Free CompTIA A+ Core 2 Sample Questions

Correct answer: B — Change the product key in the Windows Activation settings.

• A. A clean install involves reformatting the drive or overwriting the existing OS, which would erase all installed applications, settings, and personal files. This fails to meet the user's requirement to keep the current environment intact.
• B. Changing the product key in the Windows Activation settings is the standard in-place upgrade path. Windows will verify the key, download the necessary Pro-only features, and unlock them without affecting the user's data, applications, or settings. This is the most efficient and least disruptive method.
• C. Booting into Windows Preinstallation Environment (Windows PE) and using Deployment Image Servicing and Management (DISM) is typically used for large-scale deployments or system recovery. It is a complex process that would not preserve the current user state as efficiently as a simple activation change.
• D. The System Preparation (Sysprep) utility is used to generalize a Windows installation for imaging and deployment to multiple machines. It removes system-specific data like SIDs and prepares the OS for a first-run experience (OOBE); it is not used for upgrading editions.

Correct answers: C, D — NTFS; ext4

• A. FAT32 does not support journaling. As an older file system, it lacks modern data integrity features, making it more vulnerable to corruption following an unexpected shutdown or power loss.
• B. exFAT (Extended File Allocation Table) was designed for flash storage and cross-platform compatibility. It intentionally excludes journaling to minimize write overhead on flash memory, though this makes it less resilient to power loss than NTFS.
• C. NTFS (New Technology File System) is the standard file system for modern Windows versions. It uses journaling to track metadata changes, allowing the system to quickly restore consistency and prevent corruption after a crash or power failure.
• D. ext4 (Fourth Extended Filesystem) is a widely used file system in Linux distributions. It supports journaling to record file system changes before they are committed, ensuring that the system can recover more safely after an improper shutdown.
• E. CDFS (Compact Disc File System) is a read-only file system used for optical media. Because it is read-only, journaling—which is a mechanism for protecting write operations—is not applicable or supported.

Correct answer: A — Right-click the application in the Processes tab and select End task

• A. Correct. In Windows Task Manager, the Processes tab lists all running applications and background processes. Selecting 'End task' sends a termination signal to the operating system to force the unresponsive application to close, which is the standard troubleshooting step for frozen software.
• B. Incorrect. The App history tab displays resource usage data (like CPU time and network usage) for Universal Windows Platform (UWP) apps over a period of time. It is not used for managing active, running processes, and 'Delete' is not a valid function here for closing applications.
• C. Incorrect. The Performance tab provides real-time monitoring and graphs of system resources such as CPU, Memory, and Disk usage. It does not provide a mechanism to 'suspend the CPU,' nor would doing so resolve an issue with a single frozen application.
• D. Incorrect. The Users tab allows you to see which users are logged in and the resources their processes are using. While disconnecting or signing out a user would close the application, it would also close all other unsaved work for that user, making it an unnecessary and extreme measure for a single unresponsive app.

Correct answer: B — Unattended installation

• A. A clean install involves installing an operating system on a new disk or a reformatted partition, which removes any existing data. While a clean install can be performed as part of an automated process, the specific method that utilizes an answer file to provide responses and bypass prompts is termed an unattended installation.
• B. An unattended installation uses an answer file (such as autounattend.xml) to provide responses to setup prompts automatically. This method is used to deploy operating systems without manual user intervention, making it ideal for enterprise-level deployments where many systems must be configured identically.
• C. An in-place upgrade installs a newer version of an operating system over an existing one while preserving user data, applications, and settings. This process generally requires manual user intervention at various steps and is not defined by the use of automated answer files.
• D. A repair installation is used to fix or restore an existing operating system installation that has become corrupted or unstable. It is a maintenance procedure rather than an automated deployment method associated with answer files.

