220-1202 CompTIA A+ Core 2 2025 Exam Questions and Answers

Comprehensive and Detailed Explanation From Exact Extract:

Badge readers are electronic access control systems that require authorized users to scan a badge (e.g., RFID or magnetic strip cards) to gain access to restricted physical locations. These systems typically log all access attempts—successful or denied—providing both detection and recording of access events.

A. Bollards are physical barriers to prevent vehicle access.

B. Video surveillance can record access visually but does not track identity unless integrated with access control systems.

D. A fence restricts access but doesn ' t detect or record who entered.

Comprehensive and Detailed Explanation From Exact Extract:

If uploading fails only offsite,mobile data limits or restrictionsare the likely cause. Data caps or network management can interfere with uploads.

FromTravis Everett – All-in-One Exam Guide:

“When mobile users experience network issues, always check if the device has reached a data cap or roaming restriction.”

Comprehensive and Detailed Explanation From Exact Extract:

An evil twin is a rogue wireless access point set up to mimic a legitimate Wi-Fi network. Unsuspecting users may connect to it, giving attackers the opportunity to intercept traffic, steal credentials, or install malware. The evil twin often uses the same SSID as the real network to fool users.

A. Stalkerware is spyware installed to track user activity, typically on personal devices.

C. Tailgating is a physical security breach involving unauthorized entry behind someone with access.

D. Shoulder surfing involves observing a person entering confidential data, such as PINs or passwords.

The correct answer is A. .app , because macOS applications packaged as .app files are typically self-contained application bundles . This means that all required application files are stored within a single directory that appears as one file in Finder. When the .app file is moved to the Trash, the application is effectively removed from the system.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , macOS applications are commonly distributed as .app bundles, allowing for simple installation and removal. This design contrasts with Windows, where applications often install files across multiple directories and require uninstallers.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that dragging a .app file to the Trash is generally sufficient to uninstall the software, although some applications may leave behind preference files or caches. However, from an exam perspective, .app is the only option that supports this uninstall behavior.

The Mike Meyers / Mark Soper Lab Manual further clarifies that .msi and .exe are Windows formats, .rpm is used by Linux package managers, and .pkg installers often install system-wide components that require a formal uninstallation process.

Because .app files support simple drag-to-trash uninstallation , A is the correct answer.

Comprehensive and Detailed Explanation From Exact Extract:

exFATis the only listed file system that supports both read and write access across Windows, macOS, and Linux (with appropriate drivers). It’s optimized for flash storage and external drives.

FromAll-in-One Exam Guide:

“exFAT is a lightweight file system with cross-platform read/write support, ideal for use on removable drives when compatibility is essential.”

AVPN (Virtual Private Network)creates a secure tunnel between the clerk’s home device and the town server, ensuring private and authenticated access.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“VPNs are essential for remote access to internal resources, providing secure connections over public networks.”

Comprehensive and Detailed Explanation From Exact Extract:

Once the system is cleaned, the next priority is toeducate the useron safe practices to prevent recurrence.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Post-malware remediation should include user education to prevent reinfection and identify how the malware was introduced.”

When defaults are too permissive across multiple Windows workstations, the most efficient and scalable fix is to enforce a standardized security baseline using Group Policy . The All-in-One guide explains that Windows provides extensive “security features” such as requiring complex passwords, limiting logon times, and controlling whether users can install applications—“and the list goes on to thousands of security features.” It states that “ To configure these features, you use group policies ,” and that you configure them using the Group Policy Editor (gpedit.msc) .

This directly matches the scenario: repeated unauthorized attempts suggest the need to tighten multiple security settings consistently. While enabling account lockout policies (D) is one good control, the question is broader—“default security settings may be too permissive”—so the best action is to implement the overall appropriate group policy that can include lockout, password complexity, auditing, and other controls together. Updates and password resets are useful, but they don’t systematically correct permissive baseline settings across systems. Therefore, implementing an appropriate group policy is the best answer.

