220-1202 Questions and Answers

Ticket #8675310

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig /renew

For the Low priority ticket #8675310 (“A small yellow triangle appeared in the taskbar. I am no longer able to access network resources.”), the Windows yellow triangle on the network icon is the classic indicator of limited connectivity (often caused by a bad/expired DHCP lease, APIPA address, missing default gateway, or DNS info not being assigned).

Correct PBQ Selections (Ticket #8675310)

Issue

Limited network connectivity

Why (CompTIA logic):

That yellow warning triangle means the NIC is connected at Layer 2 (link is up), but the system likely doesn’t have valid Layer 3 config (IP/gateway/DNS), so it can’t reach network resources.

Resolution

Refresh DHCP

Why this is the most efficient fix:

When a Windows PC can’t access network resources and shows “limited connectivity,” the fastest, lowest-risk fix is to renew DHCP so the PC can pull:

a valid IP address

default gateway

DNS servers

This directly resolves the most common root cause behind that icon.

Verify / Resolve

ipconfig /renew

Why this is the correct verification/remediation command:

ipconfig /renew is the direct command to request a fresh DHCP lease. After renewal, the user should regain access to network resources if DHCP was the issue.

What this fixes (what you’d expect to see)

Before the fix, the attachment (Output.txt) in these PBQs typically shows symptoms like:

169.254.x.x (APIPA) → DHCP failed

Missing/blank Default Gateway

DNS not present or incorrect

After ipconfig /renew, you should see a normal private IP (like 192.168.x.x / 10.x.x.x / 172.16-31.x.x) and a valid gateway/DNS.

The correct answer is D. Smishing, which is a form of phishing attack conducted via SMS text messages. The key indicators in this scenario are the unexpected text message and the embedded link prompting the user to reset a password. These attacks rely on urgency and fear to trick users into clicking malicious links or providing credentials.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, smishing attacks often impersonate legitimate organizations such as banks, IT departments, or service providers. The attacker claims that an account action is required, such as resetting an expired password, to prompt immediate user response.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that smishing is distinct from other phishing variants based on delivery method. Vishing uses voice calls, spear phishing targets specific individuals via email, and whaling targets high-level executives. Since this attack is delivered via text message, it is classified as smishing.

The Mike Meyers / Mark Soper Lab Manual reinforces that modern attackers increasingly use SMS because users often trust text messages more than emails. This makes smishing a highly effective and common attack vector.

Because the attack uses SMS with a malicious link, smishing is the correct answer.

Inbox mail 1 -Account Locked- Phishing - Report email to Information Security

Inbox mail 2 -Share your feedback - Legitimate - Perform no additional actions

Inbox mail 3 –Employee orientation - Legitimate - Perform no additional actions

Inbox mail 4 –Security Update – Spam - Report email to Information Security

Inbox mail 5 –Interview - Legitimate - Perform no additional actions

—

The best first step is to leverage existing documentation: check whether the issue was previously recorded and resolved, and reuse that known fix (or confirm conditions). Mike Meyers explains ticketing systems capture key information needed to resolve issues, including “ problem description ,” “ progress notes ,” and “ problem resolution ,” and stresses that “ Clear, concise writing is critical ” because you “won’t be the only tech responding to every ticket.” That is exactly why you review prior tickets first—so you can quickly see what was done previously and apply it consistently.

The All-in-One guide reinforces the same ticketing-system concept and lists the same essential elements (description, notes, resolution) used to streamline troubleshooting and escalation. Consulting the prior technician (A) may be impossible (the employee is gone) and slower than checking documented history. Opening a new case (D) is important, but the question asks what to do first —review the prior occurrence details, then document your current case using what you find.

The correct answer is B. Turn off notifications in the browser, because the described behavior matches browser notification abuse, not traditional pop-ups. Modern browsers allow websites to request permission to send notifications. If a user previously allowed notifications from a retail site, the site can continue sending onscreen alerts even when pop-up blockers are enabled.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, browser notification permissions are separate from pop-up blocking settings. Pop-up blockers prevent new browser windows or tabs from opening, but they do not block push notifications that were previously approved by the user. These notifications can persist long after visiting a site.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that one of the first troubleshooting steps for repeated browser messages is to review and disable site notification permissions. This directly targets the root cause without affecting browser configuration or user data.

