COMPTIA A+ CORE 2 220-1202
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A technician is troubleshooting a Windows workstation that has
become unusually slow. Task Manager shows that one process is
consistently consuming nearly 100% of the CPU. The user reports
that the problem began after installing a free application
downloaded from an unfamiliar website. What should the
technician do FIRST?
A. Increase the system RAM
B. Immediately terminate the process and delete its executable
C. Investigate the process, verify its legitimacy, and perform an
appropriate malware scan
D. Disable Windows Update
Answer: C. Investigate the process, verify its legitimacy, and
perform an appropriate malware scan
Rationale: A process consuming excessive CPU after software was
installed from an untrusted source is a potential indicator of malware.
The technician should first investigate and validate the process and
then use trusted security tools to determine whether it is malicious.
Immediately deleting files can destroy evidence or damage legitimate
software. Increasing RAM does not address a process that is
monopolizing CPU resources.
1
, 2. A Windows 11 computer displays a message stating that the
operating system cannot find a required boot device. The
technician confirms that the SSD is physically connected and
visible in UEFI firmware. Which of the following is MOST likely
to resolve a corrupted Windows boot configuration?
A. ipconfig /flushdns
B. bootrec or appropriate Windows recovery boot-repair tools
C. sfc /scannow from the normal desktop
D. netstat -ano
Answer: B. bootrec or appropriate Windows recovery boot-repair
tools
Rationale: Boot-related failures can result from damaged boot
configuration data or boot records. Windows Recovery Environment
provides tools such as boot-repair functionality and, where
appropriate, bootrec commands. ipconfig, netstat, and similar
networking commands do not repair the Windows boot process. sfc is
designed primarily to verify and repair protected system files rather
than directly reconstructing boot configuration.
3. A company wants to ensure that employees cannot install
unauthorized applications on corporate Windows computers.
Which configuration would BEST support this requirement?
A. Give all users local administrator privileges
B. Require standard user accounts and use application-control policies
C. Disable Windows Defender
D. Increase the page file size
Answer: B. Require standard user accounts and use application-
control policies
2
,Rationale: Standard user accounts reduce the ability of users to install
or modify software without authorization. Application-control
mechanisms can further restrict which applications are permitted to
execute. Giving users administrator privileges increases the attack
surface. Antivirus and virtual-memory settings do not directly enforce
application installation policies.
4. A user receives an email claiming to be from the company's IT
department. The message asks the user to click a link and
immediately enter their Microsoft account password to prevent
account suspension. The domain in the link is slightly misspelled.
What type of attack is MOST likely occurring?
A. Phishing
B. Shoulder surfing
C. Tailgating
D. Evil twin
Answer: A. Phishing
Rationale: Phishing uses deceptive communications to trick victims
into revealing credentials or performing malicious actions. A
suspicious sender, urgent language, credential request, and look-alike
domain are classic phishing indicators. Shoulder surfing involves
observing someone entering information, tailgating involves
unauthorized physical access, and an evil twin is a fraudulent wireless
access point.
5. A company is implementing a policy requiring employees to use a
password plus a security token when logging in. Which security
principle does this implement?
3
, A. Least privilege
B. Multifactor authentication
C. Data minimization
D. Network segmentation
Answer: B. Multifactor authentication
Rationale: Multifactor authentication requires authentication factors
from different categories. A password is something the user knows,
while a physical security token is something the user has. Combining
them provides stronger authentication than relying on a password
alone.
6. A technician suspects that a Windows computer has corrupted
system files. Which command should be used to scan protected
Windows system files and attempt repairs?
A. format
B. sfc /scannow
C. diskpart clean
D. taskkill
Answer: B. sfc /scannow
Rationale: System File Checker (sfc /scannow) examines protected
Windows system files and attempts to replace corrupted versions with
valid copies. format and diskpart clean can destroy data, while taskkill
terminates processes and does not repair system files.
7. A Windows workstation repeatedly crashes with a blue screen
shortly after a new device driver is installed. What is the BEST
initial troubleshooting action?
