answer: C. Mail

The Mail applet in the Windows Control Panel manages Microsoft Outlook profiles, allowing technicians to configure or delete user email settings. User Accounts handles Windows logon credentials, not application-specific Outlook profiles.

Correct answer: C. Defragment the hard drive · E. Remove unnecessary applications from startup

Defragmenting the hard drive and removing unnecessary startup applications are free methods that effectively reduce system boot times. Upgrading to an SSD or adding RAM also improves performance, but these cost money.

Correct answer: C. Keylogger

A keylogger captures user keystrokes to steal credentials, which explains the compromised usernames and passwords following the driver update. Ransomware encrypts files, worms replicate independently, and standard viruses usually disrupt system operations.

Correct answer: A. Identifying the change type

Identifying the change type allows IT to categorize modifications by impact and urgency, ensuring proper change management procedures. Security audits, least privilege, and acceptable use policies are vital security controls but do not classify system changes.

Correct answer: B. Application spoofing

Application spoofing uses fake apps masquerading as legitimate software to steal user credentials. Because the malicious app was downloaded from a third-party store and displays a fake interface, it differs from network interception or generic phishing emails.

Correct answer: C. Enable battery saver mode and adjust screen brightness

Enabling battery saver mode and lowering screen brightness directly reduce active power drain without compromising essential functionality. Replacing the battery is premature without diagnostic evidence of hardware failure or chemical degradation.

Correct answer: B. It provides universal compatibility across multiple operating systems

FAT32 remains popular for USB flash drives because nearly all operating systems and devices natively support it. Be careful, though: it has a strict four-gigabyte individual file size limit and lacks modern security or speed features.

Correct answer: A. bootrec /fixboot

Running bootrec /fixboot writes a new boot sector to the system partition, which resolves BOOTMGR errors. diskpart manages partitions, while chkdsk and sfc check disk or file integrity but do not directly repair the boot loader.

Correct answer: B. The workstation couldn't reach the DHCP server

An IP address starting with 169.254 indicates an APIPA address, which Windows assigns when it cannot reach a DHCP server. Without a valid DHCP lease, the workstation lacks proper gateway or DNS settings to reach the internet.

Correct answer: A. diskpart

Diskpart is the command-line utility used to create, delete, and manage disk partitions in Windows. Format prepares the file system, chkdsk checks for file system errors, and dd is primarily used for low-level copying in Linux environments.

Correct answer: C. Sound

The Sound Control Panel contains a Communications tab that lets Windows automatically mute or reduce the volume of other sounds during phone calls. Ease of Access handles accessibility features, while USB selective suspend manages power for connected devices.

Correct answer: A. Clear the local application cache

Clearing the local application cache removes corrupted temporary data that commonly causes mobile apps to crash on startup. Reinstalling or rolling back are valid follow-up steps if the cache clearing fails to resolve the launch issue.

Correct answer: A. Trojan

A trojan hides malicious background processes inside what looks like a legitimate downloaded application. Ransomware focuses on encrypting data for ransom, while keylogging specifically aims to silently capture user keystrokes.

Correct answer: B. Firmware update

A firmware update introduces new features and functionality directly to networking hardware. Vulnerability patching secures the router against known exploits, but it does not provide the requested operational enhancements.

Correct answer: B. Biometric lock · E. Badge reader

Installing a biometric lock and a badge reader provides physical access control and multifactor authentication for the server room. Strong passwords secure the servers logically, while cable locks and bollards protect different physical assets.

Correct answer: B. An inactive VPN connection

Remote workers need an active VPN connection to securely tunnel into the corporate network and access internal shares. If the VPN is disconnected, the laptop only has standard internet access and cannot reach private resources, whereas patches and anti-malware don't block shares directly.

Correct answer: B. The employee lacks permission to send messages.

The ability to receive but not send messages in a fully functional app points directly to a user permission issue restricting outgoing actions. If the internet connection were down or a network outage occurred, all messaging functions and other network services would completely fail.

Correct answer: C. cd ..

The cd .. command moves up one directory level in the file system. On modern Windows systems, the ls command is a valid PowerShell alias for listing directory contents, making it a plausible but incorrect distractor for the specific action asked.

Correct answer: E. Enforcing trusted software sources · F. Enabling multifactor authentication

Multifactor authentication and trusted software sources apply universally across both computers and smartphones. Cable locks and access control vestibules are strong distractors but fail the dual requirement because they are not practical security controls for smartphones.

Correct answer: A. Restart the print spooler service

Restarting the print spooler clears stuck print jobs in the Windows queue so documents can print again. Rolling back USB drivers is a weaker option here because the prompt already verifies the hardware connection to the printer is working properly.

Correct answer: C. Multifactor · D. WPA2

WPA2 provides the required strong wireless encryption, while multifactor authentication secures the desktop access. While RADIUS is excellent for network access control, the question emphasizes desktop and cloud application authentication, making MFA the better fit.

Correct answer: C. Amount of hard drive space

The correct answer works because Windows 11 strictly requires at least 64 GB of storage space to install. The virtual machine only has 32 GB assigned, so the setup will fail until the virtual disk size is increased.

Correct answer: D. Least privilege

Least privilege ensures users only receive the access necessary for their specific job functions, improving overall security. Permission creep is incorrect because it refers to the accumulation of unnecessary access rights over time as users change roles.

