220-1202 CompTIA A+ Core 2 (2026 Exam Update) Questions and Answers

Inbox mail 1 -Account Locked- Phishing - Report email to Information Security

Inbox mail 2 -Share your feedback - Legitimate - Perform no additional actions

Inbox mail 3 –Employee orientation - Legitimate - Perform no additional actions

Inbox mail 4 –Security Update – Spam - Report email to Information Security

Inbox mail 5 –Interview - Legitimate - Perform no additional actions

—

The completed configuration:

1. Wireless AP (LAN side)

1. LAN IP: 192.168.10.1

2. Encryption: WPA2 PSK

2. Router (port-forward rule)

1. Allow TCP Any 3389

This forwards inbound RDP traffic (TCP/3389) from the Internet to the Windows PC, enabling Remote Desktop access.

3. Firewall (screened subnet side)

1. LAN IP: 10.100.0.1

4. Device placement

1. PC: place behind the router (where the port-forward rule points).

2. Game console: place on the Wireless AP (so it can use chat and extra services over WPA2 PSK).

3. Firewall: place in front of the screened subnet (with its 10.100.0.1 IP facing that subnet).

The Windows PC is placed in the screened subnet (behind the firewall) for enhanced security. Remote access to this PC requires port forwarding of TCP port 3389 (RDP), which is correctly configured through the router.

The Game Console is placed on the Wireless AP LAN, using WPA2 PSK for a secure wireless connection. Game consoles typically use peer-to-peer chat and online services that require open access without firewall restrictions, which is why the console is not placed behind the firewall.

CompTIA A+ 220-1102 Reference Points:

Objective 3.4: Given a scenario, implement best practices associated with data and device security.

Objective 2.4: Given a scenario, use appropriate tools to support and configure network settings.

Study Guide Reference: CompTIA A+ Core 2 guides recommend using screened subnets (a type of DMZ) for systems needing controlled external access, such as remote desktops, while placing gaming and media devices on less restricted networks for full functionality.

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig

Issue (drop-down)

Limited network connectivity

Why this matches:

“Internet Down” most commonly indicates the workstation has lost valid Layer 3 connectivity (bad/expired DHCP lease, APIPA address, wrong gateway, etc.). In CompTIA A+ terms, this aligns best with limited connectivity symptoms (can’t reach internet resources).

Resolution (drop-down)

Refresh DHCP

Why this is the most efficient fix:

If the client has:

an expired lease

an APIPA address (169.254.x.x) because DHCP failed

an incorrect IP/gateway from a bad lease

…then the fastest first remediation is to renew DHCP to obtain a correct IP address, default gateway, and DNS servers. This is a standard CompTIA A+ troubleshooting action (quick, low-risk, high-success).

Verify/Resolve (drop-down)

ipconfig

Why this is the correct verification tool:

ipconfig is the primary Windows CLI tool to:

check current IP settings (ipconfig /all)

release/renew DHCP (ipconfig /release and ipconfig /renew)

confirm you received a valid IP + gateway + DNS, which is required for internet access.

What you would do (mapped to those choices)

Using ipconfig to complete “Refresh DHCP” and confirm the fix:

Check current addressing

ipconfig /all

Look for:

Valid IPv4 (not 169.254.x.x)

Valid Default Gateway

DNS servers present

Refresh the DHCP lease

ipconfig /release

ipconfig /renew

Verify outcome

Run ipconfig again to confirm:

You now have a correct IP for the network

Default gateway is populated

If the gateway/DNS populate correctly, internet access typically returns.

Host 2, Host 3, Host 4 , Host 5 ,Host 6, Host 7, Host 8 , Media Server - Stop All unwanted and malicious service (Persistance.j1zpxn Installer Service) from all the listed host and Media servers

Refer screenshot below on the required service started/stopped on host2, same service to be started and stopped across all host servers.