4
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A technician is troubleshooting a Windows workstation that has
become unusually slow. Task Manager shows that one process is
consistently consuming nearly 100% of the CPU. The user reports
that the problem began after installing a free application
downloaded from an unfamiliar website. What should the
technician do FIRST?
A. Increase the system RAM
B. Immediately terminate the process and delete its executable
C. Investigate the process, verify its legitimacy, and perform an
appropriate malware scan
D. Disable Windows Update
Answer: C. Investigate the process, verify its legitimacy, and
perform an appropriate malware scan
Rationale: A process consuming excessive CPU after software was
installed from an untrusted source is a potential indicator of malware.
The technician should first investigate and validate the process and
then use trusted security tools to determine whether it is malicious.
Immediately deleting files can destroy evidence or damage legitimate
software. Increasing RAM does not address a process that is
monopolizing CPU resources.
1
, 2. A Windows 11 computer displays a message stating that the
operating system cannot find a required boot device. The
technician confirms that the SSD is physically connected and
visible in UEFI firmware. Which of the following is MOST likely
to resolve a corrupted Windows boot configuration?
A. ipconfig /flushdns
B. bootrec or appropriate Windows recovery boot-repair tools
C. sfc /scannow from the normal desktop
D. netstat -ano
Answer: B. bootrec or appropriate Windows recovery boot-repair
tools
Rationale: Boot-related failures can result from damaged boot
configuration data or boot records. Windows Recovery Environment
provides tools such as boot-repair functionality and, where
appropriate, bootrec commands. ipconfig, netstat, and similar
networking commands do not repair the Windows boot process. sfc is
designed primarily to verify and repair protected system files rather
than directly reconstructing boot configuration.
3. A company wants to ensure that employees cannot install
unauthorized applications on corporate Windows computers.
Which configuration would BEST support this requirement?
A. Give all users local administrator privileges
B. Require standard user accounts and use application-control policies
C. Disable Windows Defender
D. Increase the page file size
Answer: B. Require standard user accounts and use application-
control policies
2
,Rationale: Standard user accounts reduce the ability of users to install
or modify software without authorization. Application-control
mechanisms can further restrict which applications are permitted to
execute. Giving users administrator privileges increases the attack
surface. Antivirus and virtual-memory settings do not directly enforce
application installation policies.
4. A user receives an email claiming to be from the company's IT
department. The message asks the user to click a link and
immediately enter their Microsoft account password to prevent
account suspension. The domain in the link is slightly misspelled.
What type of attack is MOST likely occurring?
A. Phishing
B. Shoulder surfing
C. Tailgating
D. Evil twin
Answer: A. Phishing
Rationale: Phishing uses deceptive communications to trick victims
into revealing credentials or performing malicious actions. A
suspicious sender, urgent language, credential request, and look-alike
domain are classic phishing indicators. Shoulder surfing involves
observing someone entering information, tailgating involves
unauthorized physical access, and an evil twin is a fraudulent wireless
access point.
5. A company is implementing a policy requiring employees to use a
password plus a security token when logging in. Which security
principle does this implement?
3
, A. Least privilege
B. Multifactor authentication
C. Data minimization
D. Network segmentation
Answer: B. Multifactor authentication
Rationale: Multifactor authentication requires authentication factors
from different categories. A password is something the user knows,
while a physical security token is something the user has. Combining
them provides stronger authentication than relying on a password
alone.
6. A technician suspects that a Windows computer has corrupted
system files. Which command should be used to scan protected
Windows system files and attempt repairs?
A. format
B. sfc /scannow
C. diskpart clean
D. taskkill
Answer: B. sfc /scannow
Rationale: System File Checker (sfc /scannow) examines protected
Windows system files and attempts to replace corrupted versions with
valid copies. format and diskpart clean can destroy data, while taskkill
terminates processes and does not repair system files.
7. A Windows workstation repeatedly crashes with a blue screen
shortly after a new device driver is installed. What is the BEST
initial troubleshooting action?
4
