CompTIA A+ Core 2 — All Questions

Which Windows edition is designed for large enterprises and is the only one that supports joining an on-premises Active Directory domain as well as BitLocker, but is licensed through volume agreements rather than retail?

• a.Windows Enterprise✓
• b.Windows Education
• c.Windows Home
• d.Windows Pro for Workstations

Windows Enterprise is aimed at large organizations and is distributed through volume licensing rather than retail. It supports domain join, BitLocker, and advanced management features. Home lacks domain join and BitLocker.

A technician needs to open an elevated Command Prompt to run a command that modifies system files. What is the correct way to do this?

• a.Open Command Prompt and press Ctrl+Shift+Enter after typing the command
• b.Double-click cmd.exe from the Windows folder
• c.Right-click Command Prompt and choose 'Run as administrator'✓
• d.Type the command into the Run dialog

Elevated privileges are obtained by right-clicking the app and selecting 'Run as administrator', which triggers a UAC prompt. A normal launch runs with standard user rights. Elevation must be granted before the command is typed.

In Windows, which command-line utility checks the integrity of protected system files and repairs them if corruption is found?

• a.diskpart
• b.gpupdate
• c.chkdsk
• d.sfc /scannow✓

System File Checker (sfc /scannow) scans protected operating system files and restores corrupted ones from a cached copy. chkdsk repairs file-system errors on a disk, not system files. diskpart manages partitions.

Which file system is required to format a volume that will host a Windows installation and take advantage of file permissions, encryption (EFS), and journaling?

• a.FAT32
• b.NTFS✓
• c.ext4
• d.exFAT

NTFS supports file-level permissions, EFS encryption, compression, and journaling, and is required for the Windows system volume. FAT32 lacks permissions and has a 4 GB file-size limit. ext4 is a Linux file system.

A user wants to remove a Windows application cleanly. Which built-in location lists installed programs and provides an uninstall option?

• a.Task Manager > Processes
• b.Device Manager
• c.Disk Management
• d.Settings > Apps > Installed apps (or Programs and Features)✓

Installed desktop and Store apps are managed under Settings > Apps, historically the Programs and Features Control Panel item, where uninstall is offered. Task Manager only stops running processes. Device Manager handles hardware drivers.

Which Windows tool lets an administrator create, shrink, extend, and delete disk partitions through a graphical interface?

• a.Disk Management✓
• b.Performance Monitor
• c.Resource Monitor
• d.Event Viewer

Disk Management (diskmgmt.msc) provides a GUI for creating, formatting, shrinking, extending, and deleting volumes. Event Viewer only shows logs. Performance and Resource Monitor report on system utilization.

A technician wants to see startup impact and disable programs that launch at boot on a modern Windows client. Which tool is most appropriate?

• a.Task Manager Startup tab✓
• b.Services console
• c.msconfig Boot tab
• d.Registry Editor Run key only

On Windows 10/11, the Startup tab in Task Manager lists auto-start apps with their startup impact and allows disabling them. msconfig no longer manages the startup app list. Editing the registry directly is riskier and less convenient.

Which macOS feature provides automated, incremental backups to an external or network drive and lets a user restore previous versions of files?

• a.Mission Control
• b.Time Machine✓
• c.Spotlight
• d.Keychain

Time Machine performs scheduled incremental backups and lets users browse and restore prior versions of files. Spotlight is search, Mission Control manages windows/spaces, and Keychain stores credentials.

On a Linux system, which command displays the current working directory's contents in a long listing that includes permissions and ownership?

• a.pwd
• b.cd
• c.chmod
• d.ls -l✓

ls -l produces a long listing showing permissions, owner, group, size, and modification time. pwd only prints the current path. cd changes directories and chmod changes permissions.

A Linux administrator must run a single command with superuser privileges without logging in as root. Which command should prefix the command?

• a.apt
• b.sudo✓
• c.grep
• d.chown

sudo executes a single command with elevated (root) privileges for authorized users, logging the action. chown changes file ownership. apt is a package manager and grep searches text.

Which macOS utility is used to install applications simply by dragging their bundle into a specific folder, and where are most applications stored?

• a.The Dock; /System
• b.Terminal; /bin
• c.Launchpad; /Users
• d.Finder; the Applications folder✓

In macOS, most apps are self-contained bundles installed by dragging them into the Applications folder using Finder. Launchpad only launches apps, and the Dock is a shortcut bar. System binaries live elsewhere.

Which Windows command releases and then requests a new IP address configuration from a DHCP server?

• a.ipconfig /release then ipconfig /renew✓
• b.ping then tracert
• c.netstat -a
• d.nslookup then ipconfig /all

ipconfig /release drops the current DHCP lease and ipconfig /renew requests a new one. ping and tracert test connectivity, netstat shows connections, and nslookup queries DNS.

A 32-bit version of Windows has a hard limit on how much system RAM it can address. What is that practical limit?

