Free CompTIA A+ Core 2 Sample Questions

Correct answer: A — ChromeOS

• A. ChromeOS is correct because it is built around the Chrome browser and web apps, boots quickly, updates automatically, and is managed through the Google Admin console on low-cost hardware.
• B. Windows 11 Pro is incorrect because it needs heavier hardware, is managed through tools such as Intune or Group Policy, and updates on a slower, less seamless schedule.
• C. macOS is incorrect because it runs only on more expensive Apple hardware, which does not fit an inexpensive classroom laptop budget.
• D. Ubuntu Desktop is incorrect because it is a general-purpose Linux distribution without built-in cloud-console management or automatic background updates for a fleet.

Correct answer: B — Upgrade the laptop to Windows 11 Pro with a valid Pro product key, because Pro adds domain join support

• A. Incorrect. A workgroup name is only a label for peer-to-peer grouping; matching the domain name does not authenticate the PC or deliver Group Policy.
• B. Correct. Windows 11 Home cannot join an Active Directory domain, and an edition upgrade to Pro (or higher) enables domain join and Group Policy processing.
• C. Incorrect. N editions only remove media features such as Windows Media Player and do not add or change networking or domain capabilities.
• D. Incorrect. No optional feature turns Home into a domain member; the limitation is built into the edition itself, so System Properties cannot complete a domain join.

Correct answer: A — resmon.exe

• A. Correct. Resource Monitor (resmon.exe) breaks down CPU, memory, disk, and network activity per process and lists the files each process is reading or writing.
• B. Incorrect. System Configuration (msconfig.exe) controls boot options and startup selections and does not monitor live disk activity.
• C. Incorrect. Defragment and Optimize Drives (dfrgui.exe) analyzes and optimizes fragmentation or trims SSDs, but it cannot identify which process is causing disk activity.
• D. Incorrect. Task Scheduler (taskschd.msc) creates and manages scheduled tasks and does not report per-process disk usage.

Correct answer: D — `robocopy D:\Data E:\Data /MIR /COPYALL` to mirror the tree, copy security data, and skip unchanged files

• A. `xcopy /E` copies subfolders but never deletes destination files that disappeared from the source, and it does not retain all NTFS security data by default.
• B. `copy` does not recurse into subfolders and does not mirror deletions, so it cannot keep two directory trees in step.
• C. `net use` only maps a drive letter to a share; it does not move or synchronize any files.
• D. `robocopy` with `/MIR` mirrors the directory tree, deleting extra destination files and skipping unchanged ones, while `/COPYALL` preserves data, attributes, timestamps, and security information.

Correct answer: A — Build one reference PC, capture a system image of it, and deploy that image to each of the other PCs over the network

• A. Correct. Image deployment captures a fully configured reference system once and applies it to many machines. That gives identical results and fits the one-day deadline.
• B. Manual installs from a USB drive repeat the same work 30 times and invite inconsistent settings between machines. It cannot meet the deadline well.
• C. Self-service installs by trainers produce inconsistent versions and options, and standard users may lack the rights to install software. It also delays readiness.
• D. Mounting ISOs on each PC is still a per-machine, per-application process. It is repeatable but slow and error prone at this scale.

Correct answer: C — single sign-on (SSO)

• A. Incorrect. Known Folder Move redirects Desktop, Documents and Pictures into OneDrive and has nothing to do with authentication.
• B. Incorrect. Files On-Demand controls whether synced files are stored locally or only online, not how users sign in.
• C. Correct. Single sign-on lets one authentication cover multiple cloud services without repeated credential prompts.

Correct answer: D — The device is pre-registered with the organization and configures itself automatically on its first online start-up

• A. Incorrect. Booting from USB and answering each prompt by hand is a manual, hands-on installation, which is the opposite of zero touch.
• B. Incorrect. Selecting a task sequence at each build step requires a technician to attend the device, so it remains a hands-on deployment.
• C. Incorrect. Using the recovery partition resets the device to factory state and needs user interaction, so it is not a zero-touch process.
• D. Correct. In zero-touch deployment (for example Windows Autopilot), the device is pre-registered and configures itself during first start-up without IT handling it.