Correct answer: C — robocopy

• A. While xcopy is more advanced than the basic copy command and can replicate directory structures, it lacks a robust 'restartable mode' for network interruptions and is less efficient at preserving full NTFS permissions compared to more modern tools.
• B. The copy command is a basic utility intended for simple file operations. It does not support resuming interrupted transfers, nor does it have the capability to preserve NTFS security descriptors or permissions during the process.
• C. Robocopy (Robust File Copy) is specifically designed for reliable large-scale data migrations. It includes a restartable mode (/Z) to handle unstable network connections and can natively preserve all NTFS permissions and file metadata using flags like /SEC or /COPYALL.
• D. The move command is used to change the location of files or directories. It is not built for resilient network data migration and lacks the specialized features required to resume interrupted transfers or manage complex permission preservation.

Correct answers: A, B — TPM 2.0; Secure Boot capable firmware

• A. Correct. TPM (Trusted Platform Module) version 2.0 is a mandatory hardware-level security requirement for Windows 11. It provides secure cryptographic functions, hardware-based key protection, and ensures the integrity of the boot process.
• B. Correct. Windows 11 requires UEFI firmware that is Secure Boot capable. Secure Boot is a security standard that helps ensure a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM), preventing malware from loading during startup.
• C. Incorrect. Windows 11 is a 64-bit-only operating system and requires a compatible 64-bit processor with at least two cores. 32-bit (x86) processor architectures are not supported.
• D. Incorrect. The minimum RAM requirement for Windows 11 is 4GB. 2GB of RAM was the minimum for some versions of Windows 10, but it does not meet the hardware specifications for Windows 11.
• E. Incorrect. Windows 11 requires the GUID Partition Table (GPT) partition style to support the required UEFI firmware. Master Boot Record (MBR) is associated with legacy BIOS systems and is not supported for the system drive in Windows 11.

Correct answer: A — xcopy

• A. Correct. xcopy is a Windows command-line utility designed to copy files, directories, and subdirectories. While it is more powerful than the basic 'copy' command, it lacks robocopy's native 'restartable' mode, which allows for resuming transfers after an interruption.
• B. Incorrect. The move command is used to relocate files and directories from one location to another rather than creating copies. It does not fit the description of a utility specifically used for copying directory structures.
• C. Incorrect. The replace command is used specifically to replace files in a destination directory with files of the same name from a source. It is not a general-purpose utility for copying full directory and subdirectory trees.

Correct answer: B — Install Windows 10 first, then install Ubuntu.

• A. Installing Ubuntu first is generally avoided because the Windows Boot Manager often overwrites existing bootloaders (like GRUB) and assumes it is the only operating system. This typically results in the system booting directly into Windows without giving the user the option to select Linux.
• B. The industry best practice for a dual-boot setup is to install Windows first. Ubuntu's installer is designed to recognize existing Windows partitions and will automatically configure the GRUB bootloader to manage both operating systems, presenting a menu at startup to choose between them.
• C. PXE (Preboot Execution Environment) is a method for booting or installing an OS over a network. It is not a mechanism for installing multiple operating systems simultaneously on a single local drive for a dual-boot configuration.
• D. exFAT is a file system primarily used for removable storage and cross-platform compatibility. It is not a suitable format for installing an operating system, as Windows requires NTFS and Linux requires formats like ext4 to support system features like file permissions and journaling.

Correct answer: B — Sysprep

• A. Diskpart is a command-line utility used for managing disk partitions, such as creating, deleting, or formatting volumes. It does not handle the removal of unique system identifiers or the generalization of an OS for imaging.
• B. Sysprep (System Preparation tool) is the standard Microsoft utility used to prepare a Windows installation for imaging and deployment. Its primary function is to generalize the system by removing unique hardware information and system identifiers (like the SID), ensuring that clones of the image do not conflict with each other on a network.
• C. Bootrec is a utility used within the Windows Recovery Environment to repair boot-related issues, such as the Master Boot Record (MBR) or Boot Configuration Data (BCD). It is not used for system imaging or generalization.
• D. SFC (System File Checker) is a maintenance tool that scans and restores corrupted Windows system files. While useful for troubleshooting, it cannot remove machine-specific identifiers or prepare a system for deployment.