• a.About 128 GB
• b.About 8 GB
• c.About 16 GB
• d.About 4 GB✓

A 32-bit operating system can address only about 4 GB of RAM because of the 32-bit memory address space. Installing more RAM provides no benefit under 32-bit Windows. A 64-bit OS is required to use larger amounts.

Which Windows feature encrypts an entire drive volume and can use a TPM chip to protect the encryption keys?

• a.EFS
• b.Windows Defender Firewall
• c.BitLocker
• d.Credential Manager✓

BitLocker provides full-volume encryption and can seal its keys to a TPM so the drive only unlocks on the trusted hardware. EFS encrypts individual files, not the whole volume. Credential Manager stores saved logons.

Which command-line tool applies updated Group Policy settings to a Windows client immediately rather than waiting for the next refresh interval?

• a.secedit
• b.gpresult
• c.gpupdate /force✓
• d.regedit

gpupdate /force reapplies all Group Policy settings right away. gpresult only reports the resultant set of policies. secedit configures security templates and regedit edits the registry.

A technician needs to view detailed hardware and software configuration, including the BIOS version and installed RAM, in a single Windows report. Which tool provides this?

• a.System Information (msinfo32)✓
• b.Notepad
• c.Calculator
• d.Snipping Tool

System Information (msinfo32) summarizes hardware resources, components, and the software environment, including BIOS version and installed memory. The other listed utilities are unrelated accessories.

Which mobile operating system is open source, developed primarily by Google, and allows apps to be installed from multiple stores and sideloaded APK files?

• a.Android✓
• b.iPadOS
• c.watchOS
• d.iOS

Android is open source and supports installation from Google Play, third-party stores, and sideloaded APK files. iOS and iPadOS are closed platforms that normally restrict installs to the App Store.

In Windows, which utility lets you start, stop, and set the startup type (Automatic, Manual, Disabled) of background services?

• a.Device Manager
• b.Task Scheduler
• c.Disk Cleanup
• d.Services (services.msc)✓

The Services console (services.msc) manages background services, including their state and startup type. Task Scheduler runs tasks on triggers, and Device Manager manages hardware drivers.

Which upgrade method preserves user files, settings, and installed applications when moving to a newer version of Windows?

• a.Bare-metal reimage
• b.Clean install
• c.In-place upgrade✓
• d.Factory reset

An in-place upgrade installs the new Windows version while keeping user files, settings, and most applications. A clean install and bare-metal reimage wipe the existing environment. A factory reset returns the device to its shipped state.

Which Windows command-line utility maps a network share to a drive letter?

• a.tasklist
• b.format
• c.ipconfig
• d.net use✓

net use maps a shared network folder to a drive letter and manages network connections. ipconfig shows IP configuration, tasklist lists processes, and format prepares a disk.

A macOS user wants to force an unresponsive application to close. Which method accomplishes this?

• a.Delete the app from Applications
• b.Press Command+Q once
• c.Restart the router
• d.Press Command+Option+Esc to open Force Quit✓

Command+Option+Esc opens the Force Quit Applications window, letting the user end a frozen app. Command+Q requests a normal quit that a hung app may ignore. Deleting the app is unnecessary for a temporary hang.

Which type of Windows installation partition style is required to boot from drives larger than 2 TB and supports more than four primary partitions?

• a.FAT
• b.MBR
• c.GPT✓
• d.EFS

GPT (GUID Partition Table) supports drives larger than 2 TB and many partitions, and pairs with UEFI. MBR is limited to 2 TB and four primary partitions. FAT and EFS are not partition styles.

Which Windows Control Panel or Settings area is used to configure how the system behaves when the power button is pressed and to enable or disable fast startup?

• a.Power Options✓
• b.Ease of Access
• c.Network and Sharing Center
• d.Programs and Features

Power Options controls power plans, button actions, sleep behavior, and fast startup. Network and Sharing Center handles connections, and Programs and Features manages installed software.

Which command in a Linux terminal changes the permissions of a file, for example granting the owner read/write/execute using numeric mode 700?

• a.cp
• b.chmod✓
• c.ps
• d.mv

chmod changes file and directory permission bits, and numeric mode 700 grants the owner full access while denying group and others. mv and cp move and copy files, and ps lists processes.

A user reports that Windows shows only 3.5 GB of usable RAM even though 8 GB is installed. Which is the most likely cause?

• a.The pagefile is disabled
• b.The GPU is integrated
• c.A 32-bit version of Windows is installed✓
• d.The RAM is faulty

A 32-bit Windows install can address only about 4 GB total, so much of 8 GB appears unusable. Upgrading to 64-bit Windows resolves it. Faulty RAM usually causes crashes rather than a clean address-space limit.

Which Windows tool schedules programs or scripts to run automatically at specific times or in response to events such as logon?

• a.Task Scheduler✓
• b.Disk Management
• c.Resource Monitor
• d.Registry Editor

Task Scheduler runs programs and scripts on time-based or event-based triggers, such as at logon or on a daily schedule. Disk Management handles volumes, and Resource Monitor reports utilization.