The Mike Meyers / Mark Soper Lab Manual reinforces that resetting or reinstalling the browser is an excessive step unless configuration corruption is suspected. Clearing cache removes stored files but does not revoke notification permissions.

Because the messages originate from previously allowed browser notifications, the most appropriate and targeted fix is to disable notifications in the browser, making B the correct answer.

Antivirus/antimalware detection depends heavily on its definitions/signatures. If those are outdated, new malware variants may not be recognized. Quentin Docter explains that the “definitions database” is a core antivirus component and that its effectiveness depends on “the frequency of updates and the comprehensiveness of the database signatures.” He adds that new signatures are discovered frequently and added to the database, meaning stale definitions leave gaps.

Docter is also explicit that security software “is not perfect” and that malware may get around it, “especially a new threat (and especially if you haven’t updated your definitions lately).” That statement directly matches this scenario: the software exists, but it failed to detect the infection—most likely because the detection data wasn’t current.

The other answers don’t fit as well: folder permissions and user permissions can limit what malware can change, but they don’t explain why security software didn’t detect it. Port security relates to network access control, not local signature detection. Therefore, Outdated definitions (B) is the best explanation.

Authenticator apps, such as Google Authenticator or Microsoft Authenticator, can be configured to sendpush notificationsto users for approval when logging in. This is a form of multi-factor authentication.

FromAll-in-One Exam Guide:

“Push-based two-factor authentication uses an authenticator app to send a notification to a mobile device. The user must approve the login attempt in real time, ensuring the request is valid.”

The correct answer is C. In-place upgrades, because this migration method preserves existing user data, applications, and settings while upgrading the operating system to a newer version. Since a large percentage of users store documents locally, maintaining those files during the upgrade is a key requirement.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, an in-place upgrade replaces the operating system files while keeping user profiles, installed applications, and local data intact. This significantly reduces the risk of data loss and minimizes disruption to users.

The Travis Everett & Andrew Hutz – CompTIA A+ All-in-One Exam Guide explains that clean installs erase the existing OS and require data backup and restoration, which is time-consuming and risky when users store files locally. Zero-touch deployments are automated but typically rely on standardized images and centralized data storage, which does not align with this scenario.

The Mike Meyers / Mark Soper Lab Manual reinforces that in-place upgrades are ideal when preserving user environments is a priority and when systems already meet the requirements for the newer OS.

Because the goal is to upgrade Windows while retaining locally stored documents, in-place upgrades are the most appropriate solution, making C the correct answer.

The user needs to deliver a project status presentation to external stakeholders, which implies hosting a meeting with screen sharing, invitations, and attendee management. Quentin Docter defines videoconferencing as screen-sharing software that allows more than one person to share screens and includes “additional functionality, such as calendar invite, call-in numbers, and attendee management.” He lists Microsoft Teams, WebEx, Zoom, and GoToMeeting as examples and states these tools “are often used to present ideas and collaborate between groups of people.” That exactly matches presenting to external stakeholders.

The other options don’t fit the requirement: WinRM is a Windows remote management protocol (administration, not presentations), RMM is used by IT providers to manage many systems remotely (not stakeholder presentations), and secure file transfer is for moving files rather than delivering a live presentation. Since videoconferencing platforms commonly provide screen sharing, chat, and meeting controls designed for external audiences, Videoconferencing (C) is the correct software type.

A low-cost home lab for practicing server management and scripting strongly points to Linux because it is widely available at no cost and is designed to support many server-style workloads. The All-in-One guide states plainly: “Linux is a popular, free, open source operating system,” and notes that there are many distributions (distros), giving flexibility for different needs. Quentin Docter adds key context about Linux’s purpose: Linus Torvalds created it as “a completely open source operating system for the world to use… completely free for anyone to use,” and highlights that many Linux distributions exist today.

From a cost standpoint, Docter’s licensing section defines open source as “not only… free, but the source code… is also shared,” and explicitly lists “OSs such as Linux” as open source examples. This directly supports “low-cost.”

Finally, Linux is a common target environment for real server administration and scripting practice (shell tools, package repositories, services), making it the best match versus ChromeOS/macOS/Windows for this lab goal.

