CompTIA A+ Core 2 practice test/Free questions
CompTIA A+ Core 2 · 40 free questions
CompTIA A+ Core 2 Practice Questions and Answers
Every free Core 2 question with its answer, the reason each wrong choice is wrong, and the page it rests on. Pick an answer to check yourself. The real exam passes at 700 on a 100 to 900 scale.
28% of Core 212 questions
CompTIA A+ Core 2 operating system questions
Installs and upgrades, Windows tools and commands, macOS and Linux, apps and cloud tools.
A user cannot copy a 6 GB video file to a USB flash drive, even though the drive shows 30 GB free. The drive is formatted FAT32. What is the cause?
Answer: A. FAT32 cannot store a single file larger than 4 GB
Microsoft's file system comparison lists a maximum file size of 4 GiB for FAT32, while NTFS and exFAT allow files far larger. Free space does not help when one file is over the limit. Reformatting the drive as exFAT (or NTFS for a Windows-only drive) fixes it. There is no small per-folder file cap, no extra driver for large copies, and Windows does not block video files on USB drives.
Objective: Microsoft Learn, File system functionality comparison: maximum file size, FAT32 4 GiB
A technician adds a new 4 TB data drive to a Windows PC. Disk Management only lets the technician use about 2 TB of it. What should the technician do?
Answer: D. Initialize or convert the disk with a GPT partition table
A master boot record (MBR) partition table cannot address more than about 2 TB, so the rest of a larger disk is unusable. Microsoft's support article on disks over 2 TB says MBR's 32-bit addressing stops at about 2.2 TB with 512-byte sectors, so larger disks must be initialized with GPT. Converting an empty data disk to GPT exposes the full 4 TB. FAT32 does not lift the MBR limit, more MBR partitions still stop at 2 TB, and cable length has nothing to do with capacity.
PC Health Check says an office PC cannot run Windows 11. It has a 64-bit 2 GHz quad-core CPU, 8 GB RAM and a 256 GB SSD. Which missing item most likely blocks the upgrade?
Answer: C. Trusted Platform Module (TPM) version 2.0
Microsoft's Windows 11 requirements list UEFI firmware with Secure Boot capability and TPM version 2.0 alongside the CPU, 4 GB RAM and 64 GB storage minimums. This PC meets the CPU, memory and storage figures, so a missing or disabled TPM 2.0 (often just switched off in firmware) is the likely block. Windows 11 needs a DirectX 12 compatible GPU, not a dedicated 4 GB card, and it needs neither a second NIC nor an optical drive.
Objective: Microsoft Learn, Windows 11 system requirements: TPM version 2.0, UEFI and Secure Boot
A small business wants full BitLocker drive encryption on a laptop that currently runs Windows 11 Home. What must change first?
Answer: B. Upgrade the laptop to Windows 11 Pro or Enterprise
Microsoft's BitLocker overview lists the editions that support BitLocker enablement: Pro, Enterprise, Pro Education/SE and Education. Home is not on that list, so the edition must be upgraded (an in-place upgrade keeps files and apps). There is no Store app that adds BitLocker to Home, the account type does not unlock the feature, and turning off Secure Boot weakens protection rather than enabling encryption.
Objective: Microsoft Learn, BitLocker overview: Windows editions that support BitLocker enablement
Windows shows errors that point to damaged system files after a failed update. Which command scans protected system files and repairs damaged ones?
Answer: B. sfc /scannow
System File Checker (sfc) with /scannow scans the integrity of all protected system files and repairs files with problems when possible, according to Microsoft's command reference. It must run from an elevated prompt. chkdsk /f fixes file system errors on a volume, not protected Windows files. gpupdate /force reapplies Group Policy, and ipconfig /flushdns clears the DNS resolver cache, so neither repairs system files.
An administrator changed a domain Group Policy setting and wants a workstation to apply it now, without waiting for the next refresh or a reboot. Which command should be run on the workstation?