Comprehensive and Detailed Explanation From Exact Extract:

End-user education is crucial after malware removal to prevent recurrence. Teaching safe browsing habits and security awareness completes the remediation cycle.

Mark Soper – Mike Meyers ' Lab Manualstates:

“Educating the user after malware remediation is part of the CompTIA malware response methodology. This includes training on phishing and safe practices.”

Comprehensive and Detailed Explanation From Exact Extract:

A low-level format (also referred to as a zero-fill or full format) writes over every sector on a storage device, effectively destroying the existing data and making recovery nearly impossible. Unlike degaussing, which renders the drive unusable, a low-level format maintains the integrity of the device, allowing it to be repurposed or reused.

A. Deleting partitions does not fully erase data; it only removes references in the partition table.

B. EFS (Encrypting File System) encrypts files but does not securely wipe them.

D. Degaussing destroys the magnetic structure of a drive, making it inoperable and not reusable.

Comprehensive and Detailed Explanation From Exact Extract:

Outdated images and website data often result from cached files in the browser. The Internet Options panel in Windows (specifically under the General tab) allows users to clear browsing history, including cached images and files, which forces the browser to load the most current versions of web content.

A. Administrative Tools is used for advanced system management, not browser settings.

B. Windows Defender Firewall controls network traffic and security rules, not caching.

D. Ease of Access provides accessibility features for users with disabilities — unrelated to web browsing issues.

First Chat Response:When the user mentions setting up a new router, the best initial response to maintain a helpful and professional tone is:

> Select reply: " I am happy to assist you today. "

Second Chat Response:When the user states that they need to set up basic security settings:

> Select reply: " Is this the first router in your office? "

Third Chat Response:After learning it ' s a replacement router and the user is logged into the router ' s web page:

> Select reply: " The first thing you need to do is change the default password. "

Fourth Chat Response:For the response about password settings:

> Select reply: " Create a new password with an uppercase, a lowercase, and a special character. "

Fifth Chat Response:When the router prompts to reboot:

> Select reply: " Yes, reboot please. "

Study Guide Reference: The CompTIA A+ Core 2 guide highlights the importance of changing default credentials and using strong password policies, particularly in SOHO environments where routers are often targeted.

Host 2, Host 3, Host 4 , Host 5 ,Host 6, Host 7, Host 8 , Media Server - Stop All unwanted and malicious service (Persistance.j1zpxn Installer Service) from all the listed host and Media servers

Refer screenshot below on the required service started/stopped on host2, same service to be started and stopped across all host servers.

A screenshot of a computer AI-

A screenshot of a computer AI-

Ticket #8675310

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig /renew

For the Low priority ticket #8675310 (“ A small yellow triangle appeared in the taskbar. I am no longer able to access network resources. ”), the Windows yellow triangle on the network icon is the classic indicator of limited connectivity (often caused by a bad/expired DHCP lease, APIPA address, missing default gateway, or DNS info not being assigned).

Correct PBQ Selections (Ticket #8675310)

Issue

Limited network connectivity

Why (CompTIA logic):

That yellow warning triangle means the NIC is connected at Layer 2 (link is up), but the system likely doesn’t have valid Layer 3 config (IP/gateway/DNS), so it can’t reach network resources.

Resolution

Refresh DHCP

Why this is the most efficient fix:

When a Windows PC can’t access network resources and shows “limited connectivity,” the fastest, lowest-risk fix is to renew DHCP so the PC can pull:

a valid IP address

default gateway

DNS servers

This directly resolves the most common root cause behind that icon.

Verify / Resolve

ipconfig /renew

Why this is the correct verification/remediation command:

ipconfig /renew is the direct command to request a fresh DHCP lease . After renewal, the user should regain access to network resources if DHCP was the issue.

What this fixes (what you’d expect to see)

Before the fix, the attachment ( Output.txt ) in these PBQs typically shows symptoms like:

169.254.x.x (APIPA) → DHCP failed

Missing/blank Default Gateway

DNS not present or incorrect

After ipconfig /renew, you should see a normal private IP (like 192.168.x.x / 10.x.x.x / 172.16-31.x.x ) and a valid gateway/DNS.

