220-1202 CompTIA A+ Core 2 (2026 Exam Update) Free Practice Exam Questions (2026 Updated)

When an iOS device approaches full storage capacity, performance can be significantly impacted. iOS requires a buffer of free space to perform background processes efficiently.

From theAll-in-One Exam Guide:

“iOS devices need several gigabytes of free space to maintain optimal performance. Near-full storage can cause sluggish operation and failures in updates or background tasks.”

Cryptominersexploit system resources to mine cryptocurrency, often without user consent, leading to high CPU and GPU usage.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Cryptomining malware can cause significant performance degradation by monopolizing system resources like CPU and GPU to mine digital currency.”

Windows Helloprovides alternative sign-in options including facial recognition, fingerprint scans, and PINs, reducing dependence on passwords.

FromAll-in-One Exam Guide:

“Windows Hello offers a range of biometric and PIN-based login methods designed to simplify access while enhancing security.”

“It can be used in place of a password, ideal for users who frequently forget credentials.”

The correct answer is A. Hashing, because hashing is specifically designed to verify file integrity and detect whether a file has been altered after its original creation or distribution. A hash is a fixed-length value generated by running a file through a hashing algorithm such as SHA-256 or SHA-1. Even a single-bit change in the file will produce a completely different hash value.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, hashing is commonly used to validate downloaded software by comparing the calculated hash of the downloaded file with the hash published by the vendor. If the two values match, the technician can be confident that the file has not been modified or tampered with.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide emphasizes that hashing ensures integrity, not confidentiality or authentication. SSL certificates secure data in transit, but they do not validate files after download. Plug-ins and extensions provide additional browser functionality but have no role in verifying file integrity.

The Mike Meyers / Mark Soper Lab Manual reinforces that hashing is a standard best practice in secure software deployment and malware prevention. It allows technicians to confirm that files are exactly as the publisher intended.

Because the requirement is to confirm that files have not been modified, hashing is the correct and most reliable method, making A the correct answer.

The correct answer is B. diskmgmt.msc, which opens the Disk Management console in Windows. Disk Management is the primary built-in tool used to create, delete, resize, and format disk partitions.

The Quentin Docter – CompTIA A+ Complete Study Guide explains that disk partitioning is commonly used to separate data for organizational, security, and backup purposes. Disk Management allows technicians to divide a single physical drive into multiple logical volumes, such as one partition for the operating system and another for user data.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide states that diskmgmt.msc provides a graphical interface for managing partitions, drive letters, file systems, and volumes without requiring third-party tools. This makes it the preferred and safest option for partitioning tasks on Windows systems.

The Mike Meyers / Mark Soper Lab Manual clarifies that tools like perfmon.msc monitor performance, lusrmgr.msc manages user accounts, and devmgmt.msc handles hardware devices. None of these tools can modify disk partitions.

Because the task specifically involves creating partitions, Disk Management is the correct and only appropriate tool, making B the correct answer.

This scenario is phishing delivered through a QR code (scan an image to reach a portal), which is best described as quishing . Quentin Docter defines phishing as a social engineering method where the attacker makes a message look legitimate and convinces the user to click a link to “correct” an account problem; after the click, the victim is taken to a site controlled by the attacker and asked for credentials. A QR code in a message is simply an alternate way to deliver that same malicious “link” without showing the URL clearly.

The Mike Meyers Lab Manual distinguishes related social engineering types: vishing is done by phone calls, and whaling targets high-level executives. Smishing is phishing delivered via SMS text messages, but the prompt specifically centers on scanning an image (QR-style workflow), not a text-message attack vector.

Docter also notes QR codes are commonly used in authentication workflows (for example, adding accounts to authenticator apps), which is why attackers mimic this behavior to make the scam seem normal. Therefore, QR-based phishing is best labeled quishing .

A corruptedMaster Boot Record (MBR)is a common issue after disk manipulation. Booting from installation media and using tools like bootrec to repair the MBR can resolve the problem.