Device encryptionensures that even if someone bypasses biometrics or has physical access to the phone, they cannot read the stored data without the encryption key.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Encryption is the most effective way to protect data at rest. Even if the device is lost or stolen, encryption ensures the data remains inaccessible without the correct key or passcode.”

Carbon fiber filamentcan producefine particles or fumesduring printing, which may be harmful when inhaled. Wearing anair filter maskis essential to protect the respiratory system.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“When working with advanced materials like carbon fiber, always use appropriate personal protective equipment such as air filter masks to prevent inhalation of dangerous particles.”

BitLocker To Go is a Microsoft encryption feature specifically designed for removable drives such as USB flash drives and external hard drives. It allows users to protect the data on these devices by requiring a password to decrypt the contents, thereby preventing unauthorized access in the event the device is lost or stolen.

A is correct because BitLocker To Go is directly tied to password-protecting removable media.

B and C are unrelated to BitLocker To Go; Secure Boot and VPN encryption are entirely different security layers.

D applies to BitLocker (not BitLocker To Go) and full disk encryption on internal drives using TPM.

Because the requirement is defined by a global security policy , the key question is whether the endpoint is actually receiving and applying the correct Group Policy Object (GPO) settings for screensaver timeout and enforcement. The best command to investigate applied policy is gpresult , which produces the Resultant Set of Policy (RSoP) information. Quentin Docter explains: “The gpresult command is used to show the Resultant Set of Policy (RSoP) report/values for a remote user and computer,” and it helps determine “which settings apply” when policies can be set at the local workstation, domain, user, and computer levels. He notes the /r switch provides a summary and /z gives detailed, “super-verbosity” output showing exact settings being applied.

The All-in-One guide similarly states gpresult gives “a quick overview of all security policies applied to a single user or computer,” which is precisely what you need when a policy-driven screensaver setting isn’t behaving as expected. msinfo32 shows system info, sfc repairs corrupted files, and whoami shows identity—none confirm applied GPO settings like gpresult.

The correct answer is D. Quarantine the infected system. The message describes ransomware because the files are encrypted and the attacker is demanding Bitcoin payment. The Mike Meyers/Mark Soper material explains that ransomware encrypts all accessible data and often demands payment in bitcoins for decryption. Quentin Docter’s Complete Study Guide explains that ransomware can spread quickly across a network and encrypt files in its path. It also states that after malware is confirmed, the infected system should be quarantined to prevent spread to other systems or network resources. Reimaging and restoring data may be required later, and updating/scanning anti-malware is part of remediation. However, the first action after identifying an active ransomware infection is isolation. Quarantining the system protects shared drives, other endpoints, and network resources from further encryption.

To ensure the authenticity of a downloaded application, the most reliable method is to verify the file’s hash (e.g., SHA256, MD5) against the value provided by the legitimate vendor. If the hash values match, the file has not been altered or tampered with. This verification confirms the integrity and authenticity of the executable.

B. Process IDs are dynamic and not unique to specific software.

C. Running in safe mode doesn’t validate legitimacy—it only runs the app in a minimal environment.

D. File names can be spoofed; matching the name does not prove authenticity.

An MSDS providessafety and emergency procedures, such as what to do if a battery leaks or catches fire. It is not a technical or setup guide.

FromTravis Everett – CompTIA A+ All-in-One Exam Guide:

“An MSDS contains safety information, including handling, storage, and emergency procedures related to potentially hazardous components like UPS batteries.”

This scenario involves a mismatch in device time settings, which can affect synchronization and authentication across the network. Using a Network Time Protocol (NTP) server ensures all networked devices maintain accurate and synchronized clocks.

From Travis Everett – All-in-One Exam Guide:

“NTP servers keep all devices on a network in sync. This prevents time drift, which can cause authentication issues with domain logins, certificates, and applications.” .