1st CLI Resolution

copy " C:\Program Files\Testing\msvcp100.dll " " User-PC02\C$\Windows\System32 " /v /y

2nd CLI Resolution

regsvr32 msvcp100.dll

Why These Are the Correct Choices (Exam Logic)

Why the COPY command is first

The error explicitly states MSVCP100.dll is missing

Other users can run the app → the DLL exists on another system

The fastest, least disruptive fix (preferred by CompTIA) is to:

Copy the known-good DLL into C:\Windows\System32

The /v switch verifies the copy, and /y suppresses prompts — both are enterprise-safe defaults

This restores the missing runtime dependency immediately.

Why REGSVR32 is second

After copying a DLL, Windows may not recognize or properly load it

regsvr32 registers the DLL with the operating system

This ensures:

The Testing application can properly call the runtime library

The fix persists after reboot

Inbox mail 1 -Account Locked- Phishing - Report email to Information Security

Inbox mail 2 -Share your feedback - Legitimate - Perform no additional actions

Inbox mail 3 –Employee orientation - Legitimate - Perform no additional actions

Inbox mail 4 –Security Update – Spam - Report email to Information Security

Inbox mail 5 –Interview - Legitimate - Perform no additional actions

—

The completed configuration:

1. Wireless AP (LAN side)

1. LAN IP: 192.168.10.1

2. Encryption: WPA2 PSK

2. Router (port-forward rule)

1. Allow TCP Any 3389

This forwards inbound RDP traffic (TCP/3389) from the Internet to the Windows PC, enabling Remote Desktop access.

3. Firewall (screened subnet side)

1. LAN IP: 10.100.0.1

4. Device placement

1. PC: place behind the router (where the port-forward rule points).

2. Game console: place on the Wireless AP (so it can use chat and extra services over WPA2 PSK).

3. Firewall: place in front of the screened subnet (with its 10.100.0.1 IP facing that subnet).

The Windows PC is placed in the screened subnet (behind the firewall) for enhanced security. Remote access to this PC requires port forwarding of TCP port 3389 (RDP), which is correctly configured through the router.

The Game Console is placed on the Wireless AP LAN, using WPA2 PSK for a secure wireless connection. Game consoles typically use peer-to-peer chat and online services that require open access without firewall restrictions, which is why the console is not placed behind the firewall.

CompTIA A+ 220-1102 Reference Points:

Objective 3.4: Given a scenario, implement best practices associated with data and device security.

Objective 2.4: Given a scenario, use appropriate tools to support and configure network settings.

Study Guide Reference: CompTIA A+ Core 2 guides recommend using screened subnets (a type of DMZ) for systems needing controlled external access, such as remote desktops, while placing gaming and media devices on less restricted networks for full functionality.

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig

Issue (drop-down)

Limited network connectivity

Why this matches:

“Internet Down” most commonly indicates the workstation has lost valid Layer 3 connectivity (bad/expired DHCP lease, APIPA address, wrong gateway, etc.). In CompTIA A+ terms, this aligns best with limited connectivity symptoms (can’t reach internet resources).

Resolution (drop-down)

Refresh DHCP

Why this is the most efficient fix:

If the client has:

an expired lease

an APIPA address (169.254.x.x) because DHCP failed

an incorrect IP/gateway from a bad lease

…then the fastest first remediation is to renew DHCP to obtain a correct IP address, default gateway, and DNS servers. This is a standard CompTIA A+ troubleshooting action (quick, low-risk, high-success).

Verify/Resolve (drop-down)

ipconfig

Why this is the correct verification tool:

ipconfig is the primary Windows CLI tool to:

check current IP settings (ipconfig /all)

release/renew DHCP (ipconfig /release and ipconfig /renew)

confirm you received a valid IP + gateway + DNS , which is required for internet access.

