220-1202 CompTIA A+ Core 2 2025 Exam Question and Answers

Comprehensive and Detailed Explanation From Exact Extract:

A .bat file (batch file) is a script file in DOS, OS/2, and Microsoft Windows. It contains a series of commands that are executed by the command-line interpreter. In Windows environments, batch files are commonly used to automate log-in tasks, such as mapping network drives, launching applications, or setting environment variables during the user ' s logon process.

B. .sh is a shell script used in Linux/Unix environments.

C. .py is a Python script, which can be used for automation but is not commonly run directly at user logon in standard Windows environments.

D. .js is JavaScript, used mainly in web development and not for system-level scripting in Windows logon automation.

Comprehensive and Detailed Explanation From Exact Extract:

In a domain environment, printers are typically deployed via a print server. Users can browse available printers on the server and install them directly.

All-in-One Exam Guidementions:

“In a corporate domain, printers are managed via a centralized print server. Users can select the desired printer from the server’s shared list.”

Comprehensive and Detailed Explanation From Exact Extract:

Since the issue has recurred after a temporary fix, it is likely a deeper or persistent configuration or server issue. Escalating the ticket to the next tier of support (e.g., network or system administrator) ensures further investigation and permanent resolution. Escalation is part of the standard support protocol when issues reoccur despite initial troubleshooting.

A. Rechecking remotely may confirm the issue, but doesn’t resolve it long term.

B. Providing documentation helps the user but doesn’t solve the root cause.

D. Keeping the ticket open is passive and doesn’t address the recurring issue.

“No OS found” commonly indicates the firmware can’t locate boot instructions for the installed OS. If the drive isn’t obviously failing (no unusual noises) and BIOS/UEFI settings are reasonable, a classic cause is a corrupt Master Boot Record (MBR) (on MBR-partitioned disks). Mike Meyers’ Lab Manual explains that when BIOS can’t find an OS, causes may include configuration issues or drive problems, but also states: “If the correct drive is already first in the boot sequence, the master boot record… may be corrupt and need to be rebuilt.”

The Lab Manual also explains what the MBR does: the first sector contains boot code that informs the system about installed operating systems, and “without this bit of code, your OS will never load.” The All-in-One guide describes the same: BIOS looks at the first sector for instructions, and without the MBR code, the OS won’t load.

NTFS corruption wouldn’t typically present as “no OS found” at the firmware stage, and TPM issues usually create different security/boot errors. Therefore, MBR (D) is most likely.

Comprehensive and Detailed Explanation From Exact Extract:

Standard Operating Procedures (SOPs)guide technicians through consistent and complete processes, including documentation.

FromTravis Everett – All-in-One Exam Guide:

“SOPs ensure that all required steps—such as data collection and issue description—are followed in every support interaction.”

The correct answer is C. Setting up image deployment for PXE , because PXE (Preboot Execution Environment) allows operating system installations and upgrades to be performed over the network without using removable storage. Since all removable media is disabled for security reasons, PXE-based deployment preserves existing security controls while enabling centralized OS upgrades.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , PXE is commonly used in enterprise environments to deploy or upgrade operating systems at scale. PXE works by booting client machines from a network interface and pulling installation images from a secured deployment server.

The Travis Everett & Andrew Hutz – CompTIA A+ All-in-One Exam Guide explains that PXE is especially valuable when USB drives and external media are restricted. It ensures consistency, reduces human error, and maintains compliance with organizational security policies.

The Mike Meyers / Mark Soper Lab Manual reinforces that copying ISO files locally still requires write access and may violate security baselines. External drives are explicitly prohibited, and hardware tokens are authentication tools—not deployment mechanisms.

Because PXE enables secure, centralized, removable-media-free OS upgrades , it is the most appropriate solution, making C the correct answer.

The Local Users and Groups Manager (lusrmgr.msc) is the utility for managing user accounts, including renaming the default Administrator.

From Quentin Docter – Complete Study Guide :

“The lusrmgr.msc snap-in allows renaming and managing local user accounts, including the default administrator.” .

