CompTIA A+ Core 2 — All Questions

Which Windows edition is designed for large enterprises and is the only one that supports joining an on-premises Active Directory domain as well as BitLocker, but is licensed through volume agreements rather than retail?

• a.Windows Enterprise✓
• b.Windows Education
• c.Windows Home
• d.Windows Pro for Workstations

Windows Enterprise is aimed at large organizations and is distributed through volume licensing rather than retail. It supports domain join, BitLocker, and advanced management features. Home lacks domain join and BitLocker.

A technician needs to open an elevated Command Prompt to run a command that modifies system files. What is the correct way to do this?

• a.Open Command Prompt and press Ctrl+Shift+Enter after typing the command
• b.Double-click cmd.exe from the Windows folder
• c.Right-click Command Prompt and choose 'Run as administrator'✓
• d.Type the command into the Run dialog

Elevated privileges are obtained by right-clicking the app and selecting 'Run as administrator', which triggers a UAC prompt. A normal launch runs with standard user rights. Elevation must be granted before the command is typed.

In Windows, which command-line utility checks the integrity of protected system files and repairs them if corruption is found?

• a.diskpart
• b.gpupdate
• c.chkdsk
• d.sfc /scannow✓

System File Checker (sfc /scannow) scans protected operating system files and restores corrupted ones from a cached copy. chkdsk repairs file-system errors on a disk, not system files. diskpart manages partitions.

Which file system is required to format a volume that will host a Windows installation and take advantage of file permissions, encryption (EFS), and journaling?

• a.FAT32
• b.NTFS✓
• c.ext4
• d.exFAT

NTFS supports file-level permissions, EFS encryption, compression, and journaling, and is required for the Windows system volume. FAT32 lacks permissions and has a 4 GB file-size limit. ext4 is a Linux file system.

A user wants to remove a Windows application cleanly. Which built-in location lists installed programs and provides an uninstall option?

• a.Task Manager > Processes
• b.Device Manager
• c.Disk Management
• d.Settings > Apps > Installed apps (or Programs and Features)✓

Installed desktop and Store apps are managed under Settings > Apps, historically the Programs and Features Control Panel item, where uninstall is offered. Task Manager only stops running processes. Device Manager handles hardware drivers.

Which Windows tool lets an administrator create, shrink, extend, and delete disk partitions through a graphical interface?

• a.Disk Management✓
• b.Performance Monitor
• c.Resource Monitor
• d.Event Viewer

Disk Management (diskmgmt.msc) provides a GUI for creating, formatting, shrinking, extending, and deleting volumes. Event Viewer only shows logs. Performance and Resource Monitor report on system utilization.

A technician wants to see startup impact and disable programs that launch at boot on a modern Windows client. Which tool is most appropriate?

• a.Task Manager Startup tab✓
• b.Services console
• c.msconfig Boot tab
• d.Registry Editor Run key only

On Windows 10/11, the Startup tab in Task Manager lists auto-start apps with their startup impact and allows disabling them. msconfig no longer manages the startup app list. Editing the registry directly is riskier and less convenient.

Which macOS feature provides automated, incremental backups to an external or network drive and lets a user restore previous versions of files?

• a.Mission Control
• b.Time Machine✓
• c.Spotlight
• d.Keychain

Time Machine performs scheduled incremental backups and lets users browse and restore prior versions of files. Spotlight is search, Mission Control manages windows/spaces, and Keychain stores credentials.

On a Linux system, which command displays the current working directory's contents in a long listing that includes permissions and ownership?

• a.pwd
• b.cd
• c.chmod
• d.ls -l✓

ls -l produces a long listing showing permissions, owner, group, size, and modification time. pwd only prints the current path. cd changes directories and chmod changes permissions.

A Linux administrator must run a single command with superuser privileges without logging in as root. Which command should prefix the command?

• a.apt
• b.sudo✓
• c.grep
• d.chown

sudo executes a single command with elevated (root) privileges for authorized users, logging the action. chown changes file ownership. apt is a package manager and grep searches text.

Which macOS utility is used to install applications simply by dragging their bundle into a specific folder, and where are most applications stored?

• a.The Dock; /System
• b.Terminal; /bin
• c.Launchpad; /Users
• d.Finder; the Applications folder✓

In macOS, most apps are self-contained bundles installed by dragging them into the Applications folder using Finder. Launchpad only launches apps, and the Dock is a shortcut bar. System binaries live elsewhere.

Which Windows command releases and then requests a new IP address configuration from a DHCP server?

• a.ipconfig /release then ipconfig /renew✓
• b.ping then tracert
• c.netstat -a
• d.nslookup then ipconfig /all

ipconfig /release drops the current DHCP lease and ipconfig /renew requests a new one. ping and tracert test connectivity, netstat shows connections, and nslookup queries DNS.