Correct answer: C — Indexing Options, to add D:\Projects to the included locations in the index

• A. Incorrect. Devices and Printers lists hardware such as printers and peripherals and does not control which folders Windows Search covers.
• B. Incorrect. Programs and Features handles installed applications and optional features, and a location that was never indexed is not a damaged component to repair.
• C. Correct. Indexing Options defines the locations Windows Search scans, so adding the folder lets the search index return its files.
• D. Incorrect. The page file supplies virtual memory and has nothing to do with which folders are scanned by Windows Search.

Correct answer: A — The default gateway, which must be a router address inside 192.168.10.0/24 for traffic to leave the local subnet

• A. Correct. Local pings work, so the address and mask are fine. Traffic for other subnets goes to the default gateway; if it is missing or wrong, only the local subnet is reachable.
• B. Incorrect. DNS servers resolve names and need not be on the local subnet. A bad DNS entry would not block pings to remote IP addresses.
• C. Incorrect. WINS is a legacy name-resolution service and has no role in routing packets to remote subnets.
• D. Incorrect. Windows does not use a MAC filter list to decide where remote traffic goes; routing depends on the gateway, not on a frame allow list.

Correct answer: B — Open the disk image to mount it, drag the app bundle into the /Applications folder, then eject the mounted volume when finished

• A. A .dmg is a mounted disk image, not a shell script, so marking it executable and running it from Terminal does not install anything. Installation is normally a drag-and-drop copy.
• B. A .dmg mounts as a virtual volume containing an .app bundle. Dragging the bundle to /Applications copies it into place, and ejecting the volume afterward cleans up the installer.
• C. /System/Library is owned by the operating system and protected by System Integrity Protection, so third-party apps are not placed there. Disk Utility does not extract installers into it either.
• D. macOS has no registry; that is a Windows concept. A .dmg does not launch a setup wizard, and apps need no registration beyond being copied to /Applications.

Correct answer: A — Prefix the update command with sudo and authenticate with their own password so activity is logged by user

• A. Correct. sudo elevates a single command using the user's own credentials and records the invoking account, giving individual accountability.
• B. Incorrect. su - opens a full root shell with the shared root password, so later actions are attributed to root rather than the person.
• C. Incorrect. Copying a hash in /etc/shadow is an unsafe hack that duplicates credentials and defeats per-user accountability.
• D. Incorrect. Logging in as root with a shared password removes individual attribution and violates the principle of least privilege.

Correct answer: D — Delegate only the password reset permission on the Sales OU to the technician's own account

• A. Domain Admins grants far more rights than password resets require, and even a temporary membership exposes the whole domain to misuse.
• B. A shared administrator account gives unlimited rights, destroys individual accountability in audit logs, and exceeds what the task needs.
• C. Power Users is a legacy local group that does not control domain password resets, and it grants unneeded rights on every workstation.
• D. Delegating just the reset-password permission on one OU gives the technician exactly the access the job requires and nothing more, which is the definition of least privilege.

Correct answer: C — Read, because over the network the most restrictive result of the share and NTFS permissions is what applies.

• A. NTFS does not override a more restrictive share permission for network access. Modify would only apply to a user signed in locally at the file server.
• B. Share and NTFS permissions are never added into a higher level of access, and nothing is rounded up. The two sets are compared and the stricter one wins.
• C. Correct. When both layers apply, the effective permission for network users is the most restrictive of the two, so Read at the share caps the Modify granted by NTFS.
• D. Allow entries at different layers do not cancel each other out. The user simply receives the more restrictive of the two allowed permissions, not an empty result.

Correct answer: C — Kerberos rejects ticket timestamps when the client and KDC clocks differ by more than about five minutes

• A. Incorrect. TACACS+ governs device administration and is not involved in file share access. Its encryption is not time-based and does not generate Kerberos skew errors.
• B. Incorrect. Group key rotation affects wireless broadcast traffic, not Kerberos validation. The clock-skew error points specifically to time disagreement between client and domain controller.
• C. Correct. Kerberos tickets and authenticators carry timestamps to prevent replay, so a clock outside the default five-minute tolerance causes the KDC or service to reject them. Syncing time fixes it.
• D. Incorrect. RADIUS shared secrets are used between an access point or switch and the RADIUS server. They are not part of Kerberos domain logons and would not log clock-skew errors.

Correct answer: C — Back up the user's documents, then wipe the drive and reinstall the operating system from trusted installation media

• A. Incorrect. Ending processes and clearing the cache only touches visible user-level items; the hidden drivers reload at the next boot.
• B. Incorrect. Toggling the software firewall only changes network filtering rules and does not unload or remove kernel-level drivers.
• C. Correct. A rootkit hides below the level the running OS and its antivirus can inspect, so wiping the drive and reinstalling from trusted media is the dependable remedy.
• D. Incorrect. A scan run from inside the infected OS relies on the same compromised system calls the rootkit filters, so it keeps reporting clean.