Travis Everett – All-in-One Exam Guideexplains:

“A damaged MBR may result in the OS not loading. Booting from recovery or installation media and selecting startup repair or running bootrec commands can restore functionality.”

The correct answer is B. VNC . The key phrase is graphical interface access . VNC, or Virtual Network Computing, is a remote-control technology used to share and control graphical desktops. Quentin Docter’s Complete Study Guide explains that VNC is a remote control tool for desktop sharing, uses a client-server model, and allows remote control of the host where the VNC server is installed. The Mike Meyers/Mark Soper material also explains that SSH is excellent for command-line administrative tasks, but when full graphical desktop access is needed, a remote desktop application is required; VNC is identified as cross-platform and usable for remote graphical control. SSH provides secure command-line access, not a full graphical interface by default. WinRM is mainly a Windows remote-management technology. Telnet is an insecure text-based remote access protocol and should not be used for secure remote administration.

The question asks where to find ownership and business criticality details for a server. That type of “who owns it, what does it support, and how important is it” data is maintained in a Configuration Management Database (CMDB) as part of configuration/asset management. Quentin Docter discusses asset management as lifecycle tracking and emphasizes accountability, including assigning responsibility and tracking who is associated with assets.

The All-in-One guide similarly describes asset management databases as tracking details such as “who has the asset,” “what type of asset,” and “where this asset is located,” which supports the idea that ownership and operational relevance are stored in such systems.

An SLA defines service expectations, an SOP defines procedures, and an EULA covers licensing—none are intended to be the authoritative inventory/ownership record for a specific server. Therefore, CMDB is the correct answer.

The correct answer is A. Browser notifications . The clue is that the browser process appears in Task Manager when the ads appear, but the anti-malware scan finds nothing. This points to allowed browser push notifications rather than an installed malware infection. Quentin Docter’s Complete Study Guide explains that browser push notifications can be abused when a user is tricked into allowing notifications from a malicious site. The site can then push notifications to the operating system that look like system messages or advertisements. The guide also recommends periodically reviewing which sites are allowed to send notifications. A browser hijacker usually changes browser behavior such as search engines, home pages, or redirections. Browser cache stores website files but does not normally generate persistent malicious notifications. A remote access Trojan would involve unauthorized remote control, not simply browser-generated ad notifications with no malware scan result.

PXE (Preboot Execution Environment) allows workstations to boot over the network and download an OS image from a server. It is ideal for automating mass deployments using baseline images across many machines without the need for physical media.

A. An ISO is a disk image file but requires mounting or physical media.

B. Secure Boot is a security feature, not a method of deploying OS images.

C. USB requires manual installation and is not suitable for automated deployment at scale.

The first step in the IT change management process is to identify and propose the change. In this case, the technician notices a need (end-of-life network switches), so the appropriate action is to formally propose a change. This proposal would be documented and submitted for approval before any planning or implementation occurs.

According to the CompTIA A+ 220-1102 objectives under Operational Procedures (Domain 4.0), the change management process follows these typical steps:

Submit a change request (Propose the change)

Review and approval (Approve the change)

Planning and scheduling (Schedule the change)

Implementation

Documentation and review

Therefore, proposing the change is the correct first step in accordance with standard ITIL-based change management practices.

Because this is a government client with confidential data and a strict requirement to follow regulatory compliance, the best practice is to use a certified third-party destruction service that can provide documented proof of destruction. The All-in-One guide explicitly notes that “professional hard drive disposal services are third-party vendors” that guarantee drives are thoroughly destroyed by issuing a certificate of destruction/recycling, which provides assurance that data will not fall into the wrong hands. Mike Meyers’ Lab Manual repeats the same exam point: third-party vendors “will guarantee they have truly, thoroughly destroyed drives by issuing a certificate of destruction/recycling.”