Correct answer: D. Tailgating

Tailgating occurs when an unauthorized person follows closely behind an authorized user through a secure door. Shoulder surfing involves stealing passwords visually, and impersonation involves pretending to be someone else.

Correct answer: C. SSH

SSH provides a secure, encrypted command-line connection for remotely configuring network switches and routers. Telnet transmits data in plain text, making it insecure and obsolete for production networks.

Correct answer: D. shutdown

The shutdown command safely brings the Linux system down by notifying users and stopping processes. The ps command lists running processes, while kill terminates specific processes and rm removes files, making them incorrect for this scenario.

Correct answer: A. SQL injection

An SQL injection attack inserts malicious code into entry fields to access or manipulate database contents. Cross-site scripting targets the end user's browser by injecting scripts into trusted websites, making it a different type of vulnerability.

Correct answer: B. Password policy

A password policy dictates complexity requirements for keys and passwords. For the exam, remember that acceptable use governs user behavior, while password rules determine length and complexity.

Correct answer: A. Disable or remove the recently installed browser plug-in.

Disabling or removing the recently installed plug-in directly resolves the performance issue by eliminating the problematic software. Clearing the cache or updating the browser addresses general performance, not a specific bad plug-in.

Correct answer: B. Social engineering attempts

Social engineering targets human behavior, making policies and training the most effective mitigation. Technical attacks like DDoS or on-path attacks require network security controls rather than user education to prevent successfully.

Correct answer: D. Spoofing

Spoofing disguises communications, allowing attackers to insert themselves into the data path. Tailgating is a physical security breach, while brute force attacks target authentication mechanisms.

Correct answer: A. The file system structure is reset removing data references

Standard formatting resets the file system structure and removes data references, leaving recovery possible. Overwriting data completely requires a secure wipe, and encryption simply scrambles data rather than removing file references.

Correct answer: D. Swap partition

A swap partition provides virtual memory to supplement physical RAM in Linux. The ext4 and ext3 options are file systems, while NFS is a network sharing protocol, none of which act as system memory.

Correct answer: C. Uninstall the application and run a full malware scan

Uninstalling the suspicious application and running a malware scan removes the root cause of the adware. Resetting the browser only fixes the symptom, while updates will not eliminate existing malicious software.

Correct answer: A. df

The df command displays available disk space on mounted Linux file systems. Remember common Linux commands: ls lists files, cat reads them, and pwd shows your current directory.

Correct answer: A. Set the document to view-only mode.

Setting the document to view-only mode enforces the restriction while allowing employees to read the file. Asking staff not to edit relies on trust, whereas locking the document blocks access entirely.

Correct answer: A. Check network permissions and data usage for any applications installed within the last month

Checking recently installed applications identifies background processes consuming cellular data. A factory restore is unnecessary, and restricting large WiFi downloads fails to isolate the sudden spike.

Correct answer: A. Brute-force

A brute-force attack sequentially submits every possible combination until the correct PIN is found. Dictionary attacks only use known words, whereas rainbow tables rely on precomputed password hashes.

Correct answer: B. UPnP

Universal Plug and Play allows devices to automatically request open router ports. DHCP assigns IP addresses, while NAT handles private to public address translation.

Correct answer: A. Update the firmware

Updating the firmware adds missing features and patches security vulnerabilities on the spare router. Rebooting or resetting the device will not magically enable HTTPS support.

Correct answer: B. String

A string data type stores textual characters like an employee name. Integers hold whole numbers, floats handle decimals, and booleans represent true or false values.

Correct answer: D. copy

The copy command duplicates files from one directory to another in Windows. Diskpart manages partitions, chkdsk scans for file system errors, and net user manages accounts.

Correct answer: A. Play Store

The Google Play Store is the official, trusted source for installing Android package files. The App Store is for iOS, while websites require risky sideloading.

Correct answer: B. Plagiarism

Plagiarism best describes the ethical violation of copying materials without proper attribution. Copyright infringement involves legal ownership rights, while data exfiltration focuses on unauthorized data theft.

Correct answer: D. Insufficient internet bandwidth for high-quality video transmission.

The correct answer works because video conferencing requires sustained high throughput, and low bandwidth directly causes lag and dropped sessions. Remember that a firewall would normally block the application entirely, not just degrade its streaming performance.

Correct answer: C. .sh

The correct answer works because Bash shell scripts in Linux are saved with the dot SH extension. As a quick exam cue, remember that PS1 belongs to Windows PowerShell and VBS is strictly for Windows environments.

Correct answer: D. Any individual who worked with evidence during the investigation

The correct answer works because chain of custody forms track exactly who handled or controlled the evidence during an investigation. A practical exam tip is to remember that it documents evidence handlers, not necessarily initial bystanders or previous owners.

Correct answer: A. Lock the formula cells while keeping data entry fields editable.

The correct answer works because modern spreadsheet applications allow you to lock specific cells while leaving others editable. The strongest distractor fails because making the entire file read-only completely prevents the required collaborative data entry.

Correct answer: A. rm -rf /

The correct answer works because the RM command with recursive and force flags targets the root directory, deleting everything. The asterisk operator only deletes files in the current working directory, not the entire Linux file system.

Correct answer: C. Phishing

Phishing is a mass email attack using a disguised fraudulent message to steal credentials. Spear phishing fails because it targets specific individuals or organizations, whereas this scenario describes a bulk email sent to random addresses.