Correct answer: A — safe computing habits, such as spotting phishing emails and avoiding downloads from untrusted websites

• A. User education on phishing, risky downloads and untrusted sites is the final step of the procedure. It targets how most infections begin and lowers the chance of reinfection.
• B. Disabling the firewall removes a protective control and increases exposure. Security training teaches users to keep protections enabled, not to turn them off to avoid prompts.
• C. Monthly reimaging is not part of the procedure and is wasteful for a SOHO setting. Reimaging is a response to failed remediation, not an educational topic for routine use.
• D. Sharing administrator credentials is poor security practice that widens the attack surface. Education stresses least privilege and individual accounts rather than shared admin access.

Correct answer: D — Set an account expiration date of 30 August on each intern's account so it is disabled automatically afterward

• A. Incorrect. Password expiration only forces a password change, and the intern could still sign in after choosing a new password on 30 August.
• B. Incorrect. Log-in time restrictions limit when an account can be used each day, but they never end the account's validity on a calendar date.
• C. Incorrect. Placing users in the Guests group reduces their permissions but does not make the account stop working on any particular date.
• D. Correct. An account expiration date disables the account itself on a fixed day, which fits temporary staff whose contract end date is known in advance.

Correct answer: A — Enroll the phones in an MDM service that pushes a passcode profile and supports selective wipe of managed data

• A. Correct. MDM enforces profile security requirements such as a passcode and can retire a BYOD device by wiping only the corporate-managed data, leaving personal content untouched.
• B. Incorrect. A full factory reset removes personal data the company does not own and does nothing to enforce a passcode while the employee is still working.
• C. Incorrect. A locator application can find or fully wipe a device but cannot enforce passcode policy or separate corporate data from personal data.
• D. Incorrect. Filtering traffic on the office network does not apply off the premises and cannot set a passcode or remove stored company email from a phone.

Correct answer: B — Drill several holes completely through the housing and every platter so the surfaces cannot be read in a recovery lab

• A. Breaking the seal does not erase anything because data remains encoded on the platters. A cover-only hole leaves the platters intact and readable.
• B. Multiple holes through the housing and all platters physically damage the recording surfaces, so data cannot be reconstructed even by a recovery lab. This is how drilling is made effective on a hard drive.
• C. The circuit board holds the controller, not the user data, which lives on the platters. Discarding the board leaves the platters recoverable by transplanting a compatible board.
• D. A serial number is not a key to the data. Removing the label does nothing to the information stored on the platters.

Correct answer: C — WPA3-Personal with AES encryption and a long, randomly generated passphrase

• A. Incorrect. WEP is broken and its keys can be recovered in minutes; hiding the SSID does not strengthen the encryption in any way.
• B. Incorrect. An open network sends traffic unencrypted, and MAC filtering offers no confidentiality because addresses are visible and easy to spoof.
• C. Correct. WPA3-Personal with AES provides current, strong encryption and resists offline guessing better than earlier modes, especially with a long random passphrase.
• D. Incorrect. TKIP is deprecated and a short passphrase is easy to guess, so this combination is weaker than WPA3 even though it is better than WEP.

Correct answer: A — The browser discards local history, cookies and form entries once all private windows close, but network administrators can still see traffic.

• A. Private mode keeps session data such as history, cookies and form entries only in memory and drops it at the end. It does nothing to hide activity from the network, so proxies and ISPs still see traffic.
• B. Private browsing does not create a VPN or encrypted tunnel. Employers and internet providers can still observe which sites are visited through the network.
• C. The public IP address is assigned by the network and remains visible to every site visited. Hiding it requires a VPN or proxy, not private mode.
• D. Private mode does not block scripts, and extensions can be allowed in it. Malicious pages can still attack the browser, so it offers no malware protection.

Correct answers: C, D — Force stop the app and clear its cache, then try launching it again to discard corrupted temporary files.; Uninstall the app and reinstall the latest version from the official store to replace damaged program files.