A screenshot of a computer AI-

A screenshot of a computer AI-

Ticket #8675310

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig /renew

For the Low priority ticket #8675310 (“A small yellow triangle appeared in the taskbar. I am no longer able to access network resources.”), the Windows yellow triangle on the network icon is the classic indicator of limited connectivity (often caused by a bad/expired DHCP lease, APIPA address, missing default gateway, or DNS info not being assigned).

Correct PBQ Selections (Ticket #8675310)

Issue

Limited network connectivity

Why (CompTIA logic):

That yellow warning triangle means the NIC is connected at Layer 2 (link is up), but the system likely doesn’t have valid Layer 3 config (IP/gateway/DNS), so it can’t reach network resources.

Resolution

Refresh DHCP

Why this is the most efficient fix:

When a Windows PC can’t access network resources and shows “limited connectivity,” the fastest, lowest-risk fix is to renew DHCP so the PC can pull:

a valid IP address

default gateway

DNS servers

This directly resolves the most common root cause behind that icon.

Verify / Resolve

ipconfig /renew

Why this is the correct verification/remediation command:

ipconfig /renew is the direct command to request a fresh DHCP lease. After renewal, the user should regain access to network resources if DHCP was the issue.

What this fixes (what you’d expect to see)

Before the fix, the attachment (Output.txt) in these PBQs typically shows symptoms like:

169.254.x.x (APIPA) → DHCP failed

Missing/blank Default Gateway

DNS not present or incorrect

After ipconfig /renew, you should see a normal private IP (like 192.168.x.x / 10.x.x.x / 172.16-31.x.x) and a valid gateway/DNS.

The correct answer is C. exFAT . macOS can read and write several file systems, but among the listed choices, exFAT is the best answer because it is designed for broad compatibility and is commonly used on removable storage shared between Windows and macOS. The Sybex practice-test explanation states that macOS can only read NTFS partitions but can both read and write to exFAT partitions. The All-in-One Exam Guide also explains that macOS can read and write FAT32 and exFAT, while it only reads NTFS. NTFS is the standard modern Windows file system but is not writable by macOS without extra tools. ReFS is a Microsoft file system used for specific Windows storage scenarios, and XFS is a Linux/UNIX-style file system. Therefore, when a macOS system must write data to a volume from the listed options, exFAT is the correct choice.

The su (substitute user) command is used in Linux to switch to another user account, most commonly to escalate privileges by switching to the root (administrator) account. It allows administrative tasks to be performed in a terminal session.

A. runas is a Windows command for executing a program under another user ' s context.

B. cmcl is not a valid Linux or administrative command.

C. net user is a Windows command for managing local user accounts.

BitLocker To Go is a Microsoft encryption feature specifically designed for removable drives such as USB flash drives and external hard drives. It allows users to protect the data on these devices by requiring a password to decrypt the contents, thereby preventing unauthorized access in the event the device is lost or stolen.

A is correct because BitLocker To Go is directly tied to password-protecting removable media.

B and C are unrelated to BitLocker To Go; Secure Boot and VPN encryption are entirely different security layers.

D applies to BitLocker (not BitLocker To Go) and full disk encryption on internal drives using TPM.

The best first step is to leverage existing documentation: check whether the issue was previously recorded and resolved, and reuse that known fix (or confirm conditions). Mike Meyers explains ticketing systems capture key information needed to resolve issues, including “ problem description ,” “ progress notes ,” and “ problem resolution ,” and stresses that “ Clear, concise writing is critical ” because you “won’t be the only tech responding to every ticket.” That is exactly why you review prior tickets first—so you can quickly see what was done previously and apply it consistently.

The All-in-One guide reinforces the same ticketing-system concept and lists the same essential elements (description, notes, resolution) used to streamline troubleshooting and escalation. Consulting the prior technician (A) may be impossible (the employee is gone) and slower than checking documented history. Opening a new case (D) is important, but the question asks what to do first —review the prior occurrence details, then document your current case using what you find.