Correct answers: A, C — It supports partitions larger than 2TB.; It supports up to 128 primary partitions in Windows.

• A. GUID Partition Table (GPT) supports disk sizes and partitions much larger than the 2TB limit imposed by the Master Boot Record (MBR) system, making it essential for a 4TB SSD.
• B. GPT is designed to work with modern Unified Extensible Firmware Interface (UEFI) systems. Older legacy BIOS systems primarily use the MBR partition style.
• C. In Windows, GPT allows for the creation of up to 128 primary partitions. This is a significant improvement over MBR, which is limited to four primary partitions (or three primary partitions and one extended partition).
• D. GPT does not provide automatic encryption. Boot sector or disk encryption is a function provided by software like BitLocker or hardware features, not by the partition table style itself.
• E. GPT is fully compatible with modern Linux distributions. In fact, many Linux systems require GPT when used on UEFI-based hardware.

Correct answer: B — Assign standard user accounts for daily tasks and reserve admin accounts for administrative duties.

• A. Mandatory Access Control (MAC) is a strict security model where access is restricted based on security labels and clearance levels. While it is a form of access control, it does not specifically address the problem of users having excessive administrative privileges for daily workstation activities.
• B. This recommendation directly implements the Principle of Least Privilege (PoLP). By providing users with standard accounts for daily work and reserving administrator privileges only for specific administrative tasks, the organization reduces the risk of malware execution, accidental system modifications, and unauthorized access.
• C. Requiring frequent password changes is a credential management policy aimed at mitigating the risk of stolen passwords. It does not affect the level of permissions or privileges assigned to the account itself.
• D. Single Sign-On (SSO) centralizes and simplifies the authentication process across various platforms, but it does not dictate or reduce the level of access rights (privileges) a user has once they are logged into their workstation.

Correct answer: C — EAP-TLS

• A. Incorrect. EAP-FAST (EAP Flexible Authentication via Secure Tunneling) was developed by Cisco as a replacement for LEAP. It typically uses a Protected Access Credential (PAC) for authentication rather than requiring digital certificates on both the server and the client, making it easier to deploy but less secure than certificate-based mutual authentication.
• B. Incorrect. PEAP (Protected Extensible Authentication Protocol) only requires a digital certificate on the authentication server to establish a secure tunnel. Client authentication typically occurs inside that tunnel using a password-based method like MS-CHAPv2, rather than requiring a client-side certificate.
• C. Correct. EAP-TLS (EAP Transport Layer Security) is widely considered the most secure EAP method because it requires mutual authentication. This means digital certificates must be installed on both the authentication server and every client device. This certificate-based approach effectively eliminates password-related vulnerabilities, though it requires a Public Key Infrastructure (PKI) to manage the certificates.
• D. Incorrect. EAP-TTLS (EAP Tunneled Transport Layer Security) requires a certificate on the authentication server to create a secure tunnel, but it allows the client to authenticate using a variety of legacy methods (such as PAP or CHAP) within that tunnel. It does not require certificates on the client devices.

Correct answer: C — Offline, air-gapped backups

• A. Differential backups only back up the changes made since the last full backup to save time and storage. However, this is a data selection method rather than a security strategy; if the destination drive is network-attached or online, it remains vulnerable to ransomware encryption.
• B. Incremental backups back up changes made since the last backup of any type. While efficient for storage, they provide no inherent protection against ransomware if the backup repository is accessible from the infected network environment.
• C. Offline, air-gapped backups are physically or logically disconnected from the network and the primary system. Because ransomware typically spreads via network connections, it cannot reach or encrypt data stored on an air-gapped medium, making it the most reliable defense for data recovery.
• D. Cloud-based synchronized backups often automatically sync changes to the cloud. If local files are encrypted by ransomware, the encrypted versions may immediately overwrite healthy copies in the cloud. Without specific features like immutability or versioning, synchronization alone is not an effective defense against ransomware.