Which file system is best suited for a large external flash drive that must be read and written on both Windows and macOS without a 4 GB file-size limit?

• a.FAT32
• b.NTFS
• c.exFAT✓
• d.EFS

exFAT is cross-platform, supported natively by Windows and macOS, and has no practical 4 GB file-size limit. FAT32 caps files at 4 GB. NTFS is read-only by default on macOS.

A technician wants to verify whether a Windows installation is 32-bit or 64-bit and see the edition and version. Where is this shown most directly?

• a.Recycle Bin properties
• b.Printer preferences
• c.Network adapter properties
• d.Settings > System > About (or System Properties)✓

Settings > System > About (System Properties) reports the edition, version, and whether the system type is 32-bit or 64-bit. The other listed locations do not report OS architecture.

A user receives an email that appears to be from the company's bank, urging them to click a link and confirm their password immediately. What type of attack is this?

• a.DDoS
• b.SQL injection
• c.Phishing✓
• d.Zero-day exploit

Phishing uses fraudulent messages impersonating a trusted party to trick users into revealing credentials or clicking malicious links. A DDoS floods a service with traffic, and SQL injection targets databases, neither of which fits this scenario.

Which type of malware encrypts a victim's files and demands payment in exchange for the decryption key?

• a.Keylogger
• b.Rootkit
• c.Adware
• d.Ransomware✓

Ransomware encrypts data and extorts the victim for a decryption key, often with a deadline. A keylogger records keystrokes, a rootkit hides deep in the system, and adware displays unwanted ads.

An attacker follows an authorized employee through a secured door before it closes, without presenting their own badge. What is this physical technique called?

• a.Phishing
• b.Shoulder surfing
• c.Whaling
• d.Tailgating✓

Tailgating (piggybacking) is when an unauthorized person follows an authorized one through a controlled entrance. Shoulder surfing is watching someone enter credentials. Whaling is phishing that targets executives.

Which authentication approach requires two or more independent factors, such as a password plus a code from an authenticator app?

• a.Least privilege
• b.Multifactor authentication✓
• c.Single sign-on
• d.Access control list

Multifactor authentication (MFA) combines factors from different categories (something you know, have, or are), such as a password plus an app code. Single sign-on centralizes logins but is not inherently multifactor.

Which practice grants each user only the minimum permissions needed to perform their job, reducing the impact of a compromised account?

• a.Open sharing
• b.Principle of least privilege✓
• c.Full administrator access for all
• d.Default allow

The principle of least privilege limits users to the access their role requires, shrinking the attack surface if an account is compromised. Granting everyone administrator rights greatly increases risk.

Which type of malware disguises itself as legitimate software to trick a user into installing it, then performs malicious actions in the background?

• a.Logic bomb
• b.Trojan horse✓
• c.Worm
• d.Boot sector virus

A Trojan horse masquerades as a useful program to get installed, then carries a hidden malicious payload. A worm self-replicates across networks, and a logic bomb triggers on a condition rather than relying on disguise.

A technician wants to protect a laptop's data so it cannot be read if the device is lost or stolen. Which control best achieves this?

• a.Full-disk encryption✓
• b.A screen saver
• c.Disabling the firewall
• d.A stronger Wi-Fi password

Full-disk encryption renders stored data unreadable without the key, protecting it if the hardware is lost or stolen. A screen saver or Wi-Fi password does not protect data at rest on the drive.

Which social engineering tactic involves an attacker impersonating IT support over the phone to convince a user to reveal their password?

• a.Vishing✓
• b.Evil twin
• c.Tailgating
• d.Dumpster diving

Vishing is voice phishing, where the attacker uses a phone call and pretext (such as posing as IT) to extract sensitive information. Dumpster diving searches discarded materials, and an evil twin is a rogue Wi-Fi access point.

Which Windows security feature filters inbound and outbound network traffic based on configurable rules to help block unauthorized connections?

• a.Snipping Tool
• b.Task Manager
• c.Windows Defender Firewall✓
• d.Disk Cleanup

Windows Defender Firewall inspects network traffic and permits or blocks it according to rules, helping stop unauthorized connections. The other tools do not perform network filtering.

When disposing of drives that held sensitive data, which method most reliably prevents any data recovery from a hard disk drive?

• a.Moving files to the Recycle Bin
• b.Renaming the files
• c.Quick formatting the drive
• d.Physical destruction (shredding or drilling)✓

Physical destruction such as shredding or drilling reliably prevents recovery from a magnetic hard drive. A quick format and Recycle Bin deletion leave data recoverable, and renaming does nothing to remove data.

Which term describes a previously unknown software vulnerability that attackers exploit before the vendor has released a patch?

• a.Zero-day vulnerability✓
• b.Replay attack
• c.Brute-force attack
• d.Man-in-the-middle

A zero-day vulnerability is a flaw unknown to the vendor, giving defenders zero days to patch before exploitation. A brute-force attack guesses credentials and a replay attack reuses captured data.