Answer: A. gpupdate /force
gpupdate updates Group Policy settings, and the /force switch reapplies every policy setting, not only the ones that changed (Microsoft command reference). gpresult /r only reports which policies applied; it does not pull new ones. net user /domain lists domain accounts, and whoami /groups shows the signed-in user's group memberships. Those three help with diagnosis but do not apply the change.
Objective: Microsoft Learn, Windows Commands: gpupdate, /force
A technician must copy a user's D:\Projects folder tree to a new drive and keep the copy identical over time, including deleting files at the destination that no longer exist at the source. Which command fits?
Answer: D. robocopy D:\Projects E:\Projects /mir
Microsoft's robocopy reference describes /mir as mirroring a directory tree, the same as /e plus /purge. /e copies all subfolders and /purge deletes destination files that no longer exist in the source, so the copy stays identical. Be careful: pointed at the wrong destination, /mir deletes data there. copy does not copy whole folder trees, md only creates a folder and has no mirror switch, and move removes the source.
Objective: Microsoft Learn, Windows Commands: robocopy, /mir (equivalent to /e plus /purge)
A laptop moved to a different office network still shows its old IP address. Which pair of commands drops the old DHCP lease and requests a new one?
Answer: C. ipconfig /release, then ipconfig /renew
ipconfig /release releases the DHCP configuration for an adapter, and /renew requests a new one from a DHCP server (Microsoft command reference). That is the quickest fix for a stale lease after a move. /flushdns and /registerdns deal with DNS names, not IP leases. netstat shows connections and routes, and ping or tracert test reachability, so none of them gets a new address.
Objective: Microsoft Learn, Windows Commands: ipconfig, /release and /renew
On a Linux workstation, a script needs permissions so the owner can read, write and run it, while the group and everyone else can only read and run it. Which command sets this?
Answer: C. chmod 755 script.sh
The chmod manual says a numeric mode is built from octal digits, adding 4 (read), 2 (write) and 1 (execute). 7 = 4+2+1 for the owner and 5 = 4+1 for group and others, so 755 gives rwxr-xr-x. 644 removes execute for everyone, so the script will not run. chown changes the owner, not the permissions, and 777 lets anyone change the script, which is unsafe.
Objective: Linux man-pages, chmod(1): numeric mode, octal digits from 4, 2 and 1
A Linux administrator wants to see where the system keeps users' hashed passwords, which normal users must not be able to read. Which file is it?
Answer: B. /etc/shadow
The shadow(5) manual describes /etc/shadow as holding each account's encrypted password and password-ageing fields, and it is readable only by privileged users. /etc/passwd lists accounts and is readable by everyone, which is why the hashes moved out of it. /etc/hosts maps host names to IP addresses, and /etc/fstab lists the file systems to mount at boot.
Objective: Linux man-pages, shadow(5): encrypted password field
A Mac user wants extra protection so no one can read the startup disk's data if the laptop is stolen, without the user's login password or recovery key. Which macOS feature should be turned on?
Answer: A. FileVault
Apple's guide says turning on FileVault adds a layer of security by keeping someone from decrypting or getting to the Mac's data without the login password or recovery key. Time Machine makes backups, Spotlight searches files, and Mission Control arranges open windows and desktops. None of those three protects data on a stolen laptop.
Objective: Apple Support, Mac User Guide: Protect data on your Mac with FileVault
A company wants to keep using a Windows version after Microsoft's end-of-support date. What is the main risk?
Answer: C. It no longer gets security updates, so new vulnerabilities stay unpatched
Microsoft's lifecycle FAQ explains that once a Windows version reaches end of support, Microsoft stops providing security updates and technical help. The PC keeps working, but every newly found flaw stays open, and CompTIA lists EOL and unpatched systems among security vulnerabilities. Windows does not lock itself, convert files or disable drivers on the end date.
Objective: Microsoft Learn, Windows lifecycle FAQ: end of support means no more security updates
28% of Core 210 questions
CompTIA A+ Core 2 security questions
MFA and access control, Windows security settings, SOHO wireless, malware, social engineering and data destruction.
An authenticator app shows a new six-digit code every 30 seconds. What kind of one-time password is it, and why does the code change?