Correct answer: B — Educate the end user

• A. Installing multiple real-time antivirus programs is discouraged because they can conflict with one another, cause system instability, and degrade performance. One robust, updated antivirus solution is the standard recommendation.
• B. Educating the end user is the seventh and final step of the CompTIA malware removal process. It is a vital proactive measure that empowers users to recognize threats like phishing, avoid suspicious downloads, and follow security best practices to prevent reinfection.
• C. Disabling a user's email account is a disruptive and extreme measure. While it might be done temporarily during a high-risk security incident, it is not a standard prevention or education step.
• D. Quarantining a workstation is a containment step (Step 2) used during the initial discovery of malware. Making this quarantine permanent is impractical for business operations; the goal is to clean and restore the system to a safe, functional state.

Correct answer: B — Adware

• A. Incorrect. A rootkit is a type of malware designed to gain unauthorized root or administrative access to a computer system while hiding its presence. It focuses on stealth and persistence rather than displaying advertisements.
• B. Correct. Adware is software designed to display unwanted advertisements (such as pop-ups or browser redirects) and often collects user browsing data or tracking behavior to generate revenue for the attacker.
• C. Incorrect. A logic bomb is malicious code inserted into a software system that remains dormant until specific conditions are met, such as a date, time, or specific event. It is not used for advertising.
• D. Incorrect. A cryptominer hijacks a victim's system resources (CPU or GPU) to mine cryptocurrency without the user's consent. Its primary goal is resource theft, not ad display or user tracking.

Correct answer: B — Host-based intrusion prevention system (HIPS)

• A. Cloud-based antivirus offloads scanning and detection to cloud servers using reputation and signature data. While effective for malware detection, it is generally less proactive at monitoring and blocking granular system-level behaviors on a host compared to a HIPS.
• B. A Host-based Intrusion Prevention System (HIPS) is an endpoint security control that monitors the host for suspicious activity (such as unauthorized registry changes or system calls) and can actively block those actions in real-time to prevent infection or compromise.
• C. A hardware firewall is a network security device that filters traffic entering or exiting the network based on IP addresses, ports, or protocols. It does not have the internal visibility required to monitor or prevent malicious execution occurring on an individual host's operating system.
• D. A local heuristic engine is a detection method used by antivirus software to identify previously unknown malware based on behavioral patterns or code characteristics. While it is a powerful tool, it is typically a feature of a broader security solution rather than a complete standalone prevention system like HIPS.

Correct answer: B — Rootkit

• A. A Potentially Unwanted Program (PUP) is software that a user may perceive as unwanted or unnecessary, often bundled with legitimate downloads. While they can cause performance issues or privacy concerns, they are not designed to gain root access or hide deep within the operating system.
• B. A rootkit is a collection of software tools designed to grant an attacker privileged (root or administrative) access to a computer while actively hiding its presence. It often achieves this by modifying system files, drivers, or the kernel to intercept and filter out information that would reveal its existence to the OS or antivirus software.
• C. Ransomware is a type of malicious software designed to block access to a computer system or encrypt data until a sum of money is paid. Its primary goal is extortion rather than maintaining long-term, stealthy administrative access.
• D. Fileless malware operates primarily in a system's memory (RAM) and utilizes legitimate system tools (like PowerShell or WMI) to execute commands. Although it is highly stealthy because it leaves no footprint on the hard drive, the specific term for malware that masks its presence to maintain root-level access is a rootkit.

Correct answer: A — The boot order in the BIOS is set to a non-bootable USB drive.