Which of the following is the strongest wireless encryption standard a technician should select when configuring a modern home or small-office router?

• a.WEP
• b.WPA
• c.WPA3✓
• d.WPS

WPA3 is the newest and strongest Wi-Fi security standard, improving on WPA2 with better key exchange. WEP and the original WPA are outdated and insecure, and WPS is a convenience feature that can weaken security.

Which best practice reduces the risk that a stolen password alone can compromise an account?

• a.Requiring multifactor authentication✓
• b.Disabling account lockout
• c.Writing passwords on a sticky note
• d.Reusing one password everywhere

Requiring MFA means a stolen password is not enough because an additional factor is needed. Reusing passwords and disabling lockout increase exposure, and writing passwords down risks disclosure.

A pop-up claims the computer is infected and urges the user to call a phone number for paid removal help. What is this most likely an example of?

• a.A Windows Update notice
• b.A driver installation prompt
• c.A rogue/fake security alert (scareware)✓
• d.A legitimate antivirus alert

Scareware displays alarming fake alerts to pressure users into calling scammers or buying useless software. Legitimate antivirus tools do not ask users to call an unknown number. Treat such pop-ups as social engineering.

Which access-control concept assigns permissions to users based on their job function or group rather than individually?

• a.Port forwarding
• b.MAC address filtering
• c.Full disk encryption
• d.Role-based access control✓

Role-based access control (RBAC) grants permissions according to a user's role or group, simplifying administration and enforcing consistency. The other options relate to encryption or networking, not permission assignment.

A user wants to prevent unauthorized people from reading over their shoulder as they type a password in a public place. Which countermeasure is most directly relevant?

• a.Using a privacy screen filter and shielding the keyboard✓
• b.Updating antivirus
• c.Using a longer Wi-Fi key
• d.Enabling a firewall

A privacy screen filter narrows viewing angles and shielding the keyboard defeats shoulder surfing in public. Firewalls, antivirus, and Wi-Fi keys do not stop someone physically observing the screen or keystrokes.

Which characteristic makes a password policy stronger against brute-force and dictionary attacks?

• a.Never expiring shared passwords
• b.Using the username as the password
• c.Disabling case sensitivity
• d.Increased length and complexity✓

Longer, more complex passwords dramatically increase the number of combinations an attacker must try. Using the username or a shared, never-expiring credential makes guessing trivial and weakens security.

Which type of malware is specifically designed to hide its presence and maintain privileged access, often loading before the operating system fully starts?

• a.Spyware
• b.Rootkit✓
• c.Adware
• d.Ransomware

A rootkit conceals itself and other malware while retaining privileged control, sometimes hooking into the boot process. Adware merely shows ads and spyware collects data, but neither is defined primarily by deep stealth.

Which authentication factor category does a fingerprint or facial scan belong to?

• a.Something you are✓
• b.Something you have
• c.Somewhere you are
• d.Something you know

Biometrics such as fingerprints and facial scans are 'something you are'. Passwords are 'something you know' and a token or phone is 'something you have'. Combining categories yields multifactor authentication.

A company wants to make sure former employees can no longer access systems the moment they leave. Which practice addresses this?

• a.Sharing one admin account
• b.Promptly disabling accounts during offboarding✓
• c.Ignoring account audits
• d.Leaving accounts enabled indefinitely

Disabling accounts immediately during offboarding removes access when an employee departs. Shared admin accounts and dormant enabled accounts create lingering, hard-to-attribute access that attackers can exploit.

Which term describes an attacker setting up a rogue Wi-Fi access point with the same name as a legitimate network to intercept traffic?

• a.Watering hole
• b.Evil twin✓
• c.SQL injection
• d.Tailgating

An evil twin is a malicious access point impersonating a trusted SSID so victims connect and expose their traffic. Tailgating is a physical intrusion and SQL injection targets databases, not wireless clients.

What is the primary security benefit of keeping operating systems and applications patched and up to date?

• a.It removes the need for backups
• b.It increases screen brightness
• c.It disables all user accounts
• d.It closes known vulnerabilities before they can be exploited✓

Patching remediates known vulnerabilities, reducing the window in which attackers can exploit them. It does not replace backups, alter brightness, or disable accounts.

Which practice helps protect users from entering credentials on a fraudulent website that mimics a real one?

• a.Turning off automatic updates
• b.Disabling the firewall
• c.Reusing the same password everywhere
• d.Verifying the site's URL and valid HTTPS certificate✓

Checking the exact domain and confirming a valid HTTPS certificate helps users detect lookalike phishing sites before entering credentials. Disabling the firewall or reusing passwords increases risk rather than reducing it.

Which control ensures that a mobile device's data can be erased remotely if the device is lost or stolen?

• a.Disabling encryption
• b.Turning off the passcode
• c.A louder ringtone
• d.Remote wipe capability✓

Remote wipe lets an administrator or user erase a lost or stolen device's data over the network. Disabling encryption or the passcode would weaken protection, and ringtones are irrelevant to data safety.

