CompTIA A+ Core 2 220-1202 PBQ Practice

Type the command that verifies the protected system files and replaces any corrupted ones.

Expected: sfc /scannow

Sfc /scannow is the System File Checker: it verifies the protected system files and replaces corrupted ones from the component store, and it must run as administrator. If it cannot repair them, DISM /online /cleanup-image /restorehealth repairs the store first and sfc runs again; chkdsk checks the filesystem, not the system files.

Type the command that checks the C: drive's filesystem and fixes the errors it finds (no bad-sector scan needed).

Expected: chkdsk C: /f

Chkdsk checks a volume's filesystem and /f fixes the errors it finds; on the system drive it schedules the check for the next boot. Chkdsk accepts the drive and the switch in either order. The /r switch also hunts for bad sectors and implies /f, but it is slow and this job did not call for it.

Type the command that clears the PC's DNS resolver cache so it looks the web server up again.

Expected: ipconfig /flushdns

Ipconfig /flushdns clears the resolver cache after a DNS change, so the next lookup asks the server and gets the new address; /displaydns shows what is cached. Ipconfig /release and /renew redo the DHCP lease, which does not touch cached names, and Windows accepts the switch as /flushdns or -flushdns.

Type the command that applies Group Policy now, reapplying every setting even if it looks unchanged.

Expected: gpupdate /force

Gpupdate applies Group Policy changes now instead of waiting for the refresh interval, and /force reapplies every setting even if it is unchanged. Gpresult /r only reports which policies applied; it changes nothing.

Type the command that restarts the PC immediately, with no countdown.

Expected: shutdown /r /t 0

Shutdown /r restarts, and /t 0 sets the countdown to zero so the restart is immediate; plain shutdown /r waits out a default delay, /s shuts down instead of restarting, and /a aborts a scheduled shutdown. The tool also accepts its switches with a dash, and /t 0 can come before /r, but the 0 must follow /t because it is the value of that switch.

One of the repair commands refuses to run and says you must be an administrator running a console session. What do you do?

1. Close the window and open Command Prompt with Run as administrator, then run the command again
2. Run the same command again until it succeeds
3. Restart the PC in Safe Mode and run it from there as the same standard user
4. Sign in with the Guest account and run it there

Expected: Close the window and open Command Prompt with Run as administrator, then run the command again

Commands that repair the system, such as sfc /scannow, need an elevated prompt: right-click Command Prompt and choose Run as administrator, and User Account Control asks for consent or an administrator's credentials. Repeating the command changes nothing, Safe Mode does not raise a standard user's rights, and the Guest account has the fewest rights of all.

Put the malware removal steps in order.

Items: Investigate and verify malware symptoms; Quarantine the infected system: disconnect it from the network; Disable System Restore in Windows Home; Remediate: update the antimalware software, then scan and remove in safe mode or a preinstallation environment; Schedule scans and run updates; Enable System Restore and create a restore point in Windows Home; Educate the end user

Expected: 1. Investigate and verify malware symptoms; 2. Quarantine the infected system: disconnect it from the network; 3. Disable System Restore in Windows Home; 4. Remediate: update the antimalware software, then scan and remove in safe mode or a preinstallation environment; 5. Schedule scans and run updates; 6. Enable System Restore and create a restore point in Windows Home; 7. Educate the end user

The order is investigate and verify, quarantine, disable System Restore, remediate, schedule scans and run updates, enable System Restore and create a restore point, then educate. Quarantine first stops the spread, the antimalware is updated before the scan so it catches current malware, and System Restore comes back only once the PC is clean so the new restore point is clean. Education comes last, because by then you know what to teach.

Why does System Restore get turned off before the cleaning?

1. Restore points can hold infected files, so a later restore would reinfect the PC, and the scanner cannot clean inside them
2. System Restore slows the scan down too much to finish
3. System Restore keeps the PC connected to the network
4. Turning it off frees disk space for the new definitions

Expected: Restore points can hold infected files, so a later restore would reinfect the PC, and the scanner cannot clean inside them

Restore points can contain infected files: left on, a later restore reinfects the machine, and the antimalware tool cannot clean inside them, so turning System Restore off deletes them. It has nothing to do with scan speed, the network connection, or disk space for definitions.

Pick every symptom that points to malware.

1. New toolbars appeared in the browser that nobody installed
2. Searches and typed addresses redirect to an unfamiliar site
3. The antivirus has been turned off and will not stay on
4. One pixel on the display stays lit in every picture
5. The printer reports that its toner is low

Expected: New toolbars appeared in the browser that nobody installed; Searches and typed addresses redirect to an unfamiliar site; The antivirus has been turned off and will not stay on

Toolbars nobody installed are the mark of a potentially unwanted program, redirection points to a hijacking extension, rogue proxy, or altered DNS or hosts file, and malware often turns off the antivirus to protect itself. A stuck pixel is a display hardware fault and low toner is a supply level; neither is a security symptom.

Put the technician's actions in the order of the troubleshooting method.

Items: Identify the problem: ask the user what changed a week ago and open Task Manager; Establish a theory: a new startup program or malware is eating resources; Test the theory: do a clean boot and run a full malware scan; Establish a plan of action: remove the startup item; Implement the plan; Verify full functionality: time the boot, have the user confirm the PC is fast again, and schedule regular scans as a preventive measure; Document the findings, actions, and outcome in the ticket

Expected: 1. Identify the problem: ask the user what changed a week ago and open Task Manager; 2. Establish a theory: a new startup program or malware is eating resources; 3. Test the theory: do a clean boot and run a full malware scan; 4. Establish a plan of action: remove the startup item; 5. Implement the plan; 6. Verify full functionality: time the boot, have the user confirm the PC is fast again, and schedule regular scans as a preventive measure; 7. Document the findings, actions, and outcome in the ticket

The method is identify the problem, establish a theory (obvious causes first), test it, establish a plan of action, implement it, verify full functionality with preventive measures, and document. Questioning the user and looking at Task Manager come before any change, the clean boot and scan test the theory before anything is removed, and timing the boot proves the fix before the ticket is closed.

These rows are from the PC's Task Manager. Pick every row that points to the cause.

1. Processes syncagent.exe CPU 95% Memory 210 MB
2. Processes Desktop Window Manager CPU 1% Memory 60 MB
3. Startup SyncAgent Enabled Startup impact: High
4. Startup Touchpad helper Disabled Startup impact: Low
5. Processes Settings CPU 0% Memory 12 MB

Expected: Processes syncagent.exe CPU 95% Memory 210 MB; Startup SyncAgent Enabled Startup impact: High

Degraded performance starts in Task Manager with the process using the CPU, memory, or disk, and with the startup programs: a process holding 95 percent of the CPU and an enabled startup item with high impact both point at the new sync tool. A system process at 1 percent, a disabled startup item, and a process at 0 percent are normal and explain nothing.

On another slow PC, Task Manager shows the disk at 100 percent nearly all the time. The PC has an old hard disk drive and no single process stands out. What is the best next step?

1. Check the drive's health for signs of failure, and consider replacing it with an SSD
2. Turn off Windows Update permanently
3. Lower the screen resolution
4. Add a second monitor

Expected: Check the drive's health for signs of failure, and consider replacing it with an SSD

A disk pinned at 100 percent with no single process to blame points at the drive itself: a failing drive is a cause of degraded performance, so check its health first, and an old hard disk is often simply too slow, which an SSD fixes. Turning off updates leaves security holes open, and the screen resolution and a second monitor have nothing to do with disk load.