A 32-bit version of Windows has a hard limit on how much system RAM it can address. What is that practical limit?

• a.About 128 GB
• b.About 8 GB
• c.About 16 GB
• d.About 4 GB✓

A 32-bit operating system can address only about 4 GB of RAM because of the 32-bit memory address space. Installing more RAM provides no benefit under 32-bit Windows. A 64-bit OS is required to use larger amounts.

Which Windows feature encrypts an entire drive volume and can use a TPM chip to protect the encryption keys?

• a.EFS
• b.Windows Defender Firewall
• c.BitLocker
• d.Credential Manager✓

BitLocker provides full-volume encryption and can seal its keys to a TPM so the drive only unlocks on the trusted hardware. EFS encrypts individual files, not the whole volume. Credential Manager stores saved logons.

Which command-line tool applies updated Group Policy settings to a Windows client immediately rather than waiting for the next refresh interval?

• a.secedit
• b.gpresult
• c.gpupdate /force✓
• d.regedit

gpupdate /force reapplies all Group Policy settings right away. gpresult only reports the resultant set of policies. secedit configures security templates and regedit edits the registry.

A technician needs to view detailed hardware and software configuration, including the BIOS version and installed RAM, in a single Windows report. Which tool provides this?

• a.System Information (msinfo32)✓
• b.Notepad
• c.Calculator
• d.Snipping Tool

System Information (msinfo32) summarizes hardware resources, components, and the software environment, including BIOS version and installed memory. The other listed utilities are unrelated accessories.

Which mobile operating system is open source, developed primarily by Google, and allows apps to be installed from multiple stores and sideloaded APK files?

• a.Android✓
• b.iPadOS
• c.watchOS
• d.iOS

Android is open source and supports installation from Google Play, third-party stores, and sideloaded APK files. iOS and iPadOS are closed platforms that normally restrict installs to the App Store.

In Windows, which utility lets you start, stop, and set the startup type (Automatic, Manual, Disabled) of background services?

• a.Device Manager
• b.Task Scheduler
• c.Disk Cleanup
• d.Services (services.msc)✓

The Services console (services.msc) manages background services, including their state and startup type. Task Scheduler runs tasks on triggers, and Device Manager manages hardware drivers.

Which upgrade method preserves user files, settings, and installed applications when moving to a newer version of Windows?

• a.Bare-metal reimage
• b.Clean install
• c.In-place upgrade✓
• d.Factory reset

An in-place upgrade installs the new Windows version while keeping user files, settings, and most applications. A clean install and bare-metal reimage wipe the existing environment. A factory reset returns the device to its shipped state.

Which Windows command-line utility maps a network share to a drive letter?

• a.tasklist
• b.format
• c.ipconfig
• d.net use✓

net use maps a shared network folder to a drive letter and manages network connections. ipconfig shows IP configuration, tasklist lists processes, and format prepares a disk.

A macOS user wants to force an unresponsive application to close. Which method accomplishes this?

• a.Delete the app from Applications
• b.Press Command+Q once
• c.Restart the router
• d.Press Command+Option+Esc to open Force Quit✓

Command+Option+Esc opens the Force Quit Applications window, letting the user end a frozen app. Command+Q requests a normal quit that a hung app may ignore. Deleting the app is unnecessary for a temporary hang.

Which type of Windows installation partition style is required to boot from drives larger than 2 TB and supports more than four primary partitions?

• a.FAT
• b.MBR
• c.GPT✓
• d.EFS

GPT (GUID Partition Table) supports drives larger than 2 TB and many partitions, and pairs with UEFI. MBR is limited to 2 TB and four primary partitions. FAT and EFS are not partition styles.

Which Windows Control Panel or Settings area is used to configure how the system behaves when the power button is pressed and to enable or disable fast startup?

• a.Power Options✓
• b.Ease of Access
• c.Network and Sharing Center
• d.Programs and Features

Power Options controls power plans, button actions, sleep behavior, and fast startup. Network and Sharing Center handles connections, and Programs and Features manages installed software.

Which command in a Linux terminal changes the permissions of a file, for example granting the owner read/write/execute using numeric mode 700?

• a.cp
• b.chmod✓
• c.ps
• d.mv

chmod changes file and directory permission bits, and numeric mode 700 grants the owner full access while denying group and others. mv and cp move and copy files, and ps lists processes.

A user reports that Windows shows only 3.5 GB of usable RAM even though 8 GB is installed. Which is the most likely cause?

• a.The pagefile is disabled
• b.The GPU is integrated
• c.A 32-bit version of Windows is installed✓
• d.The RAM is faulty

A 32-bit Windows install can address only about 4 GB total, so much of 8 GB appears unusable. Upgrading to 64-bit Windows resolves it. Faulty RAM usually causes crashes rather than a clean address-space limit.