Correct answer: D. Event Viewer

Event Viewer logs historical system and application events, making it the primary tool for diagnosing past errors. Performance Monitor is incorrect because it tracks real-time system resource utilization rather than providing an archive of past system errors.

Correct answer: B. Plan

The plan portion of change documentation details the step-by-step process of how the requested change will be implemented. Scope is incorrect because it simply defines which specific servers or systems are included in the planned update.

Correct answer: B. Lift with your legs and not your back

Lifting with your legs by bending at the knees protects your spine by relying on strong lower body muscles. Lifting with a straight back and bent legs is a standard safety requirement, whereas bending at the waist causes severe back injuries.

Correct answer: D. Prevents the malware from spreading to other devices on the network.

Quarantining an infected system isolates it, preventing the malware from propagating to other devices on the network. Backing up files or running antivirus scans should be delayed until containment is complete to avoid copying malicious data.

Correct answer: C. Reboot the computer in safe mode and run a malware removal tool

Booting into Safe Mode loads a minimal environment that prevents malware from actively defending itself. Running a removal tool under normal conditions often fails because the active infection blocks the antivirus software from re-enabling properly.

Correct answer: C. Home

The Group Policy Editor is included in professional and enterprise editions but is omitted from the home edition. If an exam question asks about centralized operating system configuration on consumer hardware, expect the home edition to lack administrative tools.

Correct answer: B. Facial recognition.

Facial recognition provides hands-free security ideal for frequent use in public spaces. Retina scanning is too cumbersome for tablets, while swipe patterns are easily compromised by shoulder surfing.

Correct answer: C. .bat

A .bat file extension identifies a batch script containing standard Windows command-line instructions like net use. While .vbs or .js are used for more advanced scripting languages, batch files directly execute native cmd commands.

Correct answer: A. Run a full malware scan and remove unwanted browser extensions

Unexpected browser redirects and pop-ups indicate adware, so running a malware scan and removing malicious extensions directly resolves the threat. A system restore is too disruptive for a first step.

Correct answer: D. sfc

The sfc command scans and repairs corrupted Windows system files, resolving issues like crashing core OS components. Regedit edits the registry, while dxdiag diagnoses audio and video hardware problems.

Correct answer: B. 127.0.0.1

Pinging the loopback address tests the internal TCP/IP stack without sending traffic over the network. Other addresses require a functioning network connection, making the loopback address the standard choice for local protocol diagnostics.

Correct answer: A. APFS

The Apple File System is the default modern file system for macOS installations, replacing the older HFS plus format. Knowing default operating system file systems is essential for the exam, especially when managing multi-boot environments.

Correct answer: A. robocopy

Robocopy is the correct choice because it synchronizes directories and mirrors drives by deleting files in the destination that no longer exist in the source. While xcopy duplicates files, it lacks the synchronization features needed here.

Correct answer: A. Event viewer

Event Viewer logs system, security, and application events, allowing you to pinpoint what happened right before the server crashed. It provides crucial error codes and timestamps for troubleshooting. The other tools show real-time performance stats or static hardware configurations, not historical event logs.

Correct answer: C. Standard change

A standard change refers to a routine, low-risk modification that follows a pre-approved process, like monthly patching. It requires minimal additional approval compared to other changes. Emergency changes require urgent fixes, while normal changes need full risk assessment and stakeholder approval beforehand.

Correct answer: B. Hardware token

A hardware token is a physical security device that generates a random, time-synchronized one-time password for authentication. This provides strong multifactor security because the user must possess the physical fob. Smart cards and PIV cards require insertion into a reader rather than generating codes.

Correct answer: B. Peer review

Peer review is the change management step where another knowledgeable administrator evaluates a proposed change for risk and compliance. This collaborative step catches errors before execution. Implementation occurs after approval, and a change freeze temporarily blocks modifications entirely during critical periods.

Correct answer: C. Full

A full backup copies all selected data every time it runs, taking the longest to complete but offering the fastest restoration. Incremental and differential backups only copy changes since the last backup, making them faster to run.

Correct answer: C. Disable any unneeded applications configured to automatically startup

Disabling unnecessary startup applications directly resolves high CPU usage immediately following the boot process. You can easily manage these applications using the Startup tab in Task Manager, preventing unwanted programs from launching automatically and draining resources.

Correct answer: B. 25

SMTP uses port 25 to send emails between servers, making it the correct port to open on the firewall. Port 143 is for IMAP and port 110 is for POP3, which are used to retrieve emails rather than send them between servers.

Correct answer: B. Shutdown

The shutdown option closes all open programs and services before powering off the computer completely. Sleep and hibernate save the current session to memory or disk without closing applications, while lock simply secures the desktop.

Correct answer: A. String

A string data type stores sequences of characters, making it the correct choice for text like a name. Integers and floating-point numbers handle mathematical values, while booleans only represent true or false states.

Correct answer: D. Rogue anti-virus

A rogue anti-virus uses fake alerts to trick users into installing malware. The Windows alert appearing on macOS clearly indicates a scam. Phishing typically harvests credentials via email, not browser pop-ups.

Correct answer: B. Data security

Data security is the most critical factor when deciding between external cloud sharing and internal hosting. Processing speed and scalability are important operational metrics but are secondary to protecting sensitive corporate information.