Online collaboration tools (for example, Microsoft 365/OneDrive, Google Workspace/Drive) typically store documents in cloud storage and rely on a sync client to make those files appear locally on each device. If the user can’t see the document on the laptop, the most direct remediation is to synchronize the remote (cloud) folder so the document downloads to the laptop and stays consistent across devices. The All-in-One guide explains that productivity platforms are “designed to be synchronized across multiple devices,” allowing work to be paused on one device and resumed on another, and that many sync problems come down to configuration or a partial sync that leaves data not fully downloaded. It also notes that enabling/adjusting synchronization settings is often the fix. Quentin Docter similarly describes synced files becoming accessible through File Explorer once server/client synchronization is configured and highlights “Documents” as a common sync data type. Mike Meyers reinforces that file services like OneDrive/Google Drive use an installed app on each device to specify what gets synchronized.

The correct answer is C. SSH (Secure Shell) , because SSH is the standard method for secure, command-line-based remote management of network devices , including switches, routers, and firewalls. Network switches typically do not provide graphical interfaces, and administrators interact with them using a command-line interface (CLI).

According to the Quentin Docter – CompTIA A+ Complete Study Guide , SSH is widely used to securely access and manage network infrastructure devices. It encrypts all communication between the technician’s system and the remote device, protecting credentials and command output from interception.

The Travis Everett & Andrew Hutz – CompTIA A+ All-in-One Exam Guide explains that SSH allows administrators to execute commands remotely and capture text-based output, which can easily be copied and shared for documentation or escalation. This makes it ideal for fulfilling requests that involve running commands and returning results.

The Mike Meyers / Mark Soper Lab Manual clarifies that RDP and VNC are graphical desktop-sharing tools typically used for managing workstations or servers, not network switches. WinRM is used for Windows system management, not network hardware.

Because the task involves secure CLI access to a network switch , SSH is the correct and expected tool, making C the correct answer.

The correct answer is B. Create and assign a security group with adequate permissions , because group-based permission management is the most efficient and scalable way to control access to shared resources. By assigning permissions to a group rather than individual users, administrators reduce administrative overhead and simplify future changes.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , security groups are a best practice for managing access to files, folders, and repositories. Permissions are assigned once to the group, and users inherit those permissions by being members of the group.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that granting administrative permissions is excessive and violates the principle of least privilege. Applying permissions individually increases complexity and the risk of configuration errors, especially as team membership changes.

The Mike Meyers / Mark Soper Lab Manual further clarifies that mapping a network folder does not control permissions; it only provides access to a resource that is already governed by permissions. Group-based access ensures consistency, security, and minimal effort.

Because the requirement is to allow specific actions while preventing deletion—and to do so with the least amount of effort —creating and assigning a properly permissioned security group is the optimal solution, making B the correct answer.

Comprehensive and Detailed Explanation From Exact Extract:

Single sign-on (SSO)allows users to authenticate once and gain access to multiple systems without re-entering credentials, which significantly enhances user convenience while maintaining security.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Single sign-on streamlines authentication by allowing users to log in once and access all authorized resources, reducing credential fatigue and improving security.”

When DHCP isn’t enabled, static IPs must be assigned manually, so the engineering team provides the IP details.

From Travis Everett – All-in-One Exam Guide :

“If DHCP is unavailable, technicians need the static IP configuration to connect devices to the network.” .

A VPN is the best choice because it is designed to provide secure remote access to an internal network over the Internet by creating an encrypted tunnel. Once the VPN is established, the remote user’s device effectively becomes part of the corporate network and can use the appropriate tools for each server type (for example, SSH to Linux and RDP to Windows) without exposing those management services directly to the public Internet. Quentin Docter explains that a VPN “extends your company’s internal network across the Internet,” creating a private connection through “encryption and encapsulation,” and that the host becomes part of the internal network (often receiving an internal IP). The All-in-One guide reinforces this by describing VPNs as an encrypted tunnel over the open Internet.

By comparison, RDP is “used exclusively with Microsoft operating systems,” so it doesn’t meet the Linux requirement. FTP is for file transfers, not full secure remote access, and RMM is primarily for centralized IT monitoring/management rather than a general user remote-access method.

Comprehensive and Detailed Explanation From Exact Extract:

This scenario describes a rogue access point — a malicious or unauthorized wireless access point that uses the same SSID as the legitimate network. Users may connect to it unknowingly, which can result in limited network access, data interception, or redirection of traffic. The inability to reach internal file servers supports this being an unauthorized AP with no connection to internal resources.