A Windows PC repeatedly shows a blue screen (stop error) shortly after installing a new device driver. What is the best first troubleshooting step?

• a.Disable the antivirus permanently
• b.Immediately replace the motherboard
• c.Reinstall all applications
• d.Boot into Safe Mode and roll back or update the driver✓

Because the crashes began right after a driver install, booting into Safe Mode and rolling back or updating that driver directly targets the likely cause. Replacing hardware or reinstalling all apps is premature and disproportionate.

An application launches but immediately closes without an error message. Which tool can reveal a logged reason for the crash?

• a.Character Map
• b.Disk Cleanup
• c.Event Viewer✓
• d.Magnifier

Event Viewer records application and system errors, often capturing the faulting module or error code behind a silent crash. Disk Cleanup, Character Map, and Magnifier do not provide diagnostic crash logs.

A smartphone's battery drains unusually fast and the device runs hot even when idle. Which is a likely software-related cause to investigate first?

• a.A misbehaving or malicious app running in the background✓
• b.The screen resolution setting
• c.The charger cable color
• d.The phone case brand

A rogue or poorly optimized background app can consume CPU and radios continuously, draining the battery and generating heat. Checking battery usage stats to find the offending app is the logical first step.

Windows fails to reach the desktop and boots into automatic repair loops. Which recovery option lets a technician restore the system to an earlier known-good configuration without deleting personal files?

• a.Replace the CPU
• b.Reinstall Windows from scratch
• c.Format the drive
• d.System Restore✓

System Restore reverts system files, drivers, and registry settings to an earlier restore point while leaving personal files intact. A full reinstall or format would be more destructive and time-consuming.

A user reports that their web browser constantly redirects to unwanted sites and shows new toolbars they did not install. What is the most likely cause?

• a.A failing power supply
• b.A dead CMOS battery
• c.A browser hijacker or adware infection✓
• d.An incorrect monitor refresh rate

Unwanted redirects and unfamiliar toolbars are classic signs of a browser hijacker or adware. Hardware issues like a power supply, refresh rate, or CMOS battery would not cause browser redirection behavior.

A Windows computer is extremely slow, and Task Manager shows an unknown process using nearly 100% CPU. What should the technician do first?

• a.Reinstall Windows
• b.Research the process, then end it and run a malware scan✓
• c.Replace the hard drive
• d.Add more RAM immediately

Identifying the process and confirming whether it is legitimate, then ending it and scanning for malware, addresses the actual cause of high CPU use. Hardware changes or a reinstall are premature before diagnosing the process.

After a Windows update, a specific application no longer opens. Which approach best isolates whether the update caused the problem?

• a.Uninstall the recent update or use System Restore, then test the app✓
• b.Replace the RAM
• c.Reset the BIOS
• d.Buy a new computer

Removing the recent update or rolling back with System Restore and retesting directly tests the hypothesis that the update broke the app. This targeted change isolates the cause without unnecessary hardware work.

A mobile app repeatedly crashes on launch after the user has plenty of storage and a good connection. Which sequence of steps is most appropriate first?

• a.Root the device
• b.Factory reset the phone right away
• c.Force stop the app, clear its cache, then update or reinstall it✓
• d.Replace the battery

Force stopping, clearing the app cache, and updating or reinstalling resolves most single-app crashes with minimal disruption. A factory reset or rooting is far more drastic and should not be the first response.

A user cannot install updates and sees low-disk-space warnings on the Windows system drive. Which action most directly addresses the root cause?

• a.Disable the network adapter
• b.Change the desktop wallpaper
• c.Increase the monitor brightness
• d.Free up space with Disk Cleanup and remove unneeded files✓

Update failures tied to low disk space are resolved by freeing storage, for example with Disk Cleanup or by removing unneeded files. The other actions do not affect available disk space.

Several pop-ups appear even when no browser is open, and the antivirus has been mysteriously disabled. What is the most likely explanation?

• a.The monitor cable is loose
• b.The BIOS date is wrong
• c.The system is infected with malware✓
• d.The keyboard is failing

Pop-ups without a browser and a disabled antivirus strongly indicate a malware infection actively defending itself. Hardware or BIOS issues would not disable security software or generate advertising pop-ups.

When following best practices to remediate a malware infection, which step should be performed to prevent the malware from spreading or communicating while it is being removed?

• a.Increase the screen resolution
• b.Quarantine/disconnect the infected system from the network✓
• c.Reinstall Microsoft Office
• d.Defragment the drive

Isolating the machine from the network (quarantine) stops the malware from spreading or contacting command-and-control servers during remediation. Reinstalling Office or changing resolution does nothing to contain an infection.

A user's files suddenly have a strange extension and a note demands payment to restore them. What has most likely happened, and what is the safest recovery path?

• a.A ransomware infection; isolate the system and restore data from clean backups✓
• b.A driver conflict; update the driver
• c.A dead battery; replace it
• d.A failed update; reinstall the update

Renamed files plus a ransom note indicate ransomware. The safest recovery is to isolate the machine and restore from known-clean backups rather than pay. Driver or battery explanations do not match these symptoms.