• A. If the BIOS boot order is configured to prioritize a non-bootable USB drive or other removable media, the system will search that device for a bootloader. Failing to find it, the system may display 'BOOTMGR is missing'. This is a common occurrence when a user leaves a thumb drive or external hard drive plugged into the computer during a restart.
• B. The Windows Registry is a configuration database loaded by the OS kernel. While registry corruption can cause Windows instability or prevent the OS from loading properly, the 'BOOTMGR is missing' error occurs much earlier in the boot process, before the Registry hives are even accessed.
• C. A corrupted user profile prevents a specific user from logging into their desktop environment. The boot process must complete successfully to reach the login screen where profiles are used. Therefore, profile issues cannot trigger a bootloader error.
• D. The pagefile.sys is used for virtual memory management after Windows is already running. It is not required for the boot manager to start the OS, and its deletion would not result in a 'BOOTMGR is missing' error.

Correct answer: B — The device storage is nearly full, leaving no room for caching or virtual memory

• A. Boot sector viruses are primarily associated with traditional PC boot processes and legacy BIOS systems. Modern smartphone architectures use secure boot mechanisms and differ significantly in storage management, making this a highly unlikely cause for performance degradation.
• B. This is the most likely cause. Modern mobile operating systems require a percentage of free storage for system caches, log files, app updates, and virtual memory/swap functions. When storage is nearly full (common on 32GB devices), the OS cannot perform these background tasks efficiently, leading to extreme slowness and the inability to save new data like email attachments.
• C. A corrupted SIM card typically results in connectivity issues, such as the inability to authenticate with the cellular network or 'No SIM' errors. It does not affect the device's local storage capacity or the speed at which the operating system runs applications.
• D. The digitizer is the component responsible for processing touch input. A faulty digitizer would result in ghost touches or unresponsive areas on the screen, but it would not cause apps to load slowly or prevent the downloading of attachments.

Correct answer: A — Clear the contents of the C:\Windows\System32\spool\PRINTERS folder.

• A. A corrupted print job or damaged file in the spooler queue is the most common cause for the Print Spooler service to crash or stop immediately after starting. Clearing the contents of the PRINTERS folder removes these stuck or corrupt jobs, allowing the service to stabilize.
• B. While USB drivers facilitate hardware communication, they would typically lead to a 'Printer Not Found' error rather than causing the Print Spooler Windows service to crash upon startup.
• C. Changing the startup type to 'Manual' only dictates when the service starts; it does not resolve the underlying software error or file corruption that is causing the service to fail once it is active.
• D. A faulty USB cable would prevent the computer from communicating with the physical hardware, but the Print Spooler service should still be able to run in the background regardless of whether a device is physically plugged in.

Correct answer: A — Enable high accuracy mode for Location Services

• A. Enabling high accuracy mode (often referred to as 'Improved Accuracy') allows the device to use a combination of GPS, Wi-Fi, Bluetooth, and mobile networks to determine the device's position. This is the most effective way to resolve location offsets and improve precision for location-dependent applications.
• B. Clearing the app cache may help with UI performance or temporary glitches within the app, but location data is provided by the mobile operating system's location services API, which is not affected by the application's local cache.
• C. Turning off Wi-Fi and Bluetooth scanning would actually decrease location accuracy. These features assist the GPS by using nearby network signals to help triangulate the device's position, especially in urban environments where GPS signals may bounce off buildings.
• D. The gyroscope is used to measure the device's orientation and rotation (tilt and turn). While calibrating it might help with compass heading or motion sensing in games, it has no impact on determining the device's geographic coordinates.

Correct answer: B — dism /online /cleanup-image /restorehealth

• A. The bootrec /rebuildbcd command is used to rebuild the Boot Configuration Data (BCD) store to resolve boot-related issues. It is not designed to repair the Windows component store or system file corruption within a running OS.
• B. The DISM (Deployment Image Servicing and Management) tool with the /restorehealth switch repairs the Windows component store, which SFC uses as its source for healthy replacement files. If SFC fails to fix files, DISM can repair the underlying image by downloading fresh copies of corrupted files from Windows Update or another source.
• C. The chkdsk c: /r command scans the hard drive for logical filesystem errors and physical bad sectors. While it ensures disk integrity, it does not specifically repair the Windows OS image or corrupted system files.
• D. The diskpart command is a disk partitioning utility used for managing disks, partitions, and volumes (e.g., creating or deleting partitions). It does not have the capability to repair corrupted operating system files or the Windows image.