A. A DNS issue would impact name resolution, not connectivity to file servers directly.

B. VLAN issues generally affect segmentation, not mimic SSID problems.

C. An incorrect IP address could cause connectivity issues, but not in the presence of a malicious AP broadcasting the same SSID.

Aclean installensures all malware is eliminated by completely wiping and reinstalling the OS. System restore or repair may leave traces.

FromQUENTIN DOCTER - COMPTIA A+ COMPLETE study GUIDE:

“If malware cannot be completely removed, perform a clean installation of the operating system. This ensures no remnants remain on the machine.”

The correct answers are D. Use PIN authentication and F. Enable screen timeout , because both controls directly protect a mobile device from unauthorized physical access . Physical access controls are designed to prevent someone from using a device if it is lost, stolen, or left unattended.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , mobile device security begins with lock-screen controls , such as PINs, passwords, biometrics, and automatic locking mechanisms. A PIN authentication requirement ensures that even if an attacker physically possesses the device, they cannot access its contents without the correct credentials.

The guide further explains that screen timeout (automatic locking after inactivity) is a critical security feature. Without it, a device left unattended—even briefly—could be accessed by unauthorized individuals. Enabling a short timeout greatly reduces this risk.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide reinforces that VPNs and antivirus software protect data in transit and against malware , not physical access. Likewise, disabling hotspots and enabling location services are management or tracking features, not access prevention mechanisms.

The Mike Meyers / Mark Soper Lab Manual emphasizes that physical security controls focus on preventing interaction with the device itself , making PIN authentication and automatic screen locking the most effective measures.

Therefore, D and F are the correct answers.

Comprehensive and Detailed Explanation From Exact Extract:

When a technician exhausts all troubleshooting steps within their knowledge and the issue remains unresolved, the best practice is to escalate the issue to a higher-level technician or team. Additionally, the technician should clearly communicate the next steps to the customer to maintain transparency and reduce frustration. This ensures continuity of support and upholds customer satisfaction.

B. Dismissing the customer is unprofessional and violates proper customer service protocols.

C. Interrupting the customer and providing excuses escalates the tension and is inappropriate.

D. Continuing to ask questions without new troubleshooting steps wastes time and increases frustration.

Comprehensive and Detailed Explanation From Exact Extract:

ApplicationsandLibraryare core system directories in macOS. TheApplicationsfolder contains installed applications. TheLibraryfolder contains support files, preferences, and other system-related files.

From theQuentin Docter – CompTIA A+ Complete Study Guide:

“macOS organizes system and user files into several key folders. Among them, Applications and Library are standard system folders where apps and related files are stored.”

Comprehensive and Detailed Explanation From Exact Extract:

Disk optimization tools can sometimes corrupt theMaster Boot Record (MBR). If BIOS sees the drive but can ' t boot, repairing the MBR using installation media is the correct next step.

FromAll-in-One Exam Guide:

“When BIOS recognizes the drive but no OS is found, the issue is often with the boot record. Use installation media to access recovery tools and repair the MBR or boot loader.”

Comprehensive and Detailed Explanation From Exact Extract:

To prevent external access, the technician should avoid exposing the surveillance system’s port to the public internet. Port mapping (also known as port forwarding) is the method used to control which internal devices and ports are accessible from the outside. By not configuring port forwarding for the device, external login attempts are effectively blocked.

B. Subnetting organizes IP addresses but doesn ' t directly restrict access.

C. A static IP ensures consistent addressing but does not secure access.

D. Content filtering is used to restrict web content, not to block access to a web interface.

Comprehensive and Detailed Explanation From Exact Extract:

When an OS is no longer receiving updates, it is generally because it has reachedend of life (EOL), meaning the vendor has ceased support.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“End-of-life refers to the point when an OS vendor no longer issues updates or support. Systems at EOL pose security risks and must be upgraded or isolated.”

Comprehensive and Detailed Explanation From Exact Extract:

Image deployment is the fastest and most efficient method for installing operating systems on multiple machines. It involves creating a pre-configured image of an OS and deploying it across systems using tools like Windows Deployment Services (WDS) or third-party imaging solutions. This method saves time and ensures consistency across all devices.

A. Physical media is slow and not scalable.

B. Mountable ISOs are useful but still require manual installation.

C. Manual installation is time-consuming and not suitable for large-scale deployment.

SSH (Secure Shell) allows encrypted console sessions to access and administer remote servers.