The technician should not disclose information about other customers’ issues, environments, or outcomes because that violates professional confidentiality expectations. Instead, the best response is to explain the general troubleshooting process the technician will follow—such as gathering symptoms, checking logs/connection status, isolating whether the problem is local vs. ISP, testing known-good hardware, and documenting results—without referencing other clients’ specific cases. Quentin Docter emphasizes that as a computer professional you must uphold confidentiality and ensure sensitive information “goes no further,” reinforcing that you should not reveal work-related details to others. The All-in-One guide similarly states that anything you see or are told should be treated as a “personal confidence” and not repeated to customers or others, underscoring why option A is inappropriate. Mike Meyers’ Lab Manual echoes this privacy expectation: treat what you see as confidential and handle customers’ private materials appropriately. Option B dismisses the customer’s concern, and option D is unprofessional and speculative.

AnNDA (Non-Disclosure Agreement)is used to ensure confidentiality of sensitive company information, especially when interacting with external parties.

FromQUENTIN DOCTER - COMPTIA A+ COMPLETE study GUIDE:

“An NDA ensures that confidential information is not disclosed to unauthorized individuals, especially important in external communications.”

These symptoms strongly indicatemalware infectionor a malicious app running in the background. The first action should be torun a malware scanto identify and remove malicious components.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“If a mobile device is overheating and the battery drains rapidly after installing an app, this could point to malware. Begin by scanning the device with a mobile anti-malware application.”

Before deploying an application update broadly, best practice is to test it in an isolated environment to avoid breaking production systems. The All-in-One guide defines sandbox testing clearly: “a sandbox is a place where you can experiment without messing up the primary system,” typically a virtualized environment, and it “entails checking out new and updated applications without putting the systems and data you depend on at risk.” That directly aligns with rolling out a new application update across the organization.

Mike Meyers’ Lab Manual repeats the same concept: sandbox testing uses an isolated environment and snapshots to test changes safely before production deployment. It’s positioned as a documented business process within change-management best practices, reinforcing why it comes early—before impact spreads.

A backup/rollback plan is important too, but the question asks for the first step when applying a new update to everyone. Testing first helps identify compatibility issues, installation failures, and side effects early—so you don’t deploy a bad update at scale. Therefore, Sandbox testing (C) is correct.

Once the system is cleaned, the next priority is toeducate the useron safe practices to prevent recurrence.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Post-malware remediation should include user education to prevent reinfection and identify how the malware was introduced.”

After containment and remediation, one of the final steps in incident response is user education. Since the root cause was a phishing attack, it is essential to educate users about identifying phishing attempts, safe browsing practices, and how to handle suspicious communications. This improves overall security posture and helps prevent future incidents.

A. Installing additional tools may be helpful but is a long-term step.

C. Flashing router firmware is not warranted unless the network hardware is known to be compromised.

D. Suggesting more advanced tools might be excessive given that the EDR successfully contained the incident.

Spear phishingtargets a specific individual using personalized tactics, as seen in emails impersonating a CEO to deceive a secretary.

FromQUENTIN DOCTER - COMPTIA A+ COMPLETE study GUIDE:

“Spear phishing targets specific individuals or roles within an organization using tailored messages to increase success rates.”

To prevent unauthorized physical access to a mobile device, the company must ensure the device locks quickly and requires an authentication factor before anyone can use it. PIN authentication directly blocks access by requiring a passcode to unlock the device—Quentin Docter lists PIN lock as one of the primary “screen lock” methods used to secure mobile devices, explaining it as the most common unlock method (typically 4–6 digits, sometimes alphanumeric).

Screen timeout (auto-lock) reduces the window in which an unattended phone remains usable; the All-in-One guide notes that systems can be set to an automatic timeout and screen lock, requiring credentials after a short period of inactivity. Mike Meyers’ Lab Manual reinforces that you should “protect your data from access by putting a good screen lock on the device,” and that these locks commonly require a password/PIN/pattern/biometric to regain access after locking.

Hotspots, VPN, antivirus, and location services are valuable, but they do not primarily stop someone holding the device from opening it and accessing data.

In secure or isolated network segments, DHCP may be disabled to reduce the risk of unauthorized device connections or to maintain strict IP assignment control. In such cases, the help desk technician must manually configure IP settings (including IP address, subnet mask, gateway, and DNS servers). This ensures the workstation communicates properly within that segment.

A. DNS server restriction is unrelated to manual IP configuration.

B. Allow lists refer to traffic access, but manual IP assignment is due to lack of DHCP, not allow lists.

D. NAC servers control access but don ' t replace the need for IP addressing.

End-user education is crucial after malware removal to prevent recurrence. Teaching safe browsing habits and security awareness completes the remediation cycle.

