CompTIA A+ Core 2 (220-1202) Practice Exam
Questions And Correct Answers (Verified
Answers) Plus Rationale 2026 Q&A | Instant
Download Pdf
1. A user reports that their Windows 11 PC is slow and shows high disk usage at 100% in
Task Manager. Which built-in tool should the technician use FIRST to diagnose disk activity?
• A) Performance Monitor
• B) Resource Monitor
• C) Disk Cleanup
• D) Event Viewer
Answer: B
Resource Monitor (resmon.exe) shows detailed per-process disk I/O, read/write speeds, and file
access.
2. Which Windows 11 feature allows a technician to remotely assist a user by viewing their
screen and controlling their PC with permission?
• A) Remote Desktop
• B) Quick Assist
• C) Remote Assistance
• D) TeamViewer
Answer: B
*Quick Assist is Microsoft's built-in remote assistance tool for Windows 10/11, replacing
Windows Remote Assistance.*
3. A user accidentally deleted a critical file from their desktop. The Recycle Bin has been
emptied. What is the FIRST step to attempt recovery?
,• A) Use System Restore
• B) Use a third-party file recovery tool (e.g., Recuva) before writing new data
• C) Restore from Windows Backup
• D) Reinstall Windows
Answer: B
After emptying Recycle Bin, file recovery software can still recover data if the sectors haven't
been overwritten.
4. Which of the following malware types replicates itself without user interaction and
spreads across networks?
• A) Trojan
• B) Worm
• C) Ransomware
• D) Rootkit
Answer: B
Worms self-replicate and spread automatically via network shares or vulnerabilities; trojans
require user action.
5. A technician is configuring a SOHO router. They want to block access to social media
websites by domain name. Which feature should they use?
• A) Port forwarding
• B) MAC filtering
• C) DNS filtering / content filtering
• D) DMZ
Answer: C
DNS or content filtering blocks domains by category or custom blacklist. Port forwarding is
unrelated.
, 6. Which Windows command-line tool is used to display and modify network routes?
• A) netstat
• B) route
• C) ipconfig
• D) nslookup
Answer: B
The route command displays/manipulates the IP routing table. netstat shows connections,
ipconfig shows IP settings.
7. A user's Windows PC takes a very long time to boot. The technician suspects too many
startup programs. Which tool is used to disable startup items in Windows 10/11?
• A) MSCONFIG (System Configuration) or Task Manager > Startup
• B) Regedit
• C) Services.msc
• D) GPEDIT.msc
Answer: A
*Task Manager (Windows 8/10/11) and System Configuration (msconfig) both manage
startup programs.*
8. Which of the following is an example of a "shoulder surfing" attack?
• A) An attacker uses a keylogger to capture passwords
• B) An attacker looks over a user's shoulder to see their PIN
• C) An attacker sends a phishing email
• D) An attacker uses a USB drop attack
, Answer: B
Shoulder surfing is a physical social engineering attack where the attacker visually spies on
the user.
9. A technician needs to securely dispose of several SSDs containing sensitive data. Which
method is considered most secure and physically destructive?
• A) Quick format
• B) Degaussing (not effective on SSDs)
• C) Shredding / physical destruction
• D) Overwriting with zeros three times
Answer: C
SSDs have wear leveling and overprovisioning – physical destruction (shredding, crushing) is
the only guaranteed method.
10. Which Windows feature creates a restore point before installing new drivers or updates?
• A) File History
• B) System Restore
• C) Backup and Restore (Windows 7)
• D) Reset this PC
Answer: B
System Restore automatically creates restore points before changes, allowing rollback of
system files and settings.
11. A user receives an email claiming to be from their bank asking them to click a link to
verify their account. The email has spelling errors and the sender's domain is slightly
misspelled. This is an example of:
• A) Spear phishing
Questions And Correct Answers (Verified
Answers) Plus Rationale 2026 Q&A | Instant
Download Pdf
1. A user reports that their Windows 11 PC is slow and shows high disk usage at 100% in
Task Manager. Which built-in tool should the technician use FIRST to diagnose disk activity?
• A) Performance Monitor
• B) Resource Monitor
• C) Disk Cleanup
• D) Event Viewer
Answer: B
Resource Monitor (resmon.exe) shows detailed per-process disk I/O, read/write speeds, and file
access.
2. Which Windows 11 feature allows a technician to remotely assist a user by viewing their
screen and controlling their PC with permission?
• A) Remote Desktop
• B) Quick Assist
• C) Remote Assistance
• D) TeamViewer
Answer: B
*Quick Assist is Microsoft's built-in remote assistance tool for Windows 10/11, replacing
Windows Remote Assistance.*
3. A user accidentally deleted a critical file from their desktop. The Recycle Bin has been
emptied. What is the FIRST step to attempt recovery?
,• A) Use System Restore
• B) Use a third-party file recovery tool (e.g., Recuva) before writing new data
• C) Restore from Windows Backup
• D) Reinstall Windows
Answer: B
After emptying Recycle Bin, file recovery software can still recover data if the sectors haven't
been overwritten.
4. Which of the following malware types replicates itself without user interaction and
spreads across networks?
• A) Trojan
• B) Worm
• C) Ransomware
• D) Rootkit
Answer: B
Worms self-replicate and spread automatically via network shares or vulnerabilities; trojans
require user action.
5. A technician is configuring a SOHO router. They want to block access to social media
websites by domain name. Which feature should they use?
• A) Port forwarding
• B) MAC filtering
• C) DNS filtering / content filtering
• D) DMZ
Answer: C
DNS or content filtering blocks domains by category or custom blacklist. Port forwarding is
unrelated.
, 6. Which Windows command-line tool is used to display and modify network routes?
• A) netstat
• B) route
• C) ipconfig
• D) nslookup
Answer: B
The route command displays/manipulates the IP routing table. netstat shows connections,
ipconfig shows IP settings.
7. A user's Windows PC takes a very long time to boot. The technician suspects too many
startup programs. Which tool is used to disable startup items in Windows 10/11?
• A) MSCONFIG (System Configuration) or Task Manager > Startup
• B) Regedit
• C) Services.msc
• D) GPEDIT.msc
Answer: A
*Task Manager (Windows 8/10/11) and System Configuration (msconfig) both manage
startup programs.*
8. Which of the following is an example of a "shoulder surfing" attack?
• A) An attacker uses a keylogger to capture passwords
• B) An attacker looks over a user's shoulder to see their PIN
• C) An attacker sends a phishing email
• D) An attacker uses a USB drop attack
, Answer: B
Shoulder surfing is a physical social engineering attack where the attacker visually spies on
the user.
9. A technician needs to securely dispose of several SSDs containing sensitive data. Which
method is considered most secure and physically destructive?
• A) Quick format
• B) Degaussing (not effective on SSDs)
• C) Shredding / physical destruction
• D) Overwriting with zeros three times
Answer: C
SSDs have wear leveling and overprovisioning – physical destruction (shredding, crushing) is
the only guaranteed method.
10. Which Windows feature creates a restore point before installing new drivers or updates?
• A) File History
• B) System Restore
• C) Backup and Restore (Windows 7)
• D) Reset this PC
Answer: B
System Restore automatically creates restore points before changes, allowing rollback of
system files and settings.
11. A user receives an email claiming to be from their bank asking them to click a link to
verify their account. The email has spelling errors and the sender's domain is slightly
misspelled. This is an example of:
• A) Spear phishing