Because this is a government client with confidential data and a strict requirement to follow regulatory compliance, the best practice is to use a certified third-party destruction service that can provide documented proof of destruction. The All-in-One guide explicitly notes that “professional hard drive disposal services are third-party vendors” that guarantee drives are thoroughly destroyed by issuing a certificate of destruction/recycling, which provides assurance that data will not fall into the wrong hands. Mike Meyers’ Lab Manual repeats the same exam point: third-party vendors “will guarantee they have truly, thoroughly destroyed drives by issuing a certificate of destruction/recycling.”

Low-level formatting (often used to mean overwrite/zero-fill) can sanitize drives, but it may not satisfy the requirement for provable compliance and chain-of-custody documentation, especially for regulated environments. Targeted deletion is ineffective because deleted data can remain recoverable. In-house incineration is extreme and may be restricted, unsafe, or noncompliant without proper facilities and documentation. Therefore, Certified third-party destruction (B) is the best option.

The correct answer is A. .app, because macOS applications packaged as .app files are typically self-contained application bundles. This means that all required application files are stored within a single directory that appears as one file in Finder. When the .app file is moved to the Trash, the application is effectively removed from the system.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, macOS applications are commonly distributed as .app bundles, allowing for simple installation and removal. This design contrasts with Windows, where applications often install files across multiple directories and require uninstallers.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that dragging a .app file to the Trash is generally sufficient to uninstall the software, although some applications may leave behind preference files or caches. However, from an exam perspective, .app is the only option that supports this uninstall behavior.

The Mike Meyers / Mark Soper Lab Manual further clarifies that .msi and .exe are Windows formats, .rpm is used by Linux package managers, and .pkg installers often install system-wide components that require a formal uninstallation process.

Because .app files support simple drag-to-trash uninstallation, A is the correct answer.

3-D rendering is a graphics-intensive workload, and minimum hardware checks for this type of software commonly fail due to GPU capability (including dedicated vs. integrated GPU support) and VRAM requirements. Quentin Docter explains that application “Display” requirements can include “a graphics processing unit (GPU). A specific GPU may be required if the application will process video or graphics.” He also notes that “VRAM requirements are typically related to applications that are graphic intensive, such as gaming,” which aligns strongly with 3-D rendering workloads.

Mike Meyers’ Lab Manual reinforces that “graphically demanding applications… state specific graphics requirements,” and that CompTIA focuses on “dedicated graphics cards versus integrated ones,” because integrated GPUs are often less capable for demanding graphics tasks. It also reminds that systems with integrated GPUs share RAM with graphics, which can matter when software checks VRAM.

Therefore, the first thing to verify is GPU requirements (B), not USB/NIC/PSU.

Linux commonly uses Linux-native filesystems (such as ext4, XFS, BTRFS, and others). The All-in-One Exam Guide explicitly states: “Linux users have lots to choose from; most use ext4, but you will see others with names like BTRFS, XFS, ZFS, and so on.” That directly links XFS to Linux.

By contrast, the same source identifies NTFS, FAT32, and exFAT as Windows file systems, with exFAT mainly for removable media, showing that FAT32/NTFS are primarily Windows-associated in A+ context. Quentin Docter also explains Linux’s ext-family filesystems (ext3/ext4) as Linux defaults in many distributions, reinforcing that Linux has its own native filesystem ecosystem rather than using NTFS/APFS as its typical format.

APFS is Apple’s filesystem for macOS/iOS devices, not Linux. FAT32 is cross-platform but not “typically associated” with Linux as a primary filesystem. Therefore, XFS (B) is the best answer.

User offboarding involves disabling the departing user ' s access to company systems and facilities. Two key tasks typically include:

Deactivating physical access credentials (e.g., key fobs or badges) to prevent unauthorized entry (B).

Suspending or disabling the user’s email account to prevent future use and to retain business communications (D).