Mark Soper – Mike Meyers ' Lab Manualstates:

“Educating the user after malware remediation is part of the CompTIA malware response methodology. This includes training on phishing and safe practices.”

The correct answer is A. Hashing, because hashing is specifically designed to verify file integrity and detect whether a file has been altered after its original creation or distribution. A hash is a fixed-length value generated by running a file through a hashing algorithm such as SHA-256 or SHA-1. Even a single-bit change in the file will produce a completely different hash value.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, hashing is commonly used to validate downloaded software by comparing the calculated hash of the downloaded file with the hash published by the vendor. If the two values match, the technician can be confident that the file has not been modified or tampered with.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide emphasizes that hashing ensures integrity, not confidentiality or authentication. SSL certificates secure data in transit, but they do not validate files after download. Plug-ins and extensions provide additional browser functionality but have no role in verifying file integrity.

The Mike Meyers / Mark Soper Lab Manual reinforces that hashing is a standard best practice in secure software deployment and malware prevention. It allows technicians to confirm that files are exactly as the publisher intended.

Because the requirement is to confirm that files have not been modified, hashing is the correct and most reliable method, making A the correct answer.

The correct answer is B. Create and assign a security group with adequate permissions, because group-based permission management is the most efficient and scalable way to control access to shared resources. By assigning permissions to a group rather than individual users, administrators reduce administrative overhead and simplify future changes.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, security groups are a best practice for managing access to files, folders, and repositories. Permissions are assigned once to the group, and users inherit those permissions by being members of the group.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that granting administrative permissions is excessive and violates the principle of least privilege. Applying permissions individually increases complexity and the risk of configuration errors, especially as team membership changes.

The Mike Meyers / Mark Soper Lab Manual further clarifies that mapping a network folder does not control permissions; it only provides access to a resource that is already governed by permissions. Group-based access ensures consistency, security, and minimal effort.

Because the requirement is to allow specific actions while preventing deletion—and to do so with the least amount of effort—creating and assigning a properly permissioned security group is the optimal solution, making B the correct answer.

The correct answer is A. Perform a factory reset, because the symptoms strongly indicate a serious mobile malware infection, potentially including spyware or a trojan installed from an unofficial app store. Random pop-ups, excessive data usage, blocked access to banking apps, and inability to update the OS are classic indicators that malicious software has gained deep system-level access.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, mobile malware installed from unofficial sources can embed itself deeply into the operating system, sometimes gaining device administrator privileges. In such cases, standard remediation steps such as clearing cache or uninstalling apps may be ineffective.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that when a mobile device shows signs of persistent compromise—especially when core OS functions and security-sensitive applications are affected—the recommended first step is to perform a factory reset. This completely wipes user-installed applications and restores the device to a known-good state.

The Mike Meyers / Mark Soper Lab Manual reinforces that changing passwords is important after the device is secured, not before. Contacting support or clearing cache does not remove deeply embedded malware.

Therefore, to immediately address the security threat and regain control of the device, a factory reset is the most appropriate first action, making A the correct answer.

UPS batteries are heavy and often located at the bottom of racks to maintain balance. Safe removal requires the use of correct lifting techniques to avoid injury. OSHA and workplace safety standards emphasize ergonomic handling when dealing with heavy equipment.

A. Fire suppression readiness is important for fire safety but not specifically relevant to battery removal.

C. Antistatic bags are for electronic components, not heavy battery modules.

D. A face mask is not generally necessary unless there is a chemical leak, which is not indicated here.

When an iOS device approaches full storage capacity, performance can be significantly impacted. iOS requires a buffer of free space to perform background processes efficiently.

From theAll-in-One Exam Guide:

“iOS devices need several gigabytes of free space to maintain optimal performance. Near-full storage can cause sluggish operation and failures in updates or background tasks.”

The correct answer is B. Add the user to the local Administrators group, because this provides the necessary permissions to install software on a specific machine without granting excessive privileges across the entire domain. This approach follows the principle of least privilege while still allowing the user to perform required testing tasks.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, local administrator rights allow users to install and configure applications on a single system but do not grant access to domain-wide resources. This makes it an appropriate choice for sandboxed or test environments.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide warns against adding users to the Domain Admins group, as this grants full control over the entire Active Directory environment and poses a significant security risk. Sharing credentials or passwords violates security best practices and audit requirements.