Correct answer: B. Signal strength or power level

The correct answer works because lowering the radio power limits how far the signal travels, keeping it inside the building. While MAC filtering is a valid security option, it requires heavy administrative overhead to manage constantly changing students.

Correct answer: C. Application log

The correct answer works because the Windows application log captures errors and crashes for user-installed programs like Excel. The system log tracks operating system and hardware driver events, not individual software crashes.

Correct answer: A. Indexing Options

The correct answer works because Indexing Options catalogs file locations and metadata to dramatically speed up local search queries. File Explorer Options only changes how folders display visually, but it does not improve the underlying search speed.

Correct answer: D. Password expiration

Password expiration forces periodic password changes, limiting the window of opportunity if a password is compromised. Password history prevents reusing old passwords, while complexity focuses on making the password harder to crack, not limiting its lifespan.

Correct answer: C. Disconnect the workstation from the network to stop the spread..

Isolating the workstation from the network immediately stops ransomware from spreading to shared network drives. Running an antivirus scan or copying files should only happen after containment to avoid spreading the infection or losing volatile evidence.

Correct answer: B. Notepad

The HOSTS file is a plain text file used for manual DNS resolution, so it can be easily modified using Notepad. Regedit is incorrect because it is used to modify the Windows Registry, not local text configuration files.

Correct answer: C. Disable Developer Mode when not actively testing the application

Disabling Developer Mode when not testing mitigates security risks and reduces battery drain by restoring default system restrictions. Disabling security warnings is a poor practice because it removes critical alerts against unsigned applications.

Correct answer: A. Synthetic

A synthetic backup is assembled by merging a previous full backup with subsequent incremental backups. The exam cue here is the word merged or synthesized, which distinguishes it from standard differential and incremental backup methods.

Correct answer: C. Brute-force

A brute-force attack systematically tries every possible character combination until the password is found. Dictionary attacks rely on word lists, so they fail against random strings, making brute force the correct choice for exhaustive guessing.

Correct answer: B. Blocklist

A blocklist explicitly denies specified items while implicitly allowing everything else. An allow list does the exact opposite by explicitly permitting items and blocking the rest, which is not the behavior described in the scenario.

Correct answer: A. Purchase a new laptop as the cost to repair might be more than a new laptop

Recommending a new laptop is appropriate when repair costs approach or exceed the device's replacement value. Fixing an obsolete system with an unsupported operating system provides poor long-term value compared to purchasing newer hardware.

Correct answer: B. System log

The system log records operating system level events, including driver failures and hardware conflicts. The application log only tracks program errors, and the security log records audit events like logon attempts, making neither useful for hardware conflicts.

Correct answer: D. Disk Management

Disk Management is the primary Windows graphical utility used to initialize new drives and create or format partitions. The Disk Defragmenter optimizes existing file storage but cannot create new partitions on unallocated space.

Correct answer: A. Risk analysis

The risk analysis component of a change request identifies potential adverse effects and the likelihood of failure during implementation. The plan dictates the steps, while the scope defines exactly which servers are affected.

Correct answer: D. WPA2

WPA2 uses a pre-shared key to authenticate wireless clients using a shared password. IPsec encrypts VPN tunnels, while geofencing restricts access based on physical location rather than a network passphrase.

Correct answer: B. System

The System applet displays the installed operating system version, CPU, and RAM specifications. Device Manager manages hardware drivers, whereas Programs and Features handles application installations.

Correct answer: B. Enable automatic updates to keep virus definitions current.

Enabling automatic updates ensures the antivirus receives the latest threat definitions to resolve the outdated warnings. Disabling alerts or running manual scans leaves the system vulnerable because the core issue remains unfixed.

Correct answer: D. pathping

The pathping command identifies network latency and packet loss at intermediate routers between a source and destination. While ping tests basic reachability, pathping combines routing discovery with extended polling to pinpoint problematic hops.

Correct answer: A. Perimeter network

A perimeter network isolates public-facing servers like a Minecraft host from the internal local area network. Placing the server directly on the LAN exposes the internal network to internet threats, making the perimeter network the safest choice.

Correct answer: C. System log

The System log records driver load failures and hardware conflicts, making it the best place to check for video card driver updates. The Setup log only covers installation events, so it misses post-install driver changes.

Correct answer: B. Power Options

The USB selective suspend feature is configured in the Power Options section of the Control Panel. This feature allows the system to power down individual unused USB ports to conserve battery life on laptops. The other options manage network settings, file views, and search indexing.

Correct answer: A. Refresh installation

A refresh installation restores system files and settings to their defaults while keeping user data and Windows Store apps intact. This makes it ideal for malware removal without losing personal files. A clean install would wipe everything, while an in-place upgrade preserves all standard applications.

Correct answer: A. A critical hardware driver failed or incompatible hardware was installed

A Blue Screen of Death indicates a critical system-level error, most commonly caused by faulty hardware drivers or incompatible hardware. These stop errors protect the system from data corruption. Low disk space or routine antivirus detections happen at the software level and do not cause kernel crashes.

Correct answer: B. Task Manager

Task Manager lets you view CPU utilization and terminate high-resource processes to resolve performance issues. While Performance Monitor can track resource usage, it cannot manage or end running processes, making Task Manager the correct choice.

Correct answer: D. Open license

An open license allows users to freely use, modify, and distribute software without paying licensing fees. Corporate or enterprise licenses require payment and are designed for business use, making them incorrect for this budget-conscious user.