From Quentin Docter – Complete Study Guide :

“Secure Shell (SSH) provides an encrypted console session to manage Linux, UNIX, or network devices securely over TCP port 22.” .

Comprehensive and Detailed Explanation From Exact Extract:

Facial recognition is a biometric authentication method that ties access to a unique physical feature of the user. Unlike passcodes or pattern locks—which can be easily shared—facial recognition provides a more secure and non-transferable form of access. It also enhances user convenience and is widely supported by modern smartphones.

A. Pattern locks can still be shared and are less secure.

C. Device encryption protects data but does not prevent screen access if a passcode is shared.

D. Multifactor authentication typically applies to app or account access, not basic phone unlocking.

The correct answer is A. Reinstalling the application , because the issue appears to be application-specific rather than system-wide. The problem only affects one game, the operating system is fully updated, and there are no storage constraints. These indicators strongly suggest corrupted application data or a faulty app installation.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , when a single application crashes repeatedly, the first recommended troubleshooting step is to remove and reinstall the app. This clears corrupted files, resets application settings, and ensures the latest compatible version is installed.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide emphasizes that factory resets should only be used as a last resort, as they are disruptive and erase user data. Disabling background applications may help performance issues but does not typically resolve persistent crashes tied to one specific app.

The Mike Meyers / Mark Soper Lab Manual further clarifies that date and time misconfiguration usually affects authentication or certificate validation, not game stability.

Because the symptoms are isolated to a single application and basic system factors have already been ruled out, reinstalling the application is the most appropriate first troubleshooting step, making A the correct answer.

Comprehensive and Detailed Explanation From Exact Extract:

These symptoms strongly suggest malware activity—likely from the newly installed app. The first action should be torun a malware scanto detect and isolate malicious software.

FromQuentin Docter – CompTIA A+ Study Guide:

“Signs of malware infection include rapid battery drain and overheating. The first step should be a malware scan using trusted mobile antivirus apps.”

The correct answer is A. .app , because macOS applications packaged as .app files are typically self-contained application bundles . This means that all required application files are stored within a single directory that appears as one file in Finder. When the .app file is moved to the Trash, the application is effectively removed from the system.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , macOS applications are commonly distributed as .app bundles, allowing for simple installation and removal. This design contrasts with Windows, where applications often install files across multiple directories and require uninstallers.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that dragging a .app file to the Trash is generally sufficient to uninstall the software, although some applications may leave behind preference files or caches. However, from an exam perspective, .app is the only option that supports this uninstall behavior.

The Mike Meyers / Mark Soper Lab Manual further clarifies that .msi and .exe are Windows formats, .rpm is used by Linux package managers, and .pkg installers often install system-wide components that require a formal uninstallation process.

Because .app files support simple drag-to-trash uninstallation , A is the correct answer.

This issue happens when Windows is hiding known file extensions. If extensions are hidden, the user may only be changing the visible name (for example, changing “Document” to “Document.xml”), while the real filename remains something like Document.xml.txt. Windows Explorer then displays “Document.xml,” but file properties still show the true type as Text Document (.txt) because the actual extension at the end is still .txt, and Windows determines file type by that extension. The fix is to show file extensions by turning off the “hide extensions” behavior—i.e., uncheck “Hide extensions for known file types” in File Explorer Options/View settings. Quentin Docter specifically calls out that “Hide Extensions For Known File Types” is commonly changed because seeing extensions is “really handy,” and shows steps to deselect “Hide File Extensions For Known File Types.” The All-in-One guide and Mike Meyers’ Lab Manual both reinforce that you toggle extensions by deselecting “Hide extensions for known file types.”

The completed configuration:

1. Wireless AP (LAN side)

1. LAN IP: 192.168.10.1

2. Encryption: WPA2 PSK

2. Router (port-forward rule)

1. Allow TCP Any 3389

This forwards inbound RDP traffic (TCP/3389) from the Internet to the Windows PC, enabling Remote Desktop access.

3. Firewall (screened subnet side)

1. LAN IP: 10.100.0.1

4. Device placement

1. PC: place behind the router (where the port-forward rule points).

2. Game console: place on the Wireless AP (so it can use chat and extra services over WPA2 PSK).

3. Firewall: place in front of the screened subnet (with its 10.100.0.1 IP facing that subnet).

The Windows PC is placed in the screened subnet (behind the firewall) for enhanced security. Remote access to this PC requires port forwarding of TCP port 3389 (RDP), which is correctly configured through the router.