The Mike Meyers / Mark Soper Lab Manual reinforces that granting local administrative access is a common and accepted practice in controlled testing scenarios, especially when systems are isolated from production environments.

Because the goal is to allow software installation without compromising domain security, adding the user to the local Administrators group is the best and safest option, making B the correct answer.

The correct answer is A. hostname . I corrected the wording from “OS name” to “host name” because, based on the answer choices, this question is testing the command that displays the computer’s host name. Quentin Docter’s Complete Study Guide explains that the hostname command returns the name of the host computer on which it is executed. This makes it appropriate for scripting because its output can be redirected to a file, such as hostname > computername.txt. The CompTIA A+ Core 2 objectives also list hostname , netstat , whoami , and winver as Windows command-line tools candidates should recognize. netstat displays active TCP/IP connections and network statistics, not the computer name. whoami displays the currently logged-in user account. winver displays Windows version information, but it opens a graphical dialog and is not the best option for writing simple script output to a file.

At large events such as music festivals, cellular towers may become congested due to the high volume of users attempting to connect simultaneously. This congestion causes slow or failed data connections, which explains the email application being unable to sync or connect. This is a common real-world mobile connectivity issue in crowded areas.

A. Lack of storage would prevent saving attachments, not prevent connection attempts.

B. Company firewalls usually don’t affect mobile access unless specific device restrictions are enforced.

D. Organizers do not have the ability to block the internet signal; only carriers manage mobile bandwidth.

If the PC can ping the domain controller by IP, basic connectivity exists. Domain join, however, depends heavily on name resolution (finding the domain and locating domain services), so incorrect DNS is the most likely cause. Mike Meyers explains a key diagnostic pattern: when you ping a URL/name and get “could not find host,” the system “can’t get an IP address for that Web site,” which “points to a DNS failure.” This same logic applies to domains: if the client can reach the DC by IP but can’t properly resolve domain names/services, the join fails.

Quentin Docter reinforces that one of the “key things” for TCP/IP to work effectively is that “a hostname must resolve to an IP address—an action usually performed by a DNS server,” and he highlights nslookup as a tool to verify DNS server entries.

Firewall issues could block some traffic, but the clue “ping by IP works” points away from total network blockage. IPv6 enabled is normal, and “not connected” contradicts successful ping. Therefore, DNS settings are incorrect (A).

When resolution requires another team, professionalism means clear communication, setting expectations, and explaining what will happen next. Quentin Docter describes escalation: when you don’t have the answer, “this process is called escalation,” and when a ticket is escalated, someone must “be responsible for communicating with the user.” He emphasizes “Clear Communication,” stating the prob lem description must be understandable to others because “the problem may have to be escalated,” and you should communicate work-arounds and progress transparently.

The All-in-One guide and Mike Meyers Lab Manual both stress empathy and respectful communication with frustrated users—use statements that acknowledge feelings and keep a nonaccusatory tone.

Option D best matches these best practices: explain what’s happening (app crashing), why another department must be involved, and what the user should expect (timeline/next steps/work-around if available). Transferring without explanation (A) increases frustration; a complaint (B) isn’t a solution; and working alone (C) ignores the required collaboration.

This scenario describes a rogue access point — a malicious or unauthorized wireless access point that uses the same SSID as the legitimate network. Users may connect to it unknowingly, which can result in limited network access, data interception, or redirection of traffic. The inability to reach internal file servers supports this being an unauthorized AP with no connection to internal resources.

A. A DNS issue would impact name resolution, not connectivity to file servers directly.

B. VLAN issues generally affect segmentation, not mimic SSID problems.

C. An incorrect IP address could cause connectivity issues, but not in the presence of a malicious AP broadcasting the same SSID.

The correct answer is D. cp, which is a core Linux command used to copy files and directories. File management in Linux is performed primarily through command-line utilities, and cp is one of the most fundamental commands for this purpose.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, Linux administrators frequently use commands such as cp, mv, rm, and ls to manage files. The cp command allows users to copy files between directories or locations and supports options for recursive copying and permission preservation.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide highlights that Linux file management commands differ significantly from Windows equivalents. While Windows uses robocopy and xcopy, Linux relies on simpler, built-in commands like cp.