A laptop touchscreen registers phantom touches and inputs the user did not make. After a reboot the issue persists in every app. What is a reasonable early software step before assuming hardware failure?

• a.Reinstall all user applications
• b.Reset the router
• c.Update or reinstall the touchscreen/digitizer driver and check for OS updates✓
• d.Immediately replace the display panel

Updating or reinstalling the digitizer driver and applying OS updates can resolve ghost-touch issues caused by software or firmware bugs. Only after software steps fail should hardware replacement be considered.

Which log-based Windows tool would best help a technician correlate a recurring application error with the exact time and error code each time it happens?

• a.Paint
• b.Sticky Notes
• c.Calculator
• d.Event Viewer✓

Event Viewer timestamps application and system events with error codes, allowing a technician to correlate a recurring crash with its cause. The other listed tools are simple accessories with no logging capability.

A Windows PC boots to a black screen with only a cursor after login. Which troubleshooting environment lets the technician load a minimal set of drivers to diagnose the issue?

• a.Screen saver settings
• b.Safe Mode✓
• c.UEFI firmware setup
• d.BIOS beep codes

Safe Mode starts Windows with a minimal set of drivers and services, helping determine whether a third-party driver or startup program causes the black screen. Firmware setup and beep codes address hardware, not this OS-level issue.

A user complains that the system time keeps resetting and secure websites report certificate errors. While often hardware-related, which quick check can rule out a simple software/setting cause?

• a.Verify the correct date, time, and time zone settings and enable automatic time sync✓
• b.Replace the RAM
• c.Reinstall the OS
• d.Replace the hard drive

Certificate errors frequently stem from an incorrect clock, so verifying date/time/time zone and enabling automatic synchronization is a fast software check. If the clock still resets after reboots, a dead CMOS battery may be the hardware cause.

An Android user side-loaded an app and now sees excessive ads and unexpected charges. What is the recommended remediation?

• a.Buy a new phone
• b.Upgrade the data plan
• c.Replace the SIM card
• d.Uninstall the suspicious app, run a mobile security scan, and review app permissions✓

Removing the side-loaded app, scanning for malware, and reviewing permissions targets the likely malicious source of ads and charges. Buying new hardware or changing the SIM does not remove the offending software.

A desktop application freezes frequently only when a specific large file is opened, while smaller files work fine. What is a sensible first hypothesis to test?

• a.The monitor is defective
• b.The specific file may be corrupt or too large for available memory✓
• c.The power supply is failing
• d.The keyboard driver is missing

Because only one large file triggers the freeze, testing whether that file is corrupt or exceeds available memory is a logical first step, such as opening a copy or checking resource usage. General hardware failures would affect all files.

During malware remediation best practices, when should the technician re-enable System Restore and create a fresh restore point?

• a.After the system is verified clean, to establish a new known-good point✓
• b.Before scanning, so restore points are preserved
• c.Never, System Restore must stay off
• d.Only if the antivirus fails

Best practice is to disable System Restore during cleanup so infected restore points are purged, then re-enable it and create a new restore point once the system is confirmed clean. Preserving infected restore points risks reinfection.

A user reports their phone's data usage spiked dramatically with no change in habits, and unfamiliar apps appeared. What is the most appropriate investigation?

• a.Replace the charging port
• b.Check data-usage per app, remove unknown apps, and scan for malware✓
• c.Turn off Bluetooth permanently
• d.Increase screen timeout

Reviewing per-app data usage, removing unrecognized apps, and scanning for malware targets a likely compromise causing the spike. Charging-port or Bluetooth changes are unrelated to unexplained data consumption.

A Windows system shows the message 'No boot device found' after being powered off normally. Which is the most appropriate first diagnostic step?

• a.Check boot order in firmware and verify the drive is detected✓
• b.Change the desktop theme
• c.Update the web browser
• d.Reinstall Microsoft Office

Verifying the firmware boot order and confirming the drive is detected isolates whether the boot device is missing or misordered before assuming corruption or hardware failure. Application or theme changes are irrelevant to booting.

Why is it important to maintain accurate, up-to-date documentation such as network diagrams and asset inventories?

• a.It speeds troubleshooting and supports consistent, informed decisions✓
• b.It replaces the need for backups
• c.It encrypts all network traffic
• d.It increases the monitor refresh rate

Accurate documentation helps technicians understand the environment quickly, reducing troubleshooting time and supporting good decisions. It does not encrypt traffic, change hardware behavior, or substitute for backups.

In a formal change-management process, what should be prepared in case a change causes unexpected problems in production?

• a.A faster CPU
• b.A rollback (back-out) plan✓
• c.A brighter display
• d.A louder alarm

A rollback or back-out plan defines how to revert a change safely if it fails, minimizing downtime. It is a core part of responsible change management and unrelated to hardware upgrades or alarms.