Which Windows tool schedules programs or scripts to run automatically at specific times or in response to events such as logon?

• a.Task Scheduler✓
• b.Disk Management
• c.Resource Monitor
• d.Registry Editor

Task Scheduler runs programs and scripts on time-based or event-based triggers, such as at logon or on a daily schedule. Disk Management handles volumes, and Resource Monitor reports utilization.

Which file system is best suited for a large external flash drive that must be read and written on both Windows and macOS without a 4 GB file-size limit?

• a.FAT32
• b.NTFS
• c.exFAT✓
• d.EFS

exFAT is cross-platform, supported natively by Windows and macOS, and has no practical 4 GB file-size limit. FAT32 caps files at 4 GB. NTFS is read-only by default on macOS.

A technician wants to verify whether a Windows installation is 32-bit or 64-bit and see the edition and version. Where is this shown most directly?

• a.Recycle Bin properties
• b.Printer preferences
• c.Network adapter properties
• d.Settings > System > About (or System Properties)✓

Settings > System > About (System Properties) reports the edition, version, and whether the system type is 32-bit or 64-bit. The other listed locations do not report OS architecture.

A user receives an email that appears to be from the company's bank, urging them to click a link and confirm their password immediately. What type of attack is this?

• a.DDoS
• b.SQL injection
• c.Phishing✓
• d.Zero-day exploit

Phishing uses fraudulent messages impersonating a trusted party to trick users into revealing credentials or clicking malicious links. A DDoS floods a service with traffic, and SQL injection targets databases, neither of which fits this scenario.

Which type of malware encrypts a victim's files and demands payment in exchange for the decryption key?

• a.Keylogger
• b.Rootkit
• c.Adware
• d.Ransomware✓

Ransomware encrypts data and extorts the victim for a decryption key, often with a deadline. A keylogger records keystrokes, a rootkit hides deep in the system, and adware displays unwanted ads.

An attacker follows an authorized employee through a secured door before it closes, without presenting their own badge. What is this physical technique called?

• a.Phishing
• b.Shoulder surfing
• c.Whaling
• d.Tailgating✓

Tailgating (piggybacking) is when an unauthorized person follows an authorized one through a controlled entrance. Shoulder surfing is watching someone enter credentials. Whaling is phishing that targets executives.

Which authentication approach requires two or more independent factors, such as a password plus a code from an authenticator app?

• a.Least privilege
• b.Multifactor authentication✓
• c.Single sign-on
• d.Access control list

Multifactor authentication (MFA) combines factors from different categories (something you know, have, or are), such as a password plus an app code. Single sign-on centralizes logins but is not inherently multifactor.

Which practice grants each user only the minimum permissions needed to perform their job, reducing the impact of a compromised account?

• a.Open sharing
• b.Principle of least privilege✓
• c.Full administrator access for all
• d.Default allow

The principle of least privilege limits users to the access their role requires, shrinking the attack surface if an account is compromised. Granting everyone administrator rights greatly increases risk.

Which type of malware disguises itself as legitimate software to trick a user into installing it, then performs malicious actions in the background?

• a.Logic bomb
• b.Trojan horse✓
• c.Worm
• d.Boot sector virus

A Trojan horse masquerades as a useful program to get installed, then carries a hidden malicious payload. A worm self-replicates across networks, and a logic bomb triggers on a condition rather than relying on disguise.

A technician wants to protect a laptop's data so it cannot be read if the device is lost or stolen. Which control best achieves this?

• a.Full-disk encryption✓
• b.A screen saver
• c.Disabling the firewall
• d.A stronger Wi-Fi password

Full-disk encryption renders stored data unreadable without the key, protecting it if the hardware is lost or stolen. A screen saver or Wi-Fi password does not protect data at rest on the drive.

Which social engineering tactic involves an attacker impersonating IT support over the phone to convince a user to reveal their password?

• a.Vishing✓
• b.Evil twin
• c.Tailgating
• d.Dumpster diving

Vishing is voice phishing, where the attacker uses a phone call and pretext (such as posing as IT) to extract sensitive information. Dumpster diving searches discarded materials, and an evil twin is a rogue Wi-Fi access point.

Which Windows security feature filters inbound and outbound network traffic based on configurable rules to help block unauthorized connections?

• a.Snipping Tool
• b.Task Manager
• c.Windows Defender Firewall✓
• d.Disk Cleanup

Windows Defender Firewall inspects network traffic and permits or blocks it according to rules, helping stop unauthorized connections. The other tools do not perform network filtering.

When disposing of drives that held sensitive data, which method most reliably prevents any data recovery from a hard disk drive?