Correct answer: A. Password style

Password policies typically define complexity, length, history, and expiration requirements rather than aesthetic choices. Password style is vague, and a strict policy might technically define style rules, making this an imperfect distractor.

Correct answer: C. Explicit allow for inbound, explicit allow for outbound

Allowing only traffic that matches an existing rule creates an explicit allow posture for both inbound and outbound traffic. This is the strictest security stance because it blocks all unauthorized network traffic by default. Implicit allow is less secure because it permits all non-blocked traffic.

Correct answer: C. Disk management

To check S.M.A.R.T. error reporting, you should use the Disk Management console to view the status and health of attached drives. While Disk Management shows basic drive status, other third-party tools or the BIOS or UEFI are often better for detailed S.M.A.R.T. diagnostics.

Correct answer: B. Rebuild the user's Windows profile

Rebuilding a corrupted user profile is the standard fix for extremely slow profile load times in Windows. While disabling startup programs improves general boot times, it does not directly resolve underlying profile corruption causing the load delay.

Correct answer: D. WPA3

WPA3 is the most secure wireless encryption protocol because it uses Simultaneous Authentication of Equals to resist offline dictionary attacks. WPA2 is still widely used but is considered weaker due to known vulnerabilities.

Correct answer: A. Date and time

Web browsers rely on the local system clock to verify if a website's security certificate falls within its valid date range. If the workstation's date and time are incorrect, the browser will flag valid certificates as expired or invalid.

Correct answer: A. resmon.exe

Resource Monitor displays real-time usage of CPU, memory, disk, and network resources. System Information provides static hardware details, while Device Manager is used to manage drivers and hardware configurations.

Correct answer: B. Browser displays a closed padlock icon next to the website address.

A closed padlock icon in the address bar confirms the website is using a valid security certificate to encrypt data. Sites starting with HTTP lack this secure encryption, while clearing cookies only affects local privacy.

Correct answer: C. Mission Control

Mission Control allows macOS users to create and manage multiple virtual desktops, called Spaces, to organize applications efficiently. The Dock manages active applications, and Boot Camp facilitates dual-booting Windows.

Correct answer: D. Constant

A constant stores a fixed value that never changes during script execution, making it ideal for mathematical conversion factors. Variables hold data that can change, while loops repeat code blocks throughout the program.

Correct answer: A. Unexpected pop-ups appear even when no browsers are open.

Unexpected pop-ups appearing without a browser open strongly indicate an adware or malware infection. Requiring manual restarts after updates is a normal software configuration behavior, not a definitive sign of malicious activity.

Correct answer: D. Obtaining certificates of secure data destruction from disposal vendors.

Obtaining a certificate of destruction provides documented proof needed for regulatory compliance. Simple reformatting fails because data can still be recovered, making it insufficient for securely destroying sensitive customer financial records.

Correct answer: C. tracert

The tracert tool traces the path of packets and reports on each hop to help isolate connectivity failures. Ping is incorrect because it only confirms end-to-end reachability without identifying where the path breaks.

Correct answer: B. It deletes stored copies of web pages to force fresh content loading.

Clearing the cache deletes locally stored copies of web pages, forcing the browser to fetch fresh content. Blocking harmful websites relies on security filters, while disabling tracking involves separate privacy settings.

Correct answer: D. Encrypting File System

The Encrypting File System allows individual users to encrypt specific files and folders on an NTFS drive. BitLocker is incorrect because it performs full disk encryption rather than individual file encryption.

Correct answer: A. Applications are running in the background, consuming system resources

The correct answer works because excessive background processes continually drain RAM and CPU cycles, directly causing the progressive sluggishness described. For the exam, remember that local typing delays point to system resources, instantly ruling out network congestion.

Correct answer: A. Malware or malicious code that compromises device security

Applications from unverified sources often contain malware designed to steal data or compromise the device. While missing automatic updates is a drawback, it does not present the severe security threat posed by embedded malicious code.

Correct answer: A. Credential Manager

Credential Manager caches network passwords, so outdated entries will constantly cause authentication prompts after a password reset. Updating or deleting the stored credentials resolves the conflict immediately.

Correct answer: B. Disabling AutoRun on the computer

Disabling AutoRun stops the malicious executable from launching automatically the moment the infected USB drive is connected. While strong passwords are good practice, they cannot prevent malware from executing directly via removable media.

Correct answer: A. Enable BitLocker · D. Enable a screen lock · E. Enable a UEFI password

BitLocker handles the hard drive encryption, the screen lock enforces the two-minute timeout, and the UEFI password secures the pre-boot environment. Multifactor authentication is a great security layer but does not directly fulfill these specific mandates.

Correct answer: C. Bring your own device policy

A bring your own device or BYOD policy governs how employees connect personal devices to corporate networks. A remote access policy covers connecting from off-site, but it does not define the use of personal equipment.

Correct answer: B. Require data at rest encryption on all endpoints

Full disk encryption protects data at rest if a device is lost or stolen. A virtual private network only secures data in transit over the network, so it would not protect the local database files copied to the stolen laptop.

Correct answer: C. Update Windows Defender definitions and restart the system

Updating Windows Defender definitions resolves the high disk usage caused by an outdated Antimalware Service Executable process. Disabling real-time protection compromises system security and should never be your first troubleshooting step.