Which safety practice protects sensitive electronic components from static discharge while a technician works inside a computer?

• a.Turning up the room heat
• b.Working on a carpet
• c.Wearing rubber-soled shoes only
• d.Using an anti-static (ESD) wrist strap connected to ground✓

An ESD wrist strap connected to ground equalizes charge and prevents static from damaging components. Carpet actually increases static risk, and shoe type or room temperature does not provide reliable ESD protection.

According to standard change management, what must typically happen before a significant change is implemented in a production environment?

• a.A social media post
• b.Documented request, risk analysis, and approval by the change board✓
• c.Only the technician's verbal note
• d.Nothing; changes are made immediately

Significant changes generally require a documented request, risk assessment, and formal approval before implementation to control impact. Making changes without review or approval undermines stability and accountability.

Which document defines the acceptable ways employees may use company computers, networks, and internet access?

• a.Bill of materials
• b.Purchase order
• c.Acceptable Use Policy (AUP)✓
• d.Network diagram

An Acceptable Use Policy specifies permitted and prohibited uses of company IT resources. A network diagram maps topology and a bill of materials lists parts, neither of which governs user behavior.

When handling a customer's confidential data during a repair, which behavior best respects privacy and professional conduct?

• a.Posting screenshots online
• b.Sharing interesting files with coworkers
• c.Accessing only what is necessary and keeping the data confidential✓
• d.Copying personal photos for yourself

Professionals should access only the data required for the task and keep customer information confidential. Sharing, posting, or copying personal data violates privacy expectations and ethical standards.

Which fire extinguisher class is appropriate for electrical fires involving energized equipment?

• a.Class B (flammable liquids)
• b.Class C (electrical)✓
• c.Class A (ordinary combustibles)
• d.Class K (cooking oils)

Class C extinguishers are rated for fires in energized electrical equipment and use a non-conductive agent. Class A is for ordinary combustibles and Class B for flammable liquids, which are unsafe on live electrical fires.

Which scripting file type is native to Windows and commonly used to automate administrative tasks with cmdlets?

• a..ps1 (PowerShell)✓
• b..py (Python) only
• c.VBScript only
• d..sh (Bash)

PowerShell scripts (.ps1) use cmdlets and are the native automation language for Windows administration. Bash (.sh) is native to Linux/Unix. Python and VBScript can be used but .ps1 is the Windows-native choice described.

What is the primary purpose of a knowledge base or ticketing system in an IT support environment?

• a.To overclock the CPU
• b.To encrypt hard drives
• c.To track issues and share documented solutions for consistency✓
• d.To replace the firewall

A knowledge base and ticketing system record incidents and proven solutions, enabling consistent, efficient support and knowledge sharing. They do not perform encryption, overclocking, or firewall functions.

When lifting a heavy piece of equipment such as a large UPS or printer, which technique reduces the risk of injury?

• a.Bend at the waist and twist while lifting
• b.Lift as quickly as possible
• c.Lift with your legs, keep your back straight, and hold the load close✓
• d.Carry it one-handed

Proper lifting means bending the knees, keeping the back straight, using the leg muscles, and holding the load close to the body. Bending at the waist and twisting greatly increases the chance of back injury.

Which document is typically required before disposing of batteries, toner cartridges, or other chemicals to ensure proper handling?

• a.A network diagram
• b.A change request form
• c.An acceptable use policy
• d.A Safety Data Sheet (SDS)✓

A Safety Data Sheet (SDS) provides handling, storage, and disposal guidance for hazardous materials like batteries and toner. Network diagrams and change requests do not address chemical safety or disposal.

Which regulated data type requires special handling under privacy rules and should never be exposed carelessly during support work?

• a.Public marketing brochures
• b.Press releases
• c.Personally identifiable information (PII) and healthcare data (PHI)✓
• d.Open-source code

PII and PHI are protected categories subject to privacy regulations and must be safeguarded from unauthorized disclosure. Public brochures, open-source code, and press releases are not confidential regulated data.

In change management, what is the purpose of documenting the 'scope' of a proposed change?

• a.To brighten the display
• b.To define exactly what will and will not be affected✓
• c.To disable the firewall
• d.To increase the clock speed

Defining scope clarifies which systems, users, and processes the change affects and which it does not, guiding testing and communication. It has nothing to do with clock speed, firewalls, or display brightness.

Which environmental control helps protect data-center equipment from damage caused by static electricity and overheating?

• a.Removing all air filtration
• b.Maintaining proper temperature and humidity levels✓
• c.Storing equipment in direct sunlight
• d.Increasing dust accumulation

Controlled temperature and humidity reduce both overheating and static-discharge risk, protecting equipment. Excess heat, sunlight, dust, or overly dry air all increase the likelihood of hardware damage.

What is a key reason to use a change board or approval step rather than letting any technician change production systems freely?