The Mike Meyers / Mark Soper Lab Manual further explains that curl is used for transferring data over network protocols, not for managing local files. Commands such as robocopy and xcopy are Windows-specific and not available in standard Linux environments.

Because the question asks specifically about managing files in Linux, and cp is a native Linux file-management command, D is the correct answer.

VPN clients often create virtual network adapters. If the software wasn ' t uninstalled properly or crashed during install, leftover (often hidden) virtual adapters can prevent reinstallation. The proper solution is to delete hidden network adapters using Device Manager (with “Show hidden devices” enabled).

A. OS updates won’t fix a leftover driver or adapter issue.

B. Mapping an adapter to the software is not a standard or viable solution.

C. Firmware updates apply to physical adapters, not virtual VPN adapters.

Windows Helloprovides alternative sign-in options including facial recognition, fingerprint scans, and PINs, reducing dependence on passwords.

FromAll-in-One Exam Guide:

“Windows Hello offers a range of biometric and PIN-based login methods designed to simplify access while enhancing security.”

“It can be used in place of a password, ideal for users who frequently forget credentials.”

Shoulder surfing is explicitly categorized as a social engineering technique because it relies on human behavior and observation rather than exploiting software flaws or cracking passwords through computation. Quentin Docter defines it directly: “Another form of social engineering is known as shoulder surfing. It involves nothing more than watching someone when they enter their sensitive data,” such as a password or credit card number. Docter also notes that privacy filters can reduce viewing angles, but “privacy filters do not protect you as you are entering a password, since a shoulder surfer will watch your keystrokes,” and the best defense is to “survey your environment before entering personal data.”

The Mike Meyers Lab Manual reinforces the same classification: “Shoulder surfing is another technique for gathering information and gaining unauthorized access… observing someone’s screen or keyboard to get information, often passwords.” Since this is about manipulating or exploiting a person’s situation (being nearby, watching, taking advantage of inattentiveness), it is not a zero-day, evil twin, or brute-force method. Therefore, Social engineering (C) is correct.

Removing users from the local admin group prevents them from installing unauthorized software.

From Quentin Docter – Complete Study Guide:

“Local admin privileges allow users to install unauthorized apps. Removing them from this group restricts installations and helps prevent malware.” .

Single sign-on (SSO)allows users to authenticate once and gain access to multiple systems without re-entering credentials, which significantly enhances user convenience while maintaining security.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Single sign-on streamlines authentication by allowing users to log in once and access all authorized resources, reducing credential fatigue and improving security.”

BSOD after driver installation suggests a compatibility issue.Safe Mode allows rollback of driversthat may be causing the crash.

FromTravis Everett – CompTIA A+ All-in-One Exam Guide:

“If a BSOD occurs after a driver update, boot into Safe Mode and roll back to the previous driver version to restore system stability.”

An evil twin is a rogue wireless access point set up to mimic a legitimate Wi-Fi network. Unsuspecting users may connect to it, giving attackers the opportunity to intercept traffic, steal credentials, or install malware. The evil twin often uses the same SSID as the real network to fool users.

A. Stalkerware is spyware installed to track user activity, typically on personal devices.

C. Tailgating is a physical security breach involving unauthorized entry behind someone with access.

D. Shoulder surfing involves observing a person entering confidential data, such as PINs or passwords.

A synthetic full backup combines the last full backup with subsequent incremental backups to create a new full backup without re-reading data from the source system. This method significantly reduces the backup window and network impact. It is especially useful when traditional full backups are too time-consuming.

A. Changing the backup window only shifts timing, not duration.

B. Incremental weekly backups would lack a proper full recovery point and aren ' t ideal alone.

C. Storage space isn ' t the bottleneck in backup speed—it’s read/write operations and network load.

When an OS is no longer receiving updates, it is generally because it has reachedend of life (EOL), meaning the vendor has ceased support.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“End-of-life refers to the point when an OS vendor no longer issues updates or support. Systems at EOL pose security risks and must be upgraded or isolated.”