What you would do (mapped to those choices)

Using ipconfig to complete “Refresh DHCP” and confirm the fix:

Check current addressing

ipconfig /all

Look for:

Valid IPv4 (not 169.254.x.x )

Valid Default Gateway

DNS servers present

Refresh the DHCP lease

ipconfig /release

ipconfig /renew

Verify outcome

Run ipconfig again to confirm:

You now have a correct IP for the network

Default gateway is populated

If the gateway/DNS populate correctly, internet access typically returns.

The user needs to deliver a project status presentation to external stakeholders , which implies hosting a meeting with screen sharing, invitations, and attendee management. Quentin Docter defines videoconferencing as screen-sharing software that allows more than one person to share screens and includes “additional functionality, such as calendar invite, call-in numbers, and attendee management.” He lists Microsoft Teams, WebEx, Zoom, and GoToMeeting as examples and states these tools “are often used to present ideas and collaborate between groups of people.” That exactly matches presenting to external stakeholders.

The other options don’t fit the requirement: WinRM is a Windows remote management protocol (administration, not presentations), RMM is used by IT providers to manage many systems remotely (not stakeholder presentations), and secure file transfer is for moving files rather than delivering a live presentation. Since videoconferencing platforms commonly provide screen sharing, chat, and meeting controls designed for external audiences, Videoconferencing (C) is the correct software type.

Comprehensive and Detailed Explanation From Exact Extract:

When an iOS device approaches full storage capacity, performance can be significantly impacted. iOS requires a buffer of free space to perform background processes efficiently.

From theAll-in-One Exam Guide:

“iOS devices need several gigabytes of free space to maintain optimal performance. Near-full storage can cause sluggish operation and failures in updates or background tasks.”

Comprehensive and Detailed Explanation From Exact Extract:

A synthetic full backup combines the last full backup with subsequent incremental backups to create a new full backup without re-reading data from the source system. This method significantly reduces the backup window and network impact. It is especially useful when traditional full backups are too time-consuming.

A. Changing the backup window only shifts timing, not duration.

B. Incremental weekly backups would lack a proper full recovery point and aren ' t ideal alone.

C. Storage space isn ' t the bottleneck in backup speed—it’s read/write operations and network load.

The 3-2-1 backup rule is specifically about number of copies, diversity of media, and offsite storage . “2” in 3-2-1 means using two different types of media . The All-in-One guide states the rule plainly: “ keep at least three copies of your data on at least two different types of media… and store at least one copy offsite .” Mike Meyers’ Lab Manual repeats the same definition word-for-word, emphasizing two different media types and one off-site copy.

Quentin Docter explains the same method and gives an example: original data plus an on-site backup, plus “ a third copy… off site ,” such as backing up to the cloud.

Given the options, only D directly satisfies the “two different media” requirement. Option C contradicts the offsite requirement, option B invents a testing interval not defined by 3-2-1, and option A is about backup types rather than the core 3-2-1 rule. Therefore D is correct.

To display a file’s contents in Linux, the standard command is cat . Quentin Docter states: “Sometime you just need to view the contents of a file. To view the contents of a file, use the cat command,” and shows an example cat /etc/hosts displaying the file output. He also lists essential Linux commands and explicitly defines cat as: “Displays the contents of a file.”

The other options do not meet the requirement: chmod changes file permissions, ls lists directory contents (or file names), and sudo runs a command with elevated privileges—none directly display a file’s contents by themselves. A+ also expects you to know that cat can do more than display; it can concatenate files and redirect output, but for this question the key function is simply viewing a file.

Therefore, the correct command is cat (B) .

Aclean installensures all malware is eliminated by completely wiping and reinstalling the OS. System restore or repair may leave traces.

FromQUENTIN DOCTER - COMPTIA A+ COMPLETE study GUIDE:

“If malware cannot be completely removed, perform a clean installation of the operating system. This ensures no remnants remain on the machine.”

Comprehensive and Detailed Explanation From Exact Extract:

The recurring print issue suggests theprint spooler service is not set to start automatically, causing it to stop between sessions. Ensuring it is set tostart automaticallyand manuallystarting the servicewill resolve the issue.