Correct answer: B. winver

The winver command displays the installed Windows version and build number. The gpresult command shows group policy settings, while net user manages local accounts, and pathping tests network latency.

Correct answer: C. chown

The chown command changes user and group ownership of a file or directory in Linux. The chmod command modifies file permissions, while passwd manages user passwords and pwd displays the current directory.

Correct answer: B. Ease of Access

The Ease of Access Center contains Windows accessibility features like Narrator, Magnifier, and high contrast settings. The Sound applet configures audio devices, but it does not manage screen reading tools.

Correct answer: C. Worm

A worm replicates and spreads across networks automatically without user intervention. A virus requires a host file and human action to propagate, while trojans disguise themselves as legitimate software to trick users.

Correct answer: B. Return the system to the original state before the change

A rollback plan returns the system to its original state before the failed change began. Reverting only to a previous step might leave the system unstable, so you must fully back out of the change during the maintenance window.

Correct answer: C. SPICE

The SPICE protocol supports high-quality audio and video for Linux-based virtualized desktops. VNC lacks built-in multimedia redirection, while RDP is primarily designed for Windows environments and SSH is strictly command-line.

Correct answer: D. Task scheduler

Task Scheduler is the correct tool because it runs automated scripts or programs at specific times. Device Manager manages hardware, while MSConfig handles startup services and Performance Monitor tracks resource utilization.

Correct answer: A. Locate and remove the affected apps, run a security scan, and verify app permissions

Removing the suspicious apps, scanning for malware, and verifying permissions directly eliminates the adware causing the symptoms. Clearing the browser cache or performing a soft reset might temporarily mask the sluggishness, but it will not remove the malicious applications.

Correct answer: A. Access control vestibule

An access control vestibule uses two interlocking doors to prevent piggybacking and tailgating. Cipher locks and biometric readers authenticate users but cannot stop an authorized person from letting someone walk in behind them.

Correct answer: A. Power failure

A power failure is a total loss of utility power that a UPS battery backup is designed to mitigate. Surges and spikes are over-voltage events handled by surge protectors, while under-voltage events are brownouts.

Correct answer: C. Loop

A loop repeats a block of code until a specific condition is met, which is exactly what a Do While statement does. A branch uses statements like IF THEN ELSE to change program flow, but it does not repeat actions.

Correct answer: D. Add a rule to the ACL to allow traffic on ports 80 and 53

Browsing websites requires DNS on port 53 for name resolution and HTTP on port 80 for unencrypted web traffic. Without adding these rules before the deny any any statement, users cannot resolve or access web pages.

Correct answer: D. Vishing

Vishing is voice-based phishing where attackers call victims to extract sensitive information over the phone. Phishing typically uses email, whereas whaling and spear phishing target specific high-value executives or groups.

Correct answer: B. Time Machine

Time Machine is the built-in macOS backup utility designed to restore personal files, applications, and system states after deletion or corruption. Keychain manages passwords, while System Restore is strictly a Windows operating system feature.

Correct answer: B. Implement a biometric reader at the datacenter entrance and require passage through an access control vestibule

An access control vestibule physically prevents tailgating by ensuring only one person can enter the secure facility at a time. Pairing it with a biometric reader guarantees that each individual is positively identified before the first door unlocks.

Correct answer: D. Multiple users can edit documents at the same time.

Cloud-based word processing tools enable real-time collaboration, allowing multiple users to edit the exact same document simultaneously from different locations. Local applications traditionally restrict live editing and often require downloading files before making any changes.

Correct answer: A. GPT

The GUID Partition Table scheme supports massive partition sizes far exceeding the older 2 TB limit imposed by Master Boot Record. When formatting large modern drives in Windows, always choose GPT over MBR to ensure the full capacity is accessible.

Correct answer: A. passwd

The passwd command is used in Linux and macOS environments to update a user account password securely. The pwd command simply displays the current working directory, while chown modifies file ownership permissions.

Correct answer: D. Install a new battery backup

An uninterruptible power supply provides reliable battery backup to keep critical servers running safely during unexpected power outages. A standard surge protector only blocks voltage spikes and will not prevent data loss caused by sudden thunderstorm power failures.

Correct answer: C. kill

The kill command sends termination signals to active processes. For the exam, remember that ps lists running processes, while grep searches text output and ls lists directory contents.

Correct answer: C. Keychain

Keychain is the macOS credential manager that stores passwords and certificates securely. Mission Control manages virtual desktops, while Spotlight handles system searches and an Apple ID handles cloud account access.

Correct answer: A. Device Manager

Device Manager provides direct access to a network adapter's advanced properties, including speed and duplex settings. Internet Options manages browser connections, while the System window only displays installed hardware specifications.

Correct answer: C. apt-get

The apt-get command uses the Advanced Packaging Tool to install and manage software on Debian-based distributions. Remember that chown modifies file ownership, while pwd displays the current directory path.

Correct answer: D. When humidity is low

Low humidity allows static electricity to build up easily, making electrostatic discharge a major threat to computer components. High humidity helps dissipate those charges, while temperature changes are secondary factors.

Correct answer: D. Improved security with native encryption support

Apple File System provides native encryption support, enhancing data security over older file systems like HFS+. APFS is optimized for SSDs and does not natively support Windows compatibility, making the other options incorrect.