• a.Moving files to the Recycle Bin
• b.Renaming the files
• c.Quick formatting the drive
• d.Physical destruction (shredding or drilling)✓

Physical destruction such as shredding or drilling reliably prevents recovery from a magnetic hard drive. A quick format and Recycle Bin deletion leave data recoverable, and renaming does nothing to remove data.

Which term describes a previously unknown software vulnerability that attackers exploit before the vendor has released a patch?

• a.Zero-day vulnerability✓
• b.Replay attack
• c.Brute-force attack
• d.Man-in-the-middle

A zero-day vulnerability is a flaw unknown to the vendor, giving defenders zero days to patch before exploitation. A brute-force attack guesses credentials and a replay attack reuses captured data.

Which of the following is the strongest wireless encryption standard a technician should select when configuring a modern home or small-office router?

• a.WEP
• b.WPA
• c.WPA3✓
• d.WPS

WPA3 is the newest and strongest Wi-Fi security standard, improving on WPA2 with better key exchange. WEP and the original WPA are outdated and insecure, and WPS is a convenience feature that can weaken security.

Which best practice reduces the risk that a stolen password alone can compromise an account?

• a.Requiring multifactor authentication✓
• b.Disabling account lockout
• c.Writing passwords on a sticky note
• d.Reusing one password everywhere

Requiring MFA means a stolen password is not enough because an additional factor is needed. Reusing passwords and disabling lockout increase exposure, and writing passwords down risks disclosure.

A pop-up claims the computer is infected and urges the user to call a phone number for paid removal help. What is this most likely an example of?

• a.A Windows Update notice
• b.A driver installation prompt
• c.A rogue/fake security alert (scareware)✓
• d.A legitimate antivirus alert

Scareware displays alarming fake alerts to pressure users into calling scammers or buying useless software. Legitimate antivirus tools do not ask users to call an unknown number. Treat such pop-ups as social engineering.

Which access-control concept assigns permissions to users based on their job function or group rather than individually?

• a.Port forwarding
• b.MAC address filtering
• c.Full disk encryption
• d.Role-based access control✓

Role-based access control (RBAC) grants permissions according to a user's role or group, simplifying administration and enforcing consistency. The other options relate to encryption or networking, not permission assignment.

A user wants to prevent unauthorized people from reading over their shoulder as they type a password in a public place. Which countermeasure is most directly relevant?

• a.Using a privacy screen filter and shielding the keyboard✓
• b.Updating antivirus
• c.Using a longer Wi-Fi key
• d.Enabling a firewall

A privacy screen filter narrows viewing angles and shielding the keyboard defeats shoulder surfing in public. Firewalls, antivirus, and Wi-Fi keys do not stop someone physically observing the screen or keystrokes.

Which characteristic makes a password policy stronger against brute-force and dictionary attacks?

• a.Never expiring shared passwords
• b.Using the username as the password
• c.Disabling case sensitivity
• d.Increased length and complexity✓

Longer, more complex passwords dramatically increase the number of combinations an attacker must try. Using the username or a shared, never-expiring credential makes guessing trivial and weakens security.

Which type of malware is specifically designed to hide its presence and maintain privileged access, often loading before the operating system fully starts?

• a.Spyware
• b.Rootkit✓
• c.Adware
• d.Ransomware

A rootkit conceals itself and other malware while retaining privileged control, sometimes hooking into the boot process. Adware merely shows ads and spyware collects data, but neither is defined primarily by deep stealth.

Which authentication factor category does a fingerprint or facial scan belong to?

• a.Something you are✓
• b.Something you have
• c.Somewhere you are
• d.Something you know

Biometrics such as fingerprints and facial scans are 'something you are'. Passwords are 'something you know' and a token or phone is 'something you have'. Combining categories yields multifactor authentication.

A company wants to make sure former employees can no longer access systems the moment they leave. Which practice addresses this?

• a.Sharing one admin account
• b.Promptly disabling accounts during offboarding✓
• c.Ignoring account audits
• d.Leaving accounts enabled indefinitely

Disabling accounts immediately during offboarding removes access when an employee departs. Shared admin accounts and dormant enabled accounts create lingering, hard-to-attribute access that attackers can exploit.

Which term describes an attacker setting up a rogue Wi-Fi access point with the same name as a legitimate network to intercept traffic?

• a.Watering hole
• b.Evil twin✓
• c.SQL injection
• d.Tailgating

An evil twin is a malicious access point impersonating a trusted SSID so victims connect and expose their traffic. Tailgating is a physical intrusion and SQL injection targets databases, not wireless clients.

What is the primary security benefit of keeping operating systems and applications patched and up to date?

• a.It removes the need for backups
• b.It increases screen brightness
• c.It disables all user accounts
• d.It closes known vulnerabilities before they can be exploited✓

Patching remediates known vulnerabilities, reducing the window in which attackers can exploit them. It does not replace backups, alter brightness, or disable accounts.