A. Quarantining a hard drive is not standard unless malware or legal issues are involved.

C. Purging PII must follow legal retention policies; it ' s not typically an immediate offboarding task.

E. Disabling network ports may be relevant in some cases but is not a standard offboarding step.

F. Blocking MAC addresses is not typical unless the device is considered a security threat.

The correct answer is C. Cryptominer . Cryptominer malware secretly uses a victim computer’s processing resources to mine cryptocurrency for an attacker. Because cryptocurrency mining requires heavy computation, this malware commonly causes unusually high CPU or GPU usage. The All-in- One Exam Guide explains that cryptominers take control of a computer’s hardware resources to mine cryptocurrency and that a telltale sign may be inexplicably high GPU or CPU utilization. The Mike Meyers/Mark Soper material states the same concept: cryptominer malware uses the target system’s CPU or GPU, and one sign of infection is unexplained high resource usage. A keylogger records keystrokes, a Trojan disguises itself as legitimate software while performing malicious actions, and a rootkit hides itself using low-level OS access. Those malware types can be dangerous, but high CPU usage most strongly points to a cryptominer.

The correct answer is B. Getting assistance to lift the hardware . A rack-mounted UPS can be very heavy because it contains one or more internal batteries. When replacing or installing heavy rack-mounted equipment, the technician must consider personal safety and proper lifting techniques before performing the work. The Sybex practice-test explanations state that a UPS, also called a battery backup, can range in size from a small unit to equipment as large as an entire server rack, and it contains batteries and fuses used to provide power protection during power problems. The same source also explains that technicians should bend at the knees, lift with the legs, observe weight limitations, and use a partner lift or cart when needed. Compressed air is related to cleaning, not replacing a UPS. Low-voltage regulations and fire suppression systems may be relevant to facility planning, but the immediate safety concern when replacing rack-mounted hardware is safe lifting and handling.

MDR (Managed Detection and Response)provides outsourced threat monitoring and response using multiple tools. The use of athird-party providerfor protection and incident handling confirms MDR.

FromQuentin Docter – CompTIA A+ Study Guide:

“MDR provides 24/7 threat detection and response through outsourced experts using advanced tools across client environments.”

A low-level format (also referred to as a zero-fill or full format) writes over every sector on a storage device, effectively destroying the existing data and making recovery nearly impossible. Unlike degaussing, which renders the drive unusable, a low-level format maintains the integrity of the device, allowing it to be repurposed or reused.

A. Deleting partitions does not fully erase data; it only removes references in the partition table.

B. EFS (Encrypting File System) encrypts files but does not securely wipe them.

D. Degaussing destroys the magnetic structure of a drive, making it inoperable and not reusable.

Credential managers or password vaults (e.g., Windows Credential Manager, KeePass, or LastPass) store passwords securely. The integrity of such tools heavily depends on the strength of the master password protecting the vault. If compromised, all saved credentials could be exposed. Therefore, setting a secure master password is crucial.

A. Login time restrictions are general user account settings, not specific to credential managers.

C. TPM is used more commonly for full disk encryption, not specifically required for password managers.

D. The lock screen protects general access but does not protect stored credentials alone.

TheDo Not Disturbsetting in Windows Notification settings allows users to suppress all notification banners and sounds during presentations or video calls.

FromTravis Everett – All-in-One Exam Guide:

“Use Windows ‘Do Not Disturb’ to prevent notifications from interrupting full-screen apps like video conferencing.”

The combination of extreme slowness , browser redirection to unknown sites , outdated antivirus , and blocked access to security settings strongly indicates a malware infection localized to that device (especially since other workstations and network diagnostics are normal). Quentin Docter lists browser redirection as a common security symptom (“Your browser is redirected to websites”) and stresses that if you experience even one of these security symptoms, you should “immediately rectify the security issue or quarantine the system .”

In malware removal best practices, the first operational containment step after verifying symptoms is to isolate/quarantine the infected system to prevent spread, credential theft, or further compromise. Disconnecting the device from the network accomplishes this containment so investigation (logs, scans, offline tools, safe mode, etc.) can be done without risking other systems. Clearing cache (B) is too narrow and doesn’t address blocked security settings/outdated AV. Firewall checks (A) and raising settings (D) don’t contain the threat and may be prevented by the malware itself. Therefore, the next step is to disconnect and investigate .