• a.It encrypts the network
• b.It reviews risk and reduces unplanned outages✓
• c.It removes the need for backups
• d.It makes the CPU faster

A review or approval step evaluates risk, dependencies, and timing, reducing the chance of unplanned outages from uncoordinated changes. It does not affect CPU speed, backups, or encryption directly.

Which basic scripting construct repeats a block of instructions until a condition is met, and is fundamental to automation?

• a.A comment
• b.A file path
• c.A loop✓
• d.A variable

A loop repeats instructions until a condition is satisfied, letting a script automate repetitive work. A variable stores a value and a comment documents code, but neither performs repetition on its own.

When a customer becomes upset during a support interaction, which professional communication practice is most appropriate?

• a.Listen actively, stay calm, and avoid arguing or being defensive✓
• b.Walk away without explanation
• c.Interrupt and raise your voice
• d.Blame the customer

Active listening, staying calm, and not arguing help de-escalate tension and maintain professionalism. Interrupting, blaming, or abandoning the customer damages trust and violates good conduct standards.

Which purpose does a 'bill of materials' (BOM) or asset inventory serve in IT operations?

• a.It measures Wi-Fi signal strength
• b.It encrypts the hard drive
• c.It configures the firewall
• d.It lists components or assets and their details for tracking and procurement✓

A bill of materials or asset inventory itemizes components or devices with relevant details, supporting tracking, procurement, and lifecycle management. It does not measure signal strength or configure security controls.

Under change management, why should a change include a documented 'end-user acceptance' or verification step after implementation?

• a.To increase RAM automatically
• b.To confirm the change works as intended and the issue is resolved✓
• c.To disable logging
• d.To overclock the GPU

Verifying end-user acceptance confirms the change achieved its goal and did not introduce new problems before the change is closed. It does not alter hardware or logging by itself.

Which environmental and safety consideration applies when using compressed air to clean dust from a computer?

• a.Spray directly into spinning fans at full speed
• b.Use short bursts, keep the can upright, and hold fans still to avoid over-spinning✓
• c.Use it while the unit is powered on and open
• d.Shake and heat the can first

Compressed air should be used in short bursts with the can upright, and fans should be held still so they do not over-spin and get damaged. Powering on the unit or forcing fans to spin can cause damage or injury.

What is the main benefit of following a standardized incident-response and documentation procedure during a security event?

• a.Brighter monitors
• b.Faster internet speeds
• c.Lower electricity bills
• d.Consistent handling, proper evidence preservation, and clear communication✓

A standardized procedure ensures incidents are handled consistently, evidence is preserved for possible investigation, and stakeholders are informed. It is unrelated to internet speed, display brightness, or utility costs.

When disposing of old electronics, which approach aligns with environmental regulations and responsible practice?

• a.Recycle through certified e-waste programs and follow local regulations✓
• b.Throw them in regular household trash
• c.Burn them to save space
• d.Bury them in a backyard

Certified e-waste recycling handles hazardous components properly and complies with regulations. Household trash, burying, or burning electronics can release toxic materials and violate environmental laws.

Which practice best supports accountability when multiple technicians manage the same systems over time?

• a.Using one shared, undocumented login
• b.Keeping a change log and updated documentation of who changed what and when✓
• c.Deleting logs weekly
• d.Skipping all records

A change log and current documentation record who made each change and when, supporting accountability and troubleshooting. Shared undocumented logins and deleted logs destroy the audit trail and hinder accountability.

Before performing maintenance that may cause downtime, what professional step should a technician take regarding affected users?

• a.Disable their accounts permanently
• b.Communicate the planned maintenance window and expected impact in advance✓
• c.Say nothing and hope no one notices
• d.Change the wallpaper first

Notifying affected users of the maintenance window and expected impact sets expectations and reduces disruption complaints. Staying silent or disabling accounts is unprofessional and harms trust.

Which practice ensures that a critical account remains protected even if its password is exposed in a data breach elsewhere?

• a.Enabling multifactor authentication and using a unique password✓
• b.Reusing the same password across sites
• c.Writing the password in a shared document
• d.Disabling the login screen

A unique password combined with multifactor authentication means a password leaked from another site cannot alone unlock the account. Reusing passwords or sharing them in documents spreads the risk of a single breach.

A Windows PC intermittently loses its network connection only over Wi-Fi, while wired devices stay online. Which is a reasonable early software step?

• a.Replace the monitor
• b.Replace the motherboard
• c.Update the wireless adapter driver and check power-management settings for the adapter✓
• d.Reinstall the operating system

Updating the wireless driver and disabling aggressive power-saving on the adapter often resolves intermittent Wi-Fi drops caused by software or firmware. Reinstalling the OS or replacing hardware is premature before these checks.

Which practice best protects customer privacy when a technician must step away from a workstation that displays sensitive information?

• a.Lock the screen so credentials are required to resume✓
• b.Leave it unlocked for convenience
• c.Increase the brightness
• d.Post the password nearby

Locking the screen prevents unauthorized viewing or use of sensitive data while the technician is away. Leaving it unlocked or posting the password exposes confidential information and violates privacy best practices.