Answer: D. TOTP: the code comes from a shared secret plus the current time
RFC 6238 defines the Time-based One-Time Password (TOTP) algorithm. It derives the code from a secret shared by the app and the server plus the current time step, which defaults to 30 seconds. No network message is needed, which is why the app works offline. SMS codes arrive by text, HOTP advances with a counter on each use rather than the clock, and a fixed list of PINs is not a one-time password.
Objective: RFC 6238, TOTP: Time-Based One-Time Password Algorithm, section 4.1 (time step X = 30 seconds)
A coffee shop's Wi-Fi uses a shared password that customers sometimes guess. Which change gives the strongest built-in protection against offline password-guessing attacks?
Answer: D. Move the network to WPA3-Personal
The Wi-Fi Alliance says WPA3-Personal users receive increased protection from password-guessing attempts compared with WPA2. WPA2 with TKIP is weaker still, because TKIP is an older cipher that WPA2's AES replaced. Hiding the SSID and filtering MAC addresses are easy to get around, since both values are visible to anyone capturing the traffic.
Objective: Wi-Fi Alliance, Wi-Fi security: WPA3-Personal protection from password guessing
A company wants each employee to sign in to Wi-Fi with their own directory credentials instead of one shared key, checked by a central server. Which setup fits?
Answer: C. WPA2/WPA3-Enterprise with 802.1X and a RADIUS server
RFC 2865 defines RADIUS, which carries authentication, authorization and configuration information between a network access server (here the access point) and a shared authentication server. Enterprise Wi-Fi uses 802.1X to pass each user's own credentials to that server, so one account can be disabled without changing a key for everyone. Personal modes use one shared passphrase, and a captive portal on an open network does not encrypt the link.
Objective: RFC 2865, RADIUS: section 1, network access server and shared authentication server
Files on a shared drive suddenly have a new extension and will not open, and a note demands cryptocurrency for a decryption key. What type of malware is this?
Answer: B. Ransomware
Ransomware encrypts a victim's files and demands payment for the key. CISA's StopRansomware.gov is the US government's hub for ransomware prevention and response; the usual first moves are to isolate the affected system and restore from clean offline backups. Spyware quietly collects information, adware pushes unwanted ads, and a rootkit hides an attacker's presence. None of those three typically locks files and leaves a ransom note.
Objective: CISA, StopRansomware.gov: ransomware guidance and response checklist
An employee gets a text message saying their payroll account is locked, with a link to "verify" their login. What kind of attack is this?
Answer: A. Smishing
CISA describes smishing as a form of social engineering that exploits SMS, or text, messages, often with links that lead to credential-stealing sites. Vishing uses voice calls, whaling targets senior executives (usually by email), and tailgating is following someone through a secured door. The safe response is to open the payroll site directly and report the text, not tap the link.
Objective: CISA, Avoiding Social Engineering and Phishing Attacks: What is a smishing attack?
A web form passes whatever a user types straight into a database query. An attacker enters ' OR '1'='1 into the login box and gets in without a password. What attack is this?
Answer: A. SQL injection
OWASP describes a SQL injection attack as inserting a SQL query through the input data from the client to the application. The quote and OR '1'='1 make the login query always true. The fix is parameterized queries and input validation. Cross-site scripting injects script into pages other users see, brute force tries many passwords, and an on-path attack intercepts traffic between two parties.
Objective: OWASP, SQL Injection: insertion of a SQL query via client input
A technician has confirmed malware on a Windows 11 Home PC and has disconnected it from the network. According to the CompTIA malware removal steps, what comes next?
Answer: D. Disable System Restore so infected restore points are not kept
CompTIA's ten-step SOHO malware removal order is: investigate and verify, quarantine, disable System Restore (Windows Home), remediate (update anti-malware, then scan and remove, reimaging if needed), schedule scans and updates, enable System Restore with a new restore point, and educate the user. With quarantine done, disabling System Restore is next, so old restore points cannot bring the malware back. The other three choices are later steps.
A company's password policy forces a change every 60 days and demands one symbol, one number and one capital. Which change follows current NIST digital identity guidance?