Event Viewer is the primary tool used to investigate system-level errors and logs, including BSODs. When a BSOD occurs, Windows logs the error codes and associated system behavior under “System” logs in Event Viewer. This allows the technician to review crash events, identify error codes (e.g., STOP codes), and pinpoint hardware or driver issues.

B. Performance Monitor is used for real-time performance tracking and trend analysis, not crash logs.

C. System Information displays system specs but not crash logs or events.

D. Device Manager shows device status and driver issues but doesn’t retain error logs related to BSODs.

Before you can accurately understand impact (what will break, what will change, what dependencies exist), you should validate the change in a controlled environment. Mike Meyers’ Lab Manual defines sandbox testing as using a safe place “where you can experiment without messing up the primary system,” typically a virtualized environment that isolates the test machine and enables restore from snapshots. It states sandbox testing “entails checking out new and updated applications without putting the systems and data you depend on at risk.”

The All-in-One guide mirrors this exact best practice for change management, emphasizing that you don’t roll changes into production for many users/systems without “thorough testing and analysis,” and highlights sandbox testing as a documented business process used to evaluate changes safely. In this scenario, the scope is known, so the next “first” practical procedure to evaluate effect is to test it in a sandbox so you can then measure and document impacts based on evidence. A rollback/backup plan is critical, but sandbox testing comes first to determine what safeguards are required.

If uploading fails only offsite,mobile data limits or restrictionsare the likely cause. Data caps or network management can interfere with uploads.

FromTravis Everett – All-in-One Exam Guide:

“When mobile users experience network issues, always check if the device has reached a data cap or roaming restriction.”

AnNDA (Non-Disclosure Agreement)is used to ensure confidentiality of sensitive company information, especially when interacting with external parties.

FromQUENTIN DOCTER - COMPTIA A+ COMPLETE study GUIDE:

“An NDA ensures that confidential information is not disclosed to unauthorized individuals, especially important in external communications.”

The issue described—“domain cannot be found” despite the ability to ping the server and access the internet—indicates aDNS resolution problem, not a network connectivity issue. The workstation is currently usingpublic DNS servers (8.8.8.8 and 1.1.1.1)whichcannot resolve internal domain names, such as the ones used in Active Directory environments. To resolve this, the technician needs tochange the DNS settings to point to the internal DNS server, which in most domain setups is thedomain controller itself (likely 192.168.1.10 in this case).

Here’s the breakdown of the incorrect options:

B. Assign a static IP address: The IP is already assigned and functioning; the device can ping and reach the network and internet.

C. Configure a subnet mask: The subnet mask is appropriate for the network range (Class C /24).

D. Update the default gateway: The gateway is valid and allows internet access; this is not the issue.

CompTIA A+ 220-1102 Core 2 Objective Reference:

Objective 1.8 – Given a scenario, use features and tools of the operating system.

Under this objective, candidates must know how to troubleshoot OS-based network configurations, includingproper DNS settings in domain environments.

—

The symptoms suggest abrowser hijacker. Thefirst stepsshould be toremove any malicious extensionsandreset the startup pageto restore normal behavior.

FromAll-in-One Exam Guide:

“Browser hijackers often install as extensions and change homepage settings. Removing these extensions and resetting the startup configuration typically resolves the issue.”

The best option is to provide temporary elevation rather than permanently increasing a user’s privileges. Quentin Docter explains the principle of least privilege: users should have “the fewest number of privileges that they need to do their job,” because administrative access increases the chance of misconfiguration and security compromise. He also describes how User Account Control (UAC) supports least privilege by logging an administrator in with minimal permissions and then allowing the user to “run as a standard user with the ability to escalate privileges.” That is the practical idea behind just-in-time access—grant admin rights only at the moment they are needed.