• A. Incorrect. Reducing screen resolution does not address the app crash and would degrade the display for every application.
• B. Incorrect. Permanently disabling the cellular modem would break calls and data for the whole device and does not repair a corrupted install.
• C. Correct. Force stopping and clearing the cache removes temporary data that commonly causes crashes after an update, without touching user data.
• D. Correct. Reinstalling the app from the official store replaces any damaged or partially applied program files left by the update.
• E. Incorrect. Mail clients authenticate over the network and do not use NFC, so switching it off has no impact on the crash.

Correct answer: A — Force-stop and uninstall the wallpaper app, then run a mobile anti-malware scan and review other recently installed apps

• A. Correct. Per-app data usage identifies the likely malicious app; removing it and scanning addresses the cause rather than the symptom.
• B. Incorrect. Bluetooth does not use the cellular data allowance, and location services produce very little traffic compared with several GB.
• C. Incorrect. Cached browser files are stored locally and are not counted toward the cellular limit; the traffic comes from the app.
• D. Incorrect. The usage is attributed to one wallpaper app running in the background, so a bigger plan only pays for a probable data leak.

Correct answer: C — The laptop's system date, time, and time zone, since a wrong clock makes valid certificates look expired.

• A. Incorrect. A blocked port would stop pages loading, not produce a certificate date warning, and coworkers share the same network path.
• B. Incorrect. Pop-up blockers have no role in certificate validation.
• C. Correct. Certificate validity is checked against the local clock, so a wrong date or time zone triggers date errors on every HTTPS site.
• D. Incorrect. Stale DNS records would send the laptop to a wrong server, not make every site's certificate appear expired only for one user.

Correct answer: A — The Windows component store, which sfc uses as its source of known-good copies when it replaces damaged system files.

• A. Correct. DISM RestoreHealth repairs the component store (WinSxS). Because sfc replaces files from that store, a healthy store lets sfc succeed.
• B. Incorrect. DISM does not alter the master boot record, and sfc does not use it to find files. Boot records are handled by bootrec.
• C. Incorrect. sfc does not download drivers. DISM can use Windows Update as a source for repair files, but it does not repair update client settings.
• D. Incorrect. sfc checks protected system files and does not compare profile settings. Profile hives are not repaired by DISM image cleanup.

Correct answer: B — The user off-boarding checklist, which lists disabling accounts, collecting assigned equipment, and updating the asset record for each returned device.

• A. Incorrect. An internal SLA sets response and resolution targets between IT and departments; it gives no step-by-step list for closing out a leaver's accounts and devices.
• B. Correct. An off-boarding checklist ensures access is revoked, equipment is collected, and asset records are updated, so a departing user does not retain access or company property.
• C. Incorrect. The onboarding checklist covers provisioning for a new hire, not revoking access or recovering equipment from someone leaving.
• D. Incorrect. An incident report documents a specific event after it happens; a routine departure is not an incident and needs a repeatable process instead.

Correct answer: C — Install the agent on an isolated virtual machine built from the standard image and run the line-of-business application there first.

• A. Pushing to every workstation at once is a production rollout, not a test. A conflict would hit 800 users before anyone could contain it.
• B. A marketing sheet is not test evidence. It does not show how the agent behaves with this company's own image and application.
• C. Sandbox testing in an isolated environment that mirrors production lets the technician find conflicts without affecting users, and it produces real evidence for the change board.
• D. Piloting on live laptops exposes real users to possible outages. A sandbox finds the same conflicts before any production machine is touched.

Correct answer: A — Memory contents and running processes, because they are lost the moment the system powers off or restarts

• A. Correct. RAM and running processes are the most volatile data and vanish at shutdown, so the order of volatility says to capture them before anything stored on disk.
• B. Incorrect. Event logs live on persistent storage and survive a power-off, so they are less volatile than memory and are collected after it.
• C. Incorrect. Data on an SSD persists without power, which makes it far less volatile than memory; disk imaging comes later in the collection order.
• D. Incorrect. Off-site backups are the least volatile source and stay intact regardless of what happens to the workstation, so they are collected last.

Correct answer: C — Let the customer finish, acknowledge the frustration, then explain the current repair status and the next steps

• A. Incorrect. Explaining away the delay by blaming the supplier is defensive, and arguing the point rather than acknowledging the concern tends to escalate an upset customer.
• B. Incorrect. Handing the complaint off immediately dismisses the customer's issue; the technician should engage with it and escalate only if the customer's needs cannot be met.
• C. Correct. Listening without interrupting, acknowledging the frustration and then giving status and next steps de-escalates the situation and keeps the focus on resolving the issue.
• D. Incorrect. Comparing the customer to others minimizes their experience and dismisses their issue, which is the opposite of showing empathy and professionalism.