Answer: C. Require long passwords and force a change only after evidence of compromise
NIST SP 800-63B-4 says verifiers shall not impose composition rules such as required character mixes and shall not require periodic password changes, but shall force a change when there is evidence of compromise. Length matters most, and password managers are encouraged. Shorter intervals and more symbol rules push users toward predictable patterns. Allowing very short passwords breaks the minimum-length rule, and the guidance also says passwords should be checked against lists of known-compromised values.
A company is retiring laptops with solid-state drives and plans to degauss the drives before recycling. Why is that a poor plan?
Answer: B. Degaussing does not reliably sanitize flash-based storage such as SSDs
Degaussing uses a strong magnetic field and works on magnetic media such as hard disk platters. NIST SP 800-88 says degaussing should never be relied on alone for flash memory-based storage, because SSDs store data electrically. For SSDs, use a vendor secure erase or cryptographic erase, or physical destruction such as shredding, and get a certificate of destruction from the vendor.
A standard user installs a program and Windows dims the screen and asks for an administrator's approval first. Which feature is doing this?
Answer: B. User Account Control (UAC)
Microsoft explains that when a user tries an action that needs administrative privileges, User Account Control triggers a prompt that asks permission to proceed. A standard user must enter an administrator's credentials. The firewall filters network traffic, EFS encrypts individual files, and BitLocker To Go encrypts removable drives. None of those three asks before a program installs.
Objective: Microsoft Learn, User Account Control overview: elevation prompt for administrative actions
23% of Core 27 questions
CompTIA A+ Core 2 software troubleshooting questions
Windows symptoms, mobile app and OS faults, and the signs of a security problem on a phone or PC.
A PC started showing blue screen (stop) errors right after the user installed a new graphics driver. What is the best first step?
Answer: A. Boot into Safe Mode and roll back or remove the new driver
Microsoft's stop-error troubleshooting guide reports that about 70% of crashes come from third-party driver code. A crash that starts right after a driver install points straight at that driver. Safe Mode loads only basic drivers, so the technician can roll back the driver in Device Manager. Replacing hardware or reinstalling Windows is premature, and defragmenting does nothing for driver crashes (and should not be used on SSDs).
Every HTTPS site on one laptop shows a certificate warning, while other computers on the same network open the same sites normally. What should the technician check first?
Answer: D. The laptop's system date and time
Every certificate carries a validity period, with notBefore and notAfter dates (RFC 5280). If the PC's clock is far off, valid certificates look expired or not yet valid on every site. That fits one laptop failing while others work. Fix the time (set it to sync automatically) and the warnings clear. Screen resolution, switch port speed and pop-up blocking do not affect certificate validation.
A user's browser home page changed to an unknown search site, and searches keep redirecting to ad pages. Nothing changed in the network. What is the most likely cause?
Answer: C. A malicious browser extension or browser hijacker
Changed home pages, swapped search engines and redirects to ad sites are classic signs of a browser hijacker, often installed as an extension or bundled software. CompTIA lists redirection and random pop-ups as browser-related security symptoms. Remove unknown extensions, reset browser settings and run an anti-malware scan. An offline DNS server stops pages loading rather than redirecting them, and a failing drive or router certificate would not swap the search engine.
Objective: CompTIA A+ 220-1202 objective 3.4: browser-related symptoms (redirection, random pop-ups)
A phone app freezes every time the user opens it, while other apps work normally. What should the technician try first?
Answer: C. Force close the app and reopen it, then update it if it still freezes
When one app misbehaves and the rest are fine, start with the least disruptive fix: force close the app, reopen it, and if needed restart the phone, update the app, or clear its cache. CompTIA lists apps failing to launch or close among mobile OS and application issues. A factory reset erases everything and comes last. A healthy battery and radios have nothing to do with a single app freezing.
Objective: CompTIA A+ 220-1202 objective 3.2: application fails to launch or close
After a user installed a free game from a third-party app store, their Android phone shows constant ads, drains its battery fast and uses unusual mobile data. What should the technician do?