The All-in-One guide reinforces this by explaining that if you are logged in with a less-privileged account, you can elevate for installs by entering admin credentials or choosing Run as administrator. Adding the user to the local Administrators group (D) violates least privilege. Assigning Power User (B) is not reliable in modern Windows and still broad. Manual installation (C) doesn’t solve the permission requirement.

Group Policyis the standard administrative tool for enforcing security and configuration settings across domain-joined systems, including disabling guest accounts.

FromQuentin Docter – CompTIA A+ Study Guide:

“Disabling guest accounts and applying consistent security policies across multiple machines is best achieved through Group Policy on a Windows domain.”

Memory usage is critically high, suggesting many applications or background processes. Closing unnecessary programs will immediately free up RAM.

FromTravis Everett – All-in-One Exam Guide:

“High memory usage with moderate CPU load usually means too many applications are open. Close unnecessary apps or use Task Manager to end processes.”

The correct answer is C. RDP (Remote Desktop Protocol), because RDP is the default remote access technology for Windows servers. It allows technicians to remotely connect to the graphical desktop environment of a Windows server to verify services, logs, and system status.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, RDP is built into Windows operating systems and is commonly used by administrators to manage Windows servers and workstations. It provides full access to the desktop, making it ideal for checking whether services such as IIS (Internet Information Services) are running properly.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that while SSH is commonly used for Linux and network devices, Windows servers typically rely on RDP for administrative access. VNC is a third-party remote desktop solution and is not enabled by default on Windows systems.

The Mike Meyers / Mark Soper Lab Manual reinforces that SPICE is primarily used in virtualized environments and is not a standard Windows remote access tool.

Because the technician needs to verify a Windows web server’s operational status using a built-in method, RDP is the most appropriate and likely technology, making C the correct answer.

Apps like GPS or roaming services often drain battery during travel.Checking app utilizationhelps identify battery drain sources.

FromQUENTIN DOCTER - COMPTIA A+ COMPLETE study GUIDE:

“Monitoring app activity can reveal high-power usage apps running in the background, especially when mobile data or GPS is active.”

The correct answer is C. Listen to the customer’s concerns and acknowledge their frustrations, because effective communication and empathy are critical components of professional help desk interactions—especially when customers are upset.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, technicians should always demonstrate active listening, empathy, and professionalism. Acknowledging a user’s frustration helps de-escalate tense situations and builds trust.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide emphasizes that users who feel unheard are less cooperative and more dissatisfied. Before troubleshooting or escalation, technicians should validate the customer’s experience and reassure them that the issue will be addressed.

The Mike Meyers / Mark Soper Lab Manual reinforces that blaming previous technicians or immediately escalating without communication can worsen the situation. Asking technical questions too early may come across as dismissive.

Because the goal is to communicate professionally and effectively, the technician should first listen and acknowledge the user’s frustration, making C the correct answer.

The correct answer is D. Chain of custody process, because chain of custody ensures that evidence collected during an incident response is tracked, preserved, and legally defensible. It documents who collected the evidence, when it was collected, how it was stored, and who accessed it throughout the investigation.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, chain of custody is essential when evidence may be used in disciplinary actions, audits, or legal proceedings. Any gap in documentation can render evidence inadmissible.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that chain of custody provides accountability and prevents claims of evidence tampering. Each transfer of evidence must be logged and verified.

The Mike Meyers / Mark Soper Lab Manual clarifies that while order of volatility determines the sequence of data collection, it does not track ownership or handling. Data integrity best practices ensure evidence is not altered, but they do not provide a record of custody.

Because the question focuses on handling and accountability, the required process is chain of custody, making D the correct answer.

Among the options, threat (end-user) education most directly addresses both preventing malware installation and preventing accidental disclosure of sensitive information, because it changes user behavior—the number one target of many attacks. Quentin Docter emphasizes: “By far the best prevention of security threats is the education of your end users regarding common threats,” explaining that the most effective method is teaching users not to open suspicious files and to open only those they’re reasonably sure are malware-free. Docter adds that trained users can better identify Trojans and phishing scams and should also learn guidelines for protecting sensitive information and recognizing social engineering threats.