Correct answer: A. FaceID · D. TouchID

FaceID and TouchID use unique physical characteristics to authenticate users securely. Passcodes and swipe patterns are knowledge-based or gesture-based methods, which do not rely on biological traits for device access.

Correct answer: B. The processor is insufficient

The processor must be increased to at least 1 GHz to meet the minimum requirements for a 64-bit Windows installation. While memory and storage are important, watch for specific hardware thresholds in the question stem that fall just below official operating system minimums.

Correct answer: A. Physical network diagram

A physical network diagram details the actual hardware locations and cable connections, such as patch panel ports. A logical network diagram is incorrect because it maps data flow and IP subnets rather than physical wiring.

Correct answer: A. Private

Selecting the Private network profile enables network discovery and allows access to shared devices like printers. The Public profile is wrong because it intentionally hides the computer and blocks file and printer sharing for security.

Correct answer: D. Cached data is being displayed instead of live updates.

Viewing cached data instead of live updates causes users to see outdated information in shared files. Refreshing the application or clearing the cache typically resolves this synchronization discrepancy without needing a reboot.

Correct answer: C. Device manager

Device Manager lets you select the problematic hardware and use the Driver tab to roll back to the previously working driver version. System Information only displays configuration data, while Performance Monitor just tracks resource usage over time.

Correct answer: C. FIFO Backup

A First In, First Out backup scheme inherently overwrites the oldest media with the newest backup being performed. The Grandfather-Father-Son rotation keeps historical archives, so it intentionally protects older media from immediate overwriting.

Correct answer: C. The system is overheating due to a failing cooling fan or blocked ventilation

The correct answer works because sudden shutdowns without error messages typically trigger the system's built-in thermal protection to prevent hardware damage. Expect application crashes or system freezing with insufficient memory, whereas a failing fan or blocked ventilation causes an immediate power loss to prevent overheating.

Correct answer: A. Smartcard and PIN

The correct answer works because multi-factor authentication requires combining two distinct validation types, such as a smartcard and a PIN. Choosing a username and password fails because both fall under the same knowledge category, meaning it remains single-factor authentication.

Correct answer: C. Spear phishing

The correct answer works because spear phishing targets a specific group of individuals within an organization to steal confidential information or credentials. Standard phishing involves sending massive, untargeted emails to random users, whereas whaling specifically targets high-level executives or wealthy individuals.

Correct answer: B. Smartcard and PIN

The correct answer works because multi-factor authentication requires combining two distinct validation types, such as a smartcard and a PIN. Choosing a fingerprint and retinal scan fails because both fall under the same biometric category, meaning it remains single-factor authentication.

Correct answer: C. Windows 10 Enterprise · D. Windows 10 Pro

Windows 10 is the correct choice because it is the latest Microsoft operating system that still offers a 32-bit edition for older x86 processors. Windows 11 exclusively requires a 64-bit architecture, so it cannot be installed on an x86 system.

Correct answer: B. System log

The System log records events generated by Windows components, including background service failures like the print spooler. The Application log is for software-specific errors, while the Security log tracks audited events like logon attempts.

Correct answer: A. Single-factor

Single-factor authentication is correct because it relies on only one category of credentials, specifically something you know. Multifactor authentication would require an additional factor from a different category, such as a token or biometric scan.

Correct answer: B. Spotlight

Spotlight is the built-in macOS search utility that indexes files and applications across the system to find keywords. Finder is the default file manager used to navigate folders, while the Dock is used to launch applications.

Correct answer: A. Performing standard formatting on the hard drives.

Standard formatting prepares the drive for reuse by clearing the file system table. However, because standard formatting leaves data recoverable, a test-taker could argue it fails basic data sanitation requirements for repurposed equipment.

Correct answer: A. Require biometric identification for user logins

Biometric identification is the strongest preventive control because it requires a unique physical trait to log in. Passwords can be shared or stolen, and security cameras only record the unauthorized access after it has already occurred.

Correct answer: B. Unintended Bluetooth pairing

Unintended Bluetooth pairing occurs when an unknown device connects to a mobile device without the owner's explicit intent. This allows potential unauthorized access to the device, whereas location tracking or microphone activation represents subsequent privacy violations.

Correct answer: A. Changes made by one user appear in real time for all users with access.

Cloud-based spreadsheets enable simultaneous editing with real-time updates for all users with access. Downloading and re-uploading creates version control issues, while locking or restricting access prevents effective collaboration.

Correct answer: C. SSH

SSH provides encrypted remote command-line access to Linux servers. Telnet transmits data in plain text and should never be used, while RDP is used for graphical Windows connections, not Linux command-line administration.

Correct answer: C. Trojan

A trojan disguises malicious code inside a seemingly harmless program, such as a key generator. Worms replicate and spread on their own without user interaction, whereas trojans rely on the user executing the disguised file.

Correct answer: B. SSH in tunnel mode

Tunneling unencrypted VNC traffic through an SSH connection secures the remote desktop session. Switching to RDP ignores the requirement to use the installed VNC server, while WPA2 only secures local wireless networks.

Correct answer: B. Open-source

Open-source software provides its source code freely, allowing users to install and run the software without paying licensing fees. Personal, enterprise, and corporate licenses all require purchased agreements, making them poor choices for a strict zero-cost requirement.