Correct answers: A, B — Disable the auto-brightness/adaptive brightness feature; Manually increase the brightness slider to maximum

• A. Correct. Auto-brightness or adaptive brightness uses a light sensor to adjust the screen based on ambient conditions. In bright sunlight, if the sensor is obstructed, limited by power settings, or malfunctioning, disabling it allows the user to manually lock the display at the maximum brightness level.
• B. Correct. Manually increasing the brightness slider to its maximum level directly addresses the problem of the screen being too dim in bright outdoor light by increasing the backlight intensity to compete with the ambient sunlight.
• C. Incorrect. Battery saver mode typically reduces screen brightness and sets a lower cap on the maximum brightness to conserve power, which would make the display even harder to read in sunlight.
• D. Incorrect. The blue light filter (Night Light) adjusts the color temperature of the display to reduce eye strain in low-light conditions. It does not improve visibility in bright sunlight and can sometimes make the screen appear slightly dimmer.
• E. Incorrect. Clearing the application cache is a software troubleshooting step for performance issues and has no effect on the hardware brightness or display settings of the tablet.
• F. Incorrect. While some prefer the look of dark mode, on most glossy mobile screens, a dark background increases the visibility of reflections and glare in direct sunlight, often making the content more difficult to read than a standard light background.

Correct answer: A — Disconnect the computer from the network immediately

• A. Isolation and containment is the most critical first step when dealing with ransomware. Disconnecting the computer from the network (wired or wireless) prevents the malware from spreading to other devices on the network, accessing shared drives, or communicating with the attacker's Command and Control (C2) server.
• B. Paying the ransom is never recommended. It does not guarantee that the data will be recovered, it validates the attacker's business model, and it funds further criminal activity. CompTIA best practices dictate isolating the system and restoring from known-good backups.
• C. While Safe Mode can be used during the remediation phase to help remove certain types of malware, the priority in a ransomware incident is immediate containment. Rebooting can also sometimes trigger further encryption or damage boot sectors depending on the ransomware strain.
• D. Running an anti-malware scan is part of the remediation process (identifying and removing the threat). However, this must only be performed after the system has been isolated from the network to ensure the infection does not spread while the scan is running.

Correct answer: B — A zero-day OS vulnerability

• A. Rogue anti-malware, also known as scareware, is a type of malicious software that poses as a legitimate security tool to trick users into paying for removal of non-existent threats. While it causes disruptive pop-ups and fake alerts, it typically does not aim to crash the system with a BSOD.
• B. A zero-day OS vulnerability is a newly discovered flaw in the operating system for which no patch is yet available. Exploiting these flaws often involves interacting with low-level system memory or kernel-level processes, which can lead to critical system instability, crashes, and Blue Screen of Death (BSOD) errors.
• C. Expired corporate antivirus licenses represent a security risk because the software may stop receiving signature updates, but this is an administrative or compliance issue. The expiration itself does not cause system instability or critical crashes.
• D. A legitimate Windows Defender alert is a standard system notification informing the user of a detected threat or current status. It is a sign of a functioning security system and is not a vulnerability or a cause of system instability.

Correct answer: B — A failing graphics card fan

• A. Cryptomining malware is a security threat that hijacks system resources (CPU/GPU) to mine cryptocurrency, which can lead to high resource usage and sluggishness. However, it is not a direct cause of physical graphical artifacts or hardware-level display distortions unless the hardware is already failing.
• B. A failing graphics card fan prevents heat dissipation from the GPU, leading to overheating. Excessive heat in a GPU typically results in graphical artifacts (distorted images or colors) and triggers thermal shutdowns to prevent permanent hardware damage. This is the most likely cause when overheating and artifacts are both present.
• C. Outdated display drivers can cause various software-related glitches, poor performance, or compatibility issues. While they can affect display stability, they are unlikely to cause hardware-level overheating symptoms or the specific thermal-related artifacts described.
• D. A fragmented hard drive primarily impacts file access speeds and overall system responsiveness by forcing the drive head to move more frequently. It has no direct relationship with graphics processing, GPU temperature, or visual artifacts on the monitor.