FromMark Soper – Mike Meyers ' Lab Manual:

“The print spooler is essential for print services. If it isn’t configured to start automatically, users may experience recurring failures.”

“Manually starting the service or setting it to ' Automatic ' in the Services panel resolves persistent print availability problems.”

Comprehensive and Detailed Explanation From Exact Extract:

PXE (Preboot Execution Environment) allows workstations to boot over the network and download an OS image from a server. It is ideal for automating mass deployments using baseline images across many machines without the need for physical media.

A. An ISO is a disk image file but requires mounting or physical media.

B. Secure Boot is a security feature, not a method of deploying OS images.

C. USB requires manual installation and is not suitable for automated deployment at scale.

The best option is to create a lower-security network exclusively for the console . Many retro or legacy gaming consoles only support older Wi-Fi security standards such as WPA or even WEP , and they cannot connect to modern WPA2 or WPA3 networks. Downgrading the entire primary network would significantly weaken overall security, which is not recommended in any environment.

The Quentin Docter – CompTIA A+ Complete Study Guide explains that legacy devices often lack firmware support for modern encryption standards and should be isolated rather than integrated directly into secure networks. Creating a separate SSID with reduced security limits exposure while still allowing connectivity for the unsupported device.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide emphasizes that lowering security settings on a primary router—even temporarily—introduces unnecessary risk. Switching encryption modes back and forth can also cause configuration instability and expose the network during the downgrade window.

The Mike Meyers / Mark Soper Lab Manual further reinforces the concept of network segmentation as a best practice. By creating a dedicated network for legacy or insecure devices, administrators reduce the attack surface and prevent lateral movement to sensitive systems.

Using a wired Ethernet adapter may not be supported by the console, and adding an older router introduces unmanaged vulnerabilities. Therefore, isolating the console on a separate, lower-security wireless network is the safest and most practical solution.

Comprehensive and Detailed Explanation From Exact Extract:

Smishing (SMS phishing) is a type of social engineering attack where attackers send fraudulent text messages to trick users into revealing sensitive information or downloading malware. These messages often impersonate banks, delivery services, or official institutions to lure the victim into clicking malicious links.

A. Impersonation is an in-person or voice-based tactic.

B. Vishing refers to voice phishing over phone calls.

C. Spear phishing is a targeted email-based phishing method.

With integrated graphics, “VRAM” is often not dedicated memory on a discrete card—graphics may instead borrow system RAM . Quentin Docter explains this directly: if the video card is built into the motherboard, it “likely won’t have its own memory but will share system memory,” meaning the total system RAM is split between the OS and video usage. Docter then answers the key “where do I change this?” question: “ Shared memory is configured in the system BIOS/UEFI ,” and some BIOS/UEFI setups allow you to set aside a specific amount (example given: 512 MB) for video memory.

That is exactly why the machine can have plenty of DRAM yet fail a VRAM check: the BIOS/UEFI allocation for integrated graphics may be set too low. Adjusting BIOS/UEFI settings to reserve more memory for the integrated GPU is the most direct way to attempt meeting a VRAM requirement (when supported). Device Manager and System Configuration won’t change reserved video memory allocation, and “Virtual RAM” (paging) is unrelated to VRAM. Therefore, BIOS options is correct.

Comprehensive and Detailed Explanation From Exact Extract:

The symptoms suggest abrowser hijacker. Thefirst stepsshould be toremove any malicious extensionsandreset the startup pageto restore normal behavior.

FromAll-in-One Exam Guide:

“Browser hijackers often install as extensions and change homepage settings. Removing these extensions and resetting the startup configuration typically resolves the issue.”

The correct answer is C. Switch the NIC settings from manual to automatic , which allows the computer to obtain an IP address dynamically from the DHCP server. When a static IP address is no longer required, reverting the network configuration to DHCP ensures the system integrates properly with the current network design.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , DHCP simplifies network management by automatically assigning IP addresses, subnet masks, gateways, and DNS settings. Leaving a static IP in place can cause address conflicts or connectivity issues, especially when the device is repurposed.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that DHCP reservations are used when a device must always receive the same IP address, which is unnecessary in this scenario. Creating exclusions or manually changing the static IP does not meet the requirement to remove static addressing altogether.