Correct answer: C. Explicit allow for inbound, implicit allow for outbound

The Windows Defender Firewall defaults to an explicit allow posture for inbound traffic, meaning it blocks connections unless a specific rule permits them. Conversely, it uses an implicit allow posture for outbound traffic, allowing all outgoing connections by default.

Correct answer: D. Verify the digital certificate is installed on the device

Encrypted emails require the correct digital certificate to be installed locally on the device to decrypt and read the message content securely. Asking the sender to forward the email unencrypted directly violates standard corporate security and privacy policies.

Correct answer: B. Reset the web browser's proxy setting

Universal browser redirection often stems from a malicious proxy server configured in the network settings. Resetting the web browser's proxy configuration fixes this hijack. Antivirus scans catch malware but rarely clear proxy configurations.

Correct answer: A. Change the Maps setting to while using

Setting Maps to use location only while the app is actively running stops continuous background GPS polling. Background location tracking heavily utilizes the GPS receiver and cellular modem, rapidly draining the battery and generating heat.

Correct answer: D. Floating-point

A floating-point data type is used to store fractional or decimal numbers like 3.14. Integers only store whole numbers, so they cannot be used for values requiring decimal precision.

Correct answer: A. .js

The correct answer works because JavaScript files use the .js extension to create interactive web content alongside HTML. For the exam, associate Linux administration with .sh, Windows administration with .vbs and .ps1, and interactive web pages exclusively with .js.

Correct answer: C. Clear the app's cache

The correct answer works because clearing the application cache removes corrupted temporary files that frequently cause mobile app crashes. Always start with simple, non-destructive steps like clearing the cache before moving to time-consuming, disruptive actions like reinstalling the software or updating the OS.

Correct answer: A. Configure the user's account

The correct answer works because users must have properly configured active directory accounts before they can authenticate and access domain resources. Configuring file server access or installing applications happens later, as users need valid credentials and appropriate permissions before utilizing network services.

Correct answer: B. ls

The correct answer works because typing ls at a Linux terminal lists all files and directories within the current working path. Remember that pwd simply prints your current location, while sfc and chkdsk are Windows utilities used to repair corrupted file systems.

Correct answer: B. Implement a CMDB

A configuration management database tracks all hardware and software configurations while documenting changes for review. Group Policy restrictions can prevent unauthorized software installations, but they do not provide the requested historical tracking and asset management capabilities.

Correct answer: B. Force the unresponsive task to quit

Forcing the unresponsive task to quit directly resolves the immediate issue without requiring a full system reboot. You can use Task Manager to identify the hanging process and end it, restoring system responsiveness quickly and efficiently.

Correct answer: C. Internet Options

Internet Options within the Windows Control Panel contains the necessary configuration settings to manage browser add-ons, security zones, and pop-up blockers. While modern browsers handle their own settings now, this applet remains the correct tested utility.

Correct answer: C. Display settings

A screen locking after 30 minutes forces the display to stay on too long, draining the battery and generating excess heat. Reducing this timeout resolves the overheating issue. Push email drains batteries, but not as severely as an active display.

Correct answer: A. Take the document to the office manager

Handling sensitive data requires proper chain of custody or secure delivery to authorized personnel. Handing it to the office manager is a safe step. Shredding it is also secure, but standard policy prefers alerting management first.

Correct answer: D. Setup log

The correct answer works because Windows installation and upgrade events are specifically recorded in the Setup log within Event Viewer. Remember that the System log tracks driver failures and hardware conflicts, while the Application log monitors software-specific errors and crashes.

Correct answer: D. Incorrect security settings in the email client

The correct answer works because email clients block automatic image downloads by default to prevent malicious tracking pixels and potential malware infections. While proxy servers or firewalls could theoretically block traffic, the red X or missing image placeholder is a classic client-side security feature.

Correct answer: D. Support for files larger than 4GB

FAT32 has a strict architectural limit that prevents storing individual files larger than four gigabytes. While NTFS also provides file permissions, the exam frequently tests FAT32 file size limits as a primary distinction.

Correct answer: A. Loop

A loop is correct because it repeats a block of code until a specific condition is met, making it ideal for displaying numbers one through one hundred. A branch only alters flow based on a condition, while a constant stores a fixed value.

Correct answer: C. Allow list

An allow list explicitly permits only identified items and denies everything else by default. A blocklist takes the opposite approach by explicitly denying specific items, while MAC filtering applies this concept to hardware addresses rather than IP addresses.

Correct answer: C. WPS

Wi-Fi Protected Setup uses a push button or PIN method to automate wireless network configuration. The other options are encryption standards like WEP or WPA2, which secure the data transmission but do not provide an automated setup mechanism.

Correct answer: D. Deploy the patch in a sandbox environment to test it before patching the production system

Testing patches in a sandbox or staging environment isolates potential issues before they impact live operations. Deploying directly to production risks unplanned downtime, and waiting exposes the system to active exploitation.

Correct answer: A. Change freeze

A change freeze prevents non-essential updates during critical business periods to maintain system stability. A maintenance window is scheduled downtime for applying changes, whereas an emergency change addresses unforeseen critical issues.

Correct answer: A. dir

The dir command lists files and directories in the Windows Command Prompt. While ls performs the same function, it is primarily a Linux command and only works in PowerShell on Windows.

Correct answer: D. Firmware updates

Firmware updates cannot be deployed through standard Windows Update because they must be flashed before the operating system loads. Windows Update only handles security patches, critical fixes, and driver updates.