Correct answer: B — Ask the HR manager to close the document to maintain confidentiality.

• A. Reviewing sensitive salary information for personal curiosity is a violation of professional ethics and confidentiality policies. It is unprofessional to access or read sensitive data without a specific business need.
• B. The technician should respect confidentiality by not viewing the contents of the document. Asking the HR manager to close or secure the spreadsheet ensures that sensitive information is protected while the technician works, which is consistent with professional best practices for handling Personally Identifiable Information (PII).
• C. Reporting the HR manager is an overreaction. As an HR professional, they are likely authorized to view the data. The technician's goal should be to maintain professional standards and privacy, not to penalize authorized users for performing their job duties.
• D. Taking a screenshot of confidential data would further expose sensitive information and create an additional privacy violation and security risk. Technicians should never capture or store sensitive data that is not required for the technical resolution.

Correct answer: B — Call the client as soon as it is safe to do so, explain the delay, and provide an ETA.

• A. Driving recklessly is unsafe and unprofessional. Professionalism requires prioritizing safety and clear communication rather than taking unnecessary risks to make up for lost time.
• B. This is the most professional response. Communicating the delay as soon as it is safe to do so demonstrates accountability, shows respect for the client's time, and allows them to adjust their schedule based on the provided ETA.
• C. Waiting until arrival leaves the client uninformed and unable to pivot their schedule. Prompt communication is a cornerstone of professional customer service and incident management.
• D. Sending an email to a general support address is passive and unreliable for an urgent scheduled appointment. Direct communication with the specific client contact is required to ensure the message is received and acknowledged.

Correct answer: B — Politely ask the user to explain what they mean by that phrase.

• A. Ignoring the user's description may cause the technician to miss important context or diagnostic clues. Professional support requires active listening and clarifying any points of confusion to ensure the issue is understood accurately before proceeding with diagnostics.
• B. Politely asking the user to clarify the phrase shows respect for their perspective and ensures clear communication. This approach is culturally sensitive, maintains professionalism, and allows the technician to gather the specific information needed for a successful resolution.
• C. Correcting the user's terminology can be perceived as dismissive or condescending, which damages rapport and hinders open communication. The objective is to understand and solve the user's problem, not to lecture them on technical jargon.
• D. Laughing at a user's phrasing is unprofessional and could be interpreted as mockery, particularly when dealing with cultural differences. This behavior risks offending the user and creating a barrier to effective technical support.

Correct answer: A — System Restore

• A. Correct. System Restore uses restore points to return system files, drivers, and registry settings to an earlier state. It is specifically designed to troubleshoot issues like faulty driver updates while leaving the user's personal documents, photos, and files intact.
• B. Incorrect. The 'Remove everything' option for Reset this PC performs a clean installation of Windows by deleting all personal files, applications, and settings. This would result in the loss of the user's documents.
• C. Incorrect. System Image Recovery is a 'bare metal' restoration tool that replaces the entire drive's contents with a previous snapshot. This would likely overwrite any documents created or modified since the last system image was created.
• D. Incorrect. File History is a data backup utility used to restore previous versions of personal files. It does not back up or restore system files, drivers, or registry settings, and therefore cannot fix BSOD errors caused by a driver installation.