Answer: B. Uninstall the game, scan the phone and allow apps only from the official store
CompTIA lists apps from unofficial app stores as a mobile security concern, and high ad counts, high network traffic and data-usage warnings as common symptoms of a malicious app. Removing the app, scanning with a mobile anti-malware tool and blocking unknown sources addresses the cause. A bigger data plan or brighter screen hides the symptoms, and developer mode adds risk.
A PC's clock keeps drifting several minutes out of sync with the domain, and users now get sign-in failures. Why does the drift matter?
Answer: A. Kerberos sign-in fails when a client's clock is too far from the domain controller's
Active Directory uses Kerberos, which checks timestamps to stop replay attacks. RFC 4120 assumes loosely synchronized clocks and rejects requests outside the acceptable clock skew, and Microsoft's recommended Kerberos tolerance is 5 minutes. Beyond that, ticket requests fail and users cannot sign in. Fix the time service so the PC syncs with the domain hierarchy. Clock drift does not spin down drives, Group Policy does not delete accounts for it, and DHCP does not check the time zone.
A Windows PC runs slowly. Task Manager shows memory use at 97% and one browser process using most of it. What should the technician do first?
Answer: D. End or restart the process using the memory and watch whether performance returns
Task Manager's Processes tab shows which program is using memory. When one process is using most of it, ending or restarting that program is the quickest test. If memory frees up and speed returns, the program (often a runaway tab or extension) is the cause. CompTIA lists low memory warnings and degraded performance as Windows OS issues. Defragmenting does not free RAM, nothing points at the motherboard, and disabling updates leaves the PC unpatched.
21% of Core 211 questions
CompTIA A+ Core 2 operational procedures questions
Change management, backups, safety, privacy and licensing, professionalism, scripting and remote access.
A company backs up fully every Sunday and runs incremental backups Monday through Saturday. The server fails on Thursday morning. Which backups are needed to restore everything?
Answer: D. Sunday's full backup plus the Monday, Tuesday and Wednesday incrementals
An incremental backup copies only what changed since the previous backup of any type. So the restore needs the last full backup and then every incremental after it, in order: Monday, Tuesday and Wednesday. A differential backup works differently: it holds every change since the last full, so only the full plus the latest differential would be needed. Skipping incrementals loses the changes from those days.
Objective: CompTIA A+ 220-1202 objective 4.3: full, incremental and differential backups
A small office wants a backup plan that survives a ransomware attack or a fire. Which plan follows the 3-2-1 rule?
Answer: C. Three copies of the data, on two types of media, with one copy offsite
CISA's data backup guidance spells out the 3-2-1 rule: keep 3 copies of any important file (1 primary and 2 backups), on 2 different media types, with 1 copy stored offsite. The offsite copy is what survives a fire or a ransomware attack on the office network. More backups on one drive, or several drives in one cabinet, still share a single point of failure, and one rarely tested copy is not three.
Objective: CISA, Data Backup Options: the 3-2-1 rule (3 copies, 2 media types, 1 offsite)
Before replacing a RAM module, what should a technician do to protect the components from electrostatic discharge?
Answer: B. Unplug the PC and wear a grounded ESD wrist strap
CompTIA's safety procedures call for ESD straps and mats, equipment grounding and disconnecting power before working inside a PC. A grounded wrist strap keeps the technician and the PC at the same potential, so no spark jumps to the module. A running PC is an electrical hazard. Carpet builds up static charge, and compressed air removes dust, not charge.
Objective: CompTIA A+ 220-1202 objective 4.4: ESD straps, ESD mats, disconnect power before repairing PC
A technician replaced a laptop's swollen lithium-ion battery. How should the old battery be handled?
Answer: A. Take it to a battery recycler or hazardous waste site, with the terminals taped
EPA guidance says lithium-ion batteries should always be recycled or taken to a household hazardous waste collection point, never put in household garbage or recycling bins. To prevent fires, tape the terminals or bag each battery separately. Puncturing a lithium-ion battery can start a fire, and keeping a swollen battery in a bag is a fire risk.