Correct answer: A — TCP 22

• A. Secure Shell listens on TCP 22 by default and encrypts the whole command-line session, which makes it the standard way to administer Linux servers remotely.
• B. TCP 23 is used by Telnet, which sends credentials and commands in clear text and is therefore not an encrypted channel.
• C. TCP 3389 is the default port for Remote Desktop Protocol, which provides a graphical Windows desktop rather than an SSH command-line session.
• D. TCP 5900 is the default port for VNC, which shares a graphical desktop and is not the encrypted command-line service described.

Correct answer: A — Edit the draft for accuracy, disclose the AI assistance as policy requires, and check that no passages are copied from existing sources.

• A. Correct. Appropriate use means reviewing AI output for accuracy, following disclosure rules, and avoiding plagiarism by checking that content is not copied from other sources. The technician remains responsible for the final article.
• B. Incorrect. AI output can reproduce existing text and contain errors, so it is not automatically original. Publishing unreviewed text violates responsible-use policy.
• C. Incorrect. Swapping words to evade detection is still plagiarism and hides AI use that the policy requires disclosing. It also leaves any factual errors in place.
• D. Incorrect. Spelling and grammar checkers do not verify facts or detect copied passages. They only fix surface-level language errors.

Correct answers: B, E — Run the script first on a test virtual machine that mirrors the production image and review the results; Comment each setting the script changes and keep a rollback script that restores the original values

• A. Running on every machine at once spreads any mistake to the whole fleet, and users bear the impact. Changes should be proven on a small group first.
• B. A test virtual machine mirroring production shows what the script really changes without risking live computers. Reviewing the results catches unwanted settings changes early.
• C. Turning off antivirus removes a safeguard and invites malware while the script runs. It does nothing to control which settings the script modifies.
• D. A plain-text administrator password can be read by anyone who opens the script, which creates a security hole. It also does not limit what the script changes.
• E. Comments document every setting touched, and a rollback script lets the technician undo unwanted changes quickly. Both limit the damage of inadvertent changes.

Correct answer: A — A full backup built on the backup server by merging the last full with incrementals, without rereading the workstation

• A. A synthetic full is built on the backup server by merging the previous full backup with the incrementals that followed it. This yields a new full restore point without reading all the data from the workstation again, which saves time and network load.
• B. Snapshot-based backups of virtual machines are a different technique. The term synthetic refers to how the full set is constructed from existing backups, not to pausing a guest.
• C. A differential backup copies changes since the last full backup and does not clear the archive attribute. It is also not a full backup, so it cannot be called synthetic.
• D. Compression and encryption at the source describe how data is protected in transit and at rest. They do not define how a synthetic full is created.

Correct answers: A, B — Safety goggles to keep flying debris out of the eyes; An air filter mask to avoid inhaling dust and fine particles

• A. Correct. Compressed air launches particles at high speed, so goggles protect the eyes from debris.
• B. Correct. Dislodged dust becomes airborne and a filter mask keeps the technician from breathing it in.
• C. Incorrect. An apron does not address the hazards of airborne dust, and static protection is provided by wrist straps and mats rather than clothing covers.
• D. Incorrect. High-voltage gloves protect against electrical hazards, which are not present when cleaning an unplugged PC with compressed air.
• E. Incorrect. Fan noise is not the main hazard during cleaning, so hearing protection does not address the particles and debris being released.

Correct answers: B, E — Power off and unplug the PC, then blow dust out in short bursts while holding each fan blade still; Use an ESD-safe vacuum designed for electronics to remove dust from the case, filters, and heat sink fins

• A. Incorrect. Holding the can upside down releases the liquid propellant, which can freeze or wet components. Cans should be kept upright and used in short bursts.
• B. Correct. Cleaning is done with power removed, and holding the fan blades still prevents over-spinning that could damage the bearings or generate a back-voltage on the board.
• C. Incorrect. Ordinary household vacuums and plastic nozzles generate static electricity that can damage sensitive components, so only ESD-safe vacuums are suitable.
• D. Incorrect. Working on a powered system risks shorts and shocks, and free-spinning fans driven by compressed air can be damaged.
• E. Correct. An ESD-safe vacuum pulls dust away without building up static charge, which makes it suitable for the case, filters, and heat sink fins.