The Game Console is placed on the Wireless AP LAN, using WPA2 PSK for a secure wireless connection. Game consoles typically use peer-to-peer chat and online services that require open access without firewall restrictions, which is why the console is not placed behind the firewall.

CompTIA A+ 220-1102 Reference Points:

Objective 3.4: Given a scenario, implement best practices associated with data and device security.

Objective 2.4: Given a scenario, use appropriate tools to support and configure network settings.

Study Guide Reference: CompTIA A+ Core 2 guides recommend using screened subnets (a type of DMZ) for systems needing controlled external access, such as remote desktops, while placing gaming and media devices on less restricted networks for full functionality.

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig

Issue (drop-down)

Limited network connectivity

Why this matches:

“Internet Down” most commonly indicates the workstation has lost valid Layer 3 connectivity (bad/expired DHCP lease, APIPA address, wrong gateway, etc.). In CompTIA A+ terms, this aligns best with limited connectivity symptoms (can’t reach internet resources).

Resolution (drop-down)

Refresh DHCP

Why this is the most efficient fix:

If the client has:

an expired lease

an APIPA address (169.254.x.x) because DHCP failed

an incorrect IP/gateway from a bad lease

…then the fastest first remediation is to renew DHCP to obtain a correct IP address, default gateway, and DNS servers. This is a standard CompTIA A+ troubleshooting action (quick, low-risk, high-success).

Verify/Resolve (drop-down)

ipconfig

Why this is the correct verification tool:

ipconfig is the primary Windows CLI tool to:

check current IP settings (ipconfig /all)

release/renew DHCP (ipconfig /release and ipconfig /renew)

confirm you received a valid IP + gateway + DNS , which is required for internet access.

What you would do (mapped to those choices)

Using ipconfig to complete “Refresh DHCP” and confirm the fix:

Check current addressing

ipconfig /all

Look for:

Valid IPv4 (not 169.254.x.x )

Valid Default Gateway

DNS servers present

Refresh the DHCP lease

ipconfig /release

ipconfig /renew

Verify outcome

Run ipconfig again to confirm:

You now have a correct IP for the network

Default gateway is populated

If the gateway/DNS populate correctly, internet access typically returns.

Host 2, Host 3, Host 4 , Host 5 ,Host 6, Host 7, Host 8 , Media Server - Stop All unwanted and malicious service (Persistance.j1zpxn Installer Service) from all the listed host and Media servers

Refer screenshot below on the required service started/stopped on host2, same service to be started and stopped across all host servers.

A screenshot of a computer AI-

A screenshot of a computer AI-

1st CLI Resolution

copy " C:\Program Files\Testing\msvcp100.dll " " User-PC02\C$\Windows\System32 " /v /y

2nd CLI Resolution

regsvr32 msvcp100.dll

Why These Are the Correct Choices (Exam Logic)

Why the COPY command is first

The error explicitly states MSVCP100.dll is missing

Other users can run the app → the DLL exists on another system

The fastest, least disruptive fix (preferred by CompTIA) is to:

Copy the known-good DLL into C:\Windows\System32

The /v switch verifies the copy, and /y suppresses prompts — both are enterprise-safe defaults

This restores the missing runtime dependency immediately.

Why REGSVR32 is second

After copying a DLL, Windows may not recognize or properly load it

regsvr32 registers the DLL with the operating system

This ensures:

The Testing application can properly call the runtime library

The fix persists after reboot

Ticket #8675310

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig /renew

For the Low priority ticket #8675310 (“ A small yellow triangle appeared in the taskbar. I am no longer able to access network resources. ”), the Windows yellow triangle on the network icon is the classic indicator of limited connectivity (often caused by a bad/expired DHCP lease, APIPA address, missing default gateway, or DNS info not being assigned).

Correct PBQ Selections (Ticket #8675310)

Issue

Limited network connectivity

Why (CompTIA logic):

That yellow warning triangle means the NIC is connected at Layer 2 (link is up), but the system likely doesn’t have valid Layer 3 config (IP/gateway/DNS), so it can’t reach network resources.