Correct answer: B — System Image backup

• A. File-level backups target specific files and folders rather than the entire disk structure. While useful for recovering user documents, they do not include the operating system or system files required to boot a new, unformatted drive.
• B. A system image backup captures a complete snapshot of the entire hard drive, including the operating system, partition information, installed applications, system settings, and user data. This is the only option that allows for a 'bare-metal' restore to a new drive.
• C. An incremental backup only captures changes made since the last backup. While it is a backup strategy used to save space, it is not a specific type of backup image that independently facilitates the recovery of an entire OS onto a fresh drive; it would require the original full backup and all subsequent incrementals to reach the desired state.
• D. Directory sync (such as cloud synchronization or file mirroring) ensures that files in one location match another. It does not provide a bootable recovery of the operating system or installed applications on a new hard drive.

Correct answer: C — Windows Recovery Environment (WinRE)

• A. Safe Mode with Networking is a diagnostic startup mode that loads a minimal set of drivers and services, including networking. While it is used for troubleshooting, it is not the environment that automatically triggers after multiple failed boot attempts; rather, it is an option selectable from within the recovery menus.
• B. Windows Preinstallation Environment (WinPE) is a lightweight OS used for the installation, deployment, and custom recovery of Windows. While the Windows Recovery Environment is built on top of WinPE, WinPE itself is not the specific feature that automatically loads for standard users after repeated boot failures.
• C. Windows Recovery Environment (WinRE) is designed to load automatically after a Windows 10 system fails to boot three consecutive times. It provides access to automated troubleshooting tools like Startup Repair, as well as manual recovery options like System Restore, Command Prompt, and the 'Reset this PC' feature.
• D. The BIOS/UEFI Setup Utility is firmware used to configure hardware settings and boot order. It is independent of the operating system and does not provide Windows-specific troubleshooting tools or automatically load in response to Windows boot failures.

Correct answer: A — Password policy

• A. Correct. A password policy is the formal document that defines specific requirements for password creation and management, including minimum length, complexity, and history (reuse) rules. It serves as the official guideline for user authentication security within an organization.
• B. Incorrect. A knowledge base is a repository for troubleshooting guides, FAQs, and technical documentation intended for support and reference. While it might reference the policy, it is not the formal source for defining security requirements.
• C. Incorrect. Regulatory compliance policies address adherence to external legal or industry standards (like HIPAA or PCI DSS). While these regulations may mandate that an organization has strong passwords, the specific technical implementation details (12 characters, history of 5) belong in the internal password policy.
• D. Incorrect. Incident documentation is used to record details of security events, response actions, and outcomes after an incident occurs. It is not a policy document used to establish proactive security rules.

Correct answer: A — End-user acceptance

• A. End-user acceptance testing (UAT) is the phase where a representative group of actual users tests the software in a real-world scenario to verify it meets business requirements and workflow needs before full deployment.
• B. Change board approval (CAB) is the formal review process where a committee evaluates and authorizes the change request. While essential to the process, it involves governance rather than the hands-on testing by users described in the scenario.
• C. Risk analysis involves identifying and evaluating potential negative impacts or vulnerabilities associated with the change to mitigate problems before implementation begins.
• D. Documenting changes is the continuous process of recording modifications, configurations, and results throughout the change lifecycle to maintain accurate system records for future troubleshooting and compliance.

Correct answers: A, B — Asset tags; Inventory management database

• A. Asset tags are essential for physical identification. They provide a unique identifier that links a specific physical device to its digital record in a database, allowing auditors to verify that the physical laptop matches the documentation for lifecycle and assignment.
• B. An inventory management database is the primary repository for asset documentation. it tracks lifecycle status (purchased, deployed, end-of-life), current physical location (office, branch, or remote), and the specific user assigned to each device.
• C. Logical network diagrams describe the flow of data and how devices are connected to the network (VLANs, IPs). They do not track the physical location, individual lifecycle status, or user assignments for hardware assets.
• D. An Acceptable Use Policy (AUP) outlines the rules for employee behavior when using company resources. While it establishes the terms for receiving a laptop, it is a policy document rather than a tracking record for hardware status or location.
• E. Change advisory board (CAB) minutes record approved changes to the IT infrastructure. While they might mention bulk hardware upgrades, they are not designed to maintain a real-time inventory of individual laptop assignments or physical locations.