The Mike Meyers / Mark Soper Lab Manual reinforces that switching the NIC to automatic configuration is the correct way to return a system to standard network operation and avoid manual IP management.

Because the static IP is no longer needed, enabling DHCP by setting the NIC to automatic configuration is the correct solution, making C the correct answer.

Comprehensive and Detailed Explanation From Exact Extract:

Virtualizationallows the legacy OS to be run in a virtual machine (VM) on top of the newer OS. This method provides backward compatibility without requiring outdated operating systems on physical hardware.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Using virtualization is a preferred method when legacy applications are needed after migrating to newer operating systems. It allows legacy environments to exist securely within a modern OS framework.”

Comprehensive and Detailed Explanation From Exact Extract:

NET Framework versions are often required for applications to run. If an older app requires .NET Framework 3.5, it must be explicitly installed as it is not included by default in newer versions of Windows. The best method to do this safely is through the built-in " Turn Windows features on or off " utility, which downloads and installs it via official Microsoft services.

B. Using third-party repositories is unsafe and not recommended.

C. Installing .NET 4 does not include 3.5; versions are not fully backward compatible.

D. The issue is technical, not a security incident for the SOC team.

The correct answer is C. Setting up image deployment for PXE , because PXE (Preboot Execution Environment) allows operating system installations and upgrades to be performed over the network without using removable storage. Since all removable media is disabled for security reasons, PXE-based deployment preserves existing security controls while enabling centralized OS upgrades.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , PXE is commonly used in enterprise environments to deploy or upgrade operating systems at scale. PXE works by booting client machines from a network interface and pulling installation images from a secured deployment server.

The Travis Everett & Andrew Hutz – CompTIA A+ All-in-One Exam Guide explains that PXE is especially valuable when USB drives and external media are restricted. It ensures consistency, reduces human error, and maintains compliance with organizational security policies.

The Mike Meyers / Mark Soper Lab Manual reinforces that copying ISO files locally still requires write access and may violate security baselines. External drives are explicitly prohibited, and hardware tokens are authentication tools—not deployment mechanisms.

Because PXE enables secure, centralized, removable-media-free OS upgrades , it is the most appropriate solution, making C the correct answer.

The correct answer is D. Chain of custody process , because chain of custody ensures that evidence collected during an incident response is tracked, preserved, and legally defensible . It documents who collected the evidence, when it was collected, how it was stored, and who accessed it throughout the investigation.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , chain of custody is essential when evidence may be used in disciplinary actions, audits, or legal proceedings. Any gap in documentation can render evidence inadmissible.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that chain of custody provides accountability and prevents claims of evidence tampering. Each transfer of evidence must be logged and verified.

The Mike Meyers / Mark Soper Lab Manual clarifies that while order of volatility determines the sequence of data collection, it does not track ownership or handling. Data integrity best practices ensure evidence is not altered, but they do not provide a record of custody.

Because the question focuses on handling and accountability , the required process is chain of custody , making D the correct answer.

Comprehensive and Detailed Explanation From Exact Extract:

TheServicestool in Windows allows a technician to view service dependencies and status. If the print spooler can ' t start due to a dependency, Services is the correct tool to inspect and manage them.

FromAll-in-One Exam Guide:

“The Services console allows technicians to view, start, and configure system services, including setting recovery actions and viewing dependencies.”

Comprehensive and Detailed Explanation From Exact Extract:

An in-place upgrade is the fastest and most efficient way to upgrade from Windows 10 to Windows 11 while keeping all user data, applications, and settings intact. This method is often used when the hardware meets Windows 11 requirements and no system reconfiguration is necessary.

A. gpupdate is used to refresh Group Policy settings — unrelated to OS upgrades.

B. Image deployment typically replaces the current OS and may not retain user data unless specifically customized.

C. A clean install requires formatting the drive and starting fresh, which removes all data.