Resolution

Refresh DHCP

Why this is the most efficient fix:

When a Windows PC can’t access network resources and shows “limited connectivity,” the fastest, lowest-risk fix is to renew DHCP so the PC can pull:

a valid IP address

default gateway

DNS servers

This directly resolves the most common root cause behind that icon.

Verify / Resolve

ipconfig /renew

Why this is the correct verification/remediation command:

ipconfig /renew is the direct command to request a fresh DHCP lease . After renewal, the user should regain access to network resources if DHCP was the issue.

What this fixes (what you’d expect to see)

Before the fix, the attachment ( Output.txt ) in these PBQs typically shows symptoms like:

169.254.x.x (APIPA) → DHCP failed

Missing/blank Default Gateway

DNS not present or incorrect

After ipconfig /renew, you should see a normal private IP (like 192.168.x.x / 10.x.x.x / 172.16-31.x.x ) and a valid gateway/DNS.

Inbox mail 1 -Account Locked- Phishing - Report email to Information Security

Inbox mail 2 -Share your feedback - Legitimate - Perform no additional actions

Inbox mail 3 –Employee orientation - Legitimate - Perform no additional actions

Inbox mail 4 –Security Update – Spam - Report email to Information Security

Inbox mail 5 –Interview - Legitimate - Perform no additional actions

—

First Chat Response:When the user mentions setting up a new router, the best initial response to maintain a helpful and professional tone is:

> Select reply: " I am happy to assist you today. "

Second Chat Response:When the user states that they need to set up basic security settings:

> Select reply: " Is this the first router in your office? "

Third Chat Response:After learning it ' s a replacement router and the user is logged into the router ' s web page:

> Select reply: " The first thing you need to do is change the default password. "

Fourth Chat Response:For the response about password settings:

> Select reply: " Create a new password with an uppercase, a lowercase, and a special character. "

Fifth Chat Response:When the router prompts to reboot:

> Select reply: " Yes, reboot please. "

Study Guide Reference: The CompTIA A+ Core 2 guide highlights the importance of changing default credentials and using strong password policies, particularly in SOHO environments where routers are often targeted.

Comprehensive and Detailed Explanation From Exact Extract:

These symptoms strongly indicatemalware infectionor a malicious app running in the background. The first action should be torun a malware scanto identify and remove malicious components.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“If a mobile device is overheating and the battery drains rapidly after installing an app, this could point to malware. Begin by scanning the device with a mobile anti-malware application.”

The symptoms point to malicious or rogue content : frequent “security warning” pop-ups that push “tools” is a classic sign of scam/rogue apps, and the new fast battery drain suggests an unwanted process running in the background. The CompTIA objectives explicitly list mobile security symptoms such as “high number of ads,” “fake security warnings,” and “unexpected application behavior,” which aligns with this scenario. On the browser side, Quentin Docter notes that if you continually receive pop-ups or overlays, “you may be infected with malware,” and recommends scanning with antivirus/antimalware software. He also explains that clearing browsing data/cache is sometimes necessary to resolve browser-related problems and details how to clear cache/browsing data.

Because the user tapped the pop-up and then battery life worsened, the best practical fix is to remove the likely malicious application(s) (uninstall unknown apps) and clear browser cache to eliminate stored site data/scripts fueling the pop-ups. A factory reset is a stronger last resort, but least disruptive remediation is A.

Comprehensive and Detailed Explanation From Exact Extract:

An incident report documents key details such as the cause of the outage, steps taken to resolve it, and measures to prevent recurrence. It is a post-mortem analysis often shared with stakeholders to improve future response.

According to the Quentin Docter – CompTIA A+ Complete Study Guide:

“An incident report provides a summary of an event that disrupted normal operations and includes a timeline of what occurred, how the issue was diagnosed and fixed, and who was involved in the resolution”.

This is reaffirmed in Travis Everett’s All-in-One Guide:

“Documentation after an incident helps technical teams and management review the situation and learn from it. This is formalized in an incident report”.

A “utility failure” means the building’s AC power source has dropped out (blackout) or sagged severely, causing the workstation to lose power instantly and shut down. The best way to prevent an immediate shutdown during these events is an Uninterruptible Power Supply (UPS), which contains a battery and can continue supplying AC power long enough to keep the PC running briefly and allow a graceful shutdown. Mike Meyers’ Lab Manual states that a UPS “continues to supply AC power…during both brownouts and blackouts via a battery,” preventing the computer from instantly losing power when the utility fails. Quentin Docter likewise explains that UPS devices protect against “power sags and even power outages,” using stored battery energy so the administrator (or OS integration) can safely shut down rather than crash off.