Docter also states clearly that even when antimalware tools exist, “user education is much more effective” in preventing certain notification-based and trick-based malware installs. While Secure Boot, firewalls, and email gateways are valuable technical controls, they don’t cover the broad human-risk dimension of both malware installs and sensitive data disclosure as effectively as education/training. Hence B is correct.

“No OS found” commonly indicates the firmware can’t locate boot instructions for the installed OS. If the drive isn’t obviously failing (no unusual noises) and BIOS/UEFI settings are reasonable, a classic cause is a corrupt Master Boot Record (MBR) (on MBR-partitioned disks). Mike Meyers’ Lab Manual explains that when BIOS can’t find an OS, causes may include configuration issues or drive problems, but also states: “If the correct drive is already first in the boot sequence, the master boot record… may be corrupt and need to be rebuilt.”

The Lab Manual also explains what the MBR does: the first sector contains boot code that informs the system about installed operating systems, and “without this bit of code, your OS will never load.” The All-in-One guide describes the same: BIOS looks at the first sector for instructions, and without the MBR code, the OS won’t load.

NTFS corruption wouldn’t typically present as “no OS found” at the firmware stage, and TPM issues usually create different security/boot errors. Therefore, MBR (D) is most likely.

The correct answer is C. DDoS (Distributed Denial-of-Service), because the attack involves thousands of compromised machines, commonly referred to as a botnet, generating fraudulent traffic against an online service. Although the activity includes fake purchases, the scale and distributed nature indicate an attempt to overwhelm or disrupt the service.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, DDoS attacks use multiple systems to flood a target with traffic, exhausting server resources and preventing legitimate users from accessing the service. These attacks often involve compromised devices controlled remotely.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that DDoS attacks can take many forms, including HTTP request floods and application-layer attacks that mimic legitimate user actions, such as fake transactions.

The Mike Meyers / Mark Soper Lab Manual clarifies that brute-force attacks focus on credential guessing, spoofing involves identity falsification, and SQL injection targets database queries. None of those specifically require thousands of compromised machines.

Because the defining characteristics here are scale, distribution, and coordinated malicious activity, the correct classification is a DDoS attack, making C the correct answer.

If internal resources (such as intranet or internal apps) can ' t be accessed but external sites work, this often points to aDNS issue, where the system isn ' t resolving internal domain names correctly.

FromAll-in-One Exam Guide:

“When internet access is functional but internal sites fail to load, the issue usually lies with DNS resolution. Internal resources often require internal DNS servers, which may not be configured correctly.”

The question asks where to find ownership and business criticality details for a server. That type of “who owns it, what does it support, and how important is it” data is maintained in a Configuration Management Database (CMDB) as part of configuration/asset management. Quentin Docter discusses asset management as lifecycle tracking and emphasizes accountability, including assigning responsibility and tracking who is associated with assets.

The All-in-One guide similarly describes asset management databases as tracking details such as “who has the asset,” “what type of asset,” and “where this asset is located,” which supports the idea that ownership and operational relevance are stored in such systems.

An SLA defines service expectations, an SOP defines procedures, and an EULA covers licensing—none are intended to be the authoritative inventory/ownership record for a specific server. Therefore, CMDB is the correct answer.

With integrated graphics, “VRAM” is often not dedicated memory on a discrete card—graphics may instead borrow system RAM. Quentin Docter explains this directly: if the video card is built into the motherboard, it “likely won’t have its own memory but will share system memory,” meaning the total system RAM is split between the OS and video usage. Docter then answers the key “where do I change this?” question: “Shared memory is configured in the system BIOS/UEFI,” and some BIOS/UEFI setups allow you to set aside a specific amount (example given: 512 MB) for video memory.