A technician needs to know how to clean up spilled toner powder and what to do if it gets in someone's eyes. Where is this information found?
Answer: A. The toner's safety data sheet (SDS, formerly MSDS)
Under OSHA's Hazard Communication Standard, chemical makers must provide a safety data sheet (SDS, the newer name for MSDS) covering hazards, first aid, spill cleanup, handling and disposal. Toner is a fine powder with handling instructions, so the SDS is the right place to look. A EULA covers software licensing, an AUP covers acceptable use of company systems, and driver notes cover software changes.
Objective: OSHA, Hazard Communication Standard (29 CFR 1910.1200): safety data sheets
A technician finds a still-running PC that may hold evidence of an insider attack. Which evidence should be captured first?
Answer: D. The contents of system memory (RAM)
RFC 3227 tells evidence collectors to go from the most volatile data to the least volatile. CPU registers, cache and RAM disappear when power is lost, so memory comes before disk. A disk image comes next and keeps for hours or days, while printed archives and floor plans do not change at all. Document each step to keep the chain of custody.
Objective: RFC 3227, Guidelines for Evidence Collection and Archiving, section 2.1: Order of Volatility
A technician removes a suspect's hard drive for an investigation. Why must every person who handles the drive be written down with times and reasons?
Answer: C. To keep a chain of custody so the evidence stays admissible
A chain of custody records who collected, handled and stored evidence, when and why. RFC 3227 says the record should let you describe exactly how the evidence was found, handled and everything that happened to it. Without it, the evidence may be challenged as altered and thrown out. Warranty, recycling and backup rotation have nothing to do with evidence handling.
Objective: RFC 3227, Guidelines for Evidence Collection and Archiving, section 4.1: Chain of Custody
A team plans to update the payroll server's software on Saturday night. Which part of the change request tells them how to get back to the working version if the update fails?
Answer: B. The rollback plan
CompTIA's change management steps include a rollback plan, a backup plan, sandbox testing, risk analysis, change board approval and end-user acceptance. The rollback plan says exactly how to undo the change and restore the previous working state. Scope describes what is changing, end-user acceptance confirms the result works for users, and change board approval authorizes the work. None of those three tells the team how to undo it.
A technician double-clicks a new PowerShell script (.ps1) on a fresh Windows 11 PC, and it will not run. A default security setting is blocking it. What is that setting?
Answer: B. The PowerShell execution policy
Microsoft's about_Execution_Policies page explains that PowerShell's execution policy controls whether script files may run. On Windows clients the default is Restricted, which allows individual commands but no scripts. A technician can run the script once with a scoped bypass or set RemoteSigned for the user, then confirm the script is trusted. The firewall filters network traffic, UAC handles elevation prompts, and BitLocker protects drives.
Objective: Microsoft Learn, about_Execution_Policies: Restricted is the default for Windows clients
A firewall rule must allow Remote Desktop to an office PC that uses default settings. Which port does Remote Desktop Protocol listen on?
Answer: A. TCP 3389
Microsoft's documentation says Remote Desktop listens on port 3389 by default. Port 22 is SSH, 5900 is the usual VNC port, and 443 is HTTPS. Opening 3389 straight to the internet invites brute-force attacks, so remote access should go through a VPN or Remote Desktop Gateway, with multifactor authentication.
Objective: Microsoft Learn, Change the listening port for Remote Desktop: port 3389 by default
A frustrated customer explains a laptop problem and keeps repeating details. What should the technician do to show active listening?
Answer: D. Let the customer finish, then restate the problem to confirm it
CompTIA's professionalism objectives say to actively listen and avoid interrupting, to clarify customer statements by restating the issue or asking open-ended questions, and to avoid dismissing customer issues. Restating the problem shows the customer they were heard and catches misunderstandings before work starts. Interrupting, looking at a phone and brushing the problem off all damage trust.
Objective: CompTIA A+ 220-1202 objective 4.7: actively listen, avoid interrupting, clarify customer statements
Keep practicing
Time yourself on the same questions, then learn the commands and procedures the exam asks about.