A surge suppressor protects from spikes, not outages. A redundant PSU only helps if the PSU fails, and Docter notes it cannot keep a system running during a power outage. A line voltage regulator helps stabilize voltage but doesn’t provide power when utility power is absent.

Comprehensive and Detailed Explanation From Exact Extract:

NET Framework versions are often required for applications to run. If an older app requires .NET Framework 3.5, it must be explicitly installed as it is not included by default in newer versions of Windows. The best method to do this safely is through the built-in " Turn Windows features on or off " utility, which downloads and installs it via official Microsoft services.

B. Using third-party repositories is unsafe and not recommended.

C. Installing .NET 4 does not include 3.5; versions are not fully backward compatible.

D. The issue is technical, not a security incident for the SOC team.

Because this is a government client with confidential data and a strict requirement to follow regulatory compliance , the best practice is to use a certified third-party destruction service that can provide documented proof of destruction. The All-in-One guide explicitly notes that “professional hard drive disposal services are third-party vendors” that guarantee drives are thoroughly destroyed by issuing a certificate of destruction/recycling , which provides assurance that data will not fall into the wrong hands. Mike Meyers’ Lab Manual repeats the same exam point: third-party vendors “will guarantee they have truly, thoroughly destroyed drives by issuing a certificate of destruction/recycling.”

Low-level formatting (often used to mean overwrite/zero-fill) can sanitize drives, but it may not satisfy the requirement for provable compliance and chain-of-custody documentation, especially for regulated environments. Targeted deletion is ineffective because deleted data can remain recoverable. In-house incineration is extreme and may be restricted, unsafe, or noncompliant without proper facilities and documentation. Therefore, Certified third-party destruction (B) is the best option.

The correct answer is C. Change the User Account Control (UAC) settings , because the credential prompt during installation indicates that the system is requesting administrative privileges . In Windows environments, UAC is designed to prevent unauthorized system changes by prompting for administrator approval when elevated permissions are required.

According to the Quentin Docter – CompTIA A+ Complete Study Guide , UAC acts as a security boundary between standard user activities and system-level changes such as software installation. If a user does not have sufficient privileges, the system will request administrator credentials before proceeding.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that technicians can temporarily adjust UAC settings or provide proper elevation to allow legitimate installations. This is especially common in corporate environments where users operate with standard accounts.

The Mike Meyers / Mark Soper Lab Manual reinforces that restarting the computer or using a different browser does not change permission requirements. Contacting the software vendor is unnecessary when the issue is clearly related to local security controls.

Because the installation is blocked by privilege restrictions enforced by UAC, adjusting User Account Control settings or providing proper elevation is the correct and most efficient resolution, making C the correct answer.

Comprehensive and Detailed Explanation From Exact Extract:

A Potentially Unwanted Program (PUP) is software that a user may not have knowingly installed. It often gets bundled with legitimate software and installs without full disclosure. PUPs can affect performance, change system settings, or display unwanted ads but are not necessarily malicious like viruses or ransomware.

A. Viruses replicate and spread; they are generally more harmful and not " bundled " in the same way.

B. Ransomware encrypts files for payment and is deliberately malicious.

D. A Trojan disguises itself as legitimate software to perform malicious actions but is not typically pre-bundled by legitimate publishers.

Antivirus/antimalware detection depends heavily on its definitions/signatures . If those are outdated, new malware variants may not be recognized. Quentin Docter explains that the “definitions database” is a core antivirus component and that its effectiveness depends on “the frequency of updates and the comprehensiveness of the database signatures.” He adds that new signatures are discovered frequently and added to the database, meaning stale definitions leave gaps.

Docter is also explicit that security software “is not perfect” and that malware may get around it, “especially a new threat (and especially if you haven’t updated your definitions lately).” That statement directly matches this scenario: the software exists, but it failed to detect the infection—most likely because the detection data wasn’t current.

The other answers don’t fit as well: folder permissions and user permissions can limit what malware can change, but they don’t explain why security software didn’t detect it . Port security relates to network access control, not local signature detection. Therefore, Outdated definitions (B) is the best explanation.