That is exactly why the machine can have plenty of DRAM yet fail a VRAM check: the BIOS/UEFI allocation for integrated graphics may be set too low. Adjusting BIOS/UEFI settings to reserve more memory for the integrated GPU is the most direct way to attempt meeting a VRAM requirement (when supported). Device Manager and System Configuration won’t change reserved video memory allocation, and “Virtual RAM” (paging) is unrelated to VRAM. Therefore, BIOS options is correct.

Group Policyis the standard administrative tool for setting user permissions across domain-joined systems.

FromQUENTIN DOCTER – COMPLETE Study Guide:

“Use Group Policy to enforce user rights, including disabling guest account access on domain computers.”

The symptoms point strongly to a bootleg/malicious application from an untrusted source: random pop-ups (high number of ads), increased data usage (high network traffic/data-usage warnings), and abnormal restrictions such as failing OS updates or blocking access to sensitive apps (unexpected application behavior). These are specifically listed as common mobile security symptoms associated with malicious apps and untrusted APK sources. When a device shows multiple signs of compromise and normal remediation options (like

Virtualizationallows the legacy OS to be run in a virtual machine (VM) on top of the newer OS. This method provides backward compatibility without requiring outdated operating systems on physical hardware.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Using virtualization is a preferred method when legacy applications are needed after migrating to newer operating systems. It allows legacy environments to exist securely within a modern OS framework.”

NET Framework versions are often required for applications to run. If an older app requires .NET Framework 3.5, it must be explicitly installed as it is not included by default in newer versions of Windows. The best method to do this safely is through the built-in " Turn Windows features on or off " utility, which downloads and installs it via official Microsoft services.

B. Using third-party repositories is unsafe and not recommended.

C. Installing .NET 4 does not include 3.5; versions are not fully backward compatible.

D. The issue is technical, not a security incident for the SOC team.

Cloud-based software often enforcesdevice limitsper license. Before reinstallation or switching software, checking license allocations is the most logical first step.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Many cloud apps enforce user or device count restrictions. When an install fails, check licensing before troubleshooting other areas.”

The correct answer is C. Perform a clean installation . When ransomware has encrypted files and the organization does not pay the ransom, the priority is to remove all traces of malware and rebuild the system from a trusted state. Quentin Docter’s Complete Study Guide explains that in ransomware situations, remediation may not be possible because user files are encrypted. It further states that in cases where no one can be certain what the malware payload has done, the proper remediation might be to sanitize the drive and reinstall the operating system from an image or manually reinstall it. A recovery partition or Windows Recovery Environment repair may leave infected files, settings, persistence mechanisms, or damaged user data behind. Upgrading to Windows 11 does not guarantee malware removal. A clean installation removes the existing compromised OS and provides the best path to full operation, followed by restoring clean data from known-good backups.

SSO issues are often related to cached session data, cookies, or browser artifacts. The fact that the user can access the company portal but not one specific SaaS tool suggests a session or token problem. Using a private/incognito browsing window allows a clean session to be initiated, which often resolves SSO conflicts.

A. Reenrolling MFA is not related unless access issues stem from failed multifactor authentication.

C. Bypassing SSO may not be possible depending on the SaaS tool and company policies.

D. Factory resetting a device is a last resort and unnecessary in this case.

Resource Monitor provides real-time monitoring of system performance and resource usage, including CPU, memory, disk, and network usage. It helps technicians identify performance bottlenecks (e.g., high memory or CPU usage) that can cause slowdowns in applications over time without producing crash errors.

A. Reliability history logs application crashes or errors — not helpful if the app doesn’t crash.

B. Computer Management is a broad utility with limited real-time monitoring capability.

D. Disk is too vague — tools like CHKDSK can help with disk errors but not general performance degradation.

Once a malware incident has been confirmed, the immediate next step is to contain the threat. Quarantining infected systems prevents the malware from spreading to other devices and isolates the malicious code for further analysis or remediation.

B. Educating end users is important but occurs later in the incident response process.

C. Disabling System Restore is part of cleanup, not containment.

D. Updating and scanning should occur after the system is quarantined to prevent further infection or spread.