Low-level formatting (often used to mean overwrite/zero-fill) can sanitize drives, but it may not satisfy the requirement for provable compliance and chain-of-custody documentation, especially for regulated environments. Targeted deletion is ineffective because deleted data can remain recoverable. In-house incineration is extreme and may be restricted, unsafe, or noncompliant without proper facilities and documentation. Therefore, Certified third-party destruction (B) is the best option.

The requirement is that vendor users can work only during certain times , which is enforced by setting logon-hour restrictions on the accounts. Quentin Docter explicitly describes this control under “Setting Time Restrictions,” stating: “Configure user accounts so that logins can occur only during times that the user can be expected to be working,” and explains that in Active Directory you can open the user account and click Logon Hours to configure permitted and denied hours. This directly matches option D.

Option C (account expiration) is useful for contractors, and Docter even notes account expiration is “best used on contractor accounts,” but that controls the end date of access, not daily working hours . Alerts (B) would only notify after the fact, and timeout policies (A) are about inactivity/session controls rather than restricting when logons are allowed. Mike Meyers also lists “login time restrictions” as an account management best practice, reinforcing that restricting logon times is a valid security control.

The correct answer is B. Restarting the print spooler from services, because the problem is isolated to one user and the print job is stuck or failed in the local print queue. This strongly indicates a print spooler service issue on the user’s workstation.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, the print spooler manages print jobs sent from applications to printers. If the spooler service hangs or becomes unstable, print jobs may fail even though network connectivity and the printer itself are functioning correctly.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that restarting the print spooler is a standard troubleshooting step when jobs remain in a failed or paused state. This clears the queue and reloads the service without requiring a full system reboot.

The Mike Meyers / Mark Soper Lab Manual reinforces that reinstalling printers should be done only after service-level troubleshooting has failed. Printing from another computer is unnecessary because other users are already printing successfully, confirming the printer and network are operational.

Because the failure is local to the user and visible in the queue, restarting the print spooler service is the most logical and efficient next step, making B the correct answer.

AVPN (Virtual Private Network)creates a secure tunnel between the clerk’s home device and the town server, ensuring private and authenticated access.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“VPNs are essential for remote access to internal resources, providing secure connections over public networks.”

The best tool is SSH (Secure Shell) because the scenario requires running command-line instructions on a remote network switch and capturing the text output. SSH provides a secure, encrypted remote terminal session (TCP port 22) that is commonly used to administer Linux/UNIX systems and networking equipment, making it ideal for switches that are typically managed through a CLI. Quentin Docter explicitly notes that ssh.exe launches the Secure Shell client and that it allows you to connect to a Linux/UNIX server or networking equipment, and he explains that SSH encrypts communications for secure text-console remote access. Mike Meyers’ Lab Manual reinforces that Telnet/SSH enable you to connect to a “server or fancy router” to run commands remotely, and that SSH is the secure modern alternative because the session is encrypted. The All-in-One guide also emphasizes SSH as the encrypted replacement for Telnet and highlights its use for remote command-line administrative tasks. By contrast, RDP and VNC are graphical remote-desktop tools, and WinRM is Windows-specific remote management rather than a standard switch-access method.

Event Viewer is the primary tool used to investigate system-level errors and logs, including BSODs. When a BSOD occurs, Windows logs the error codes and associated system behavior under “System” logs in Event Viewer. This allows the technician to review crash events, identify error codes (e.g., STOP codes), and pinpoint hardware or driver issues.

B. Performance Monitor is used for real-time performance tracking and trend analysis, not crash logs.

C. System Information displays system specs but not crash logs or events.

D. Device Manager shows device status and driver issues but doesn’t retain error logs related to BSODs.

When a Windows service suddenly stops and then fails to start manually, one of the first places to confirm why it cannot start is the service logon context. A very common root cause is that the account configured on the service cannot authenticate anymore—often because the password changed or the account is locked. Quentin Docter notes that if the service fails due to misconfiguration, “the most likely cause is the user account the service is configured to start with,” and you should ensure “the user account is not locked out.” This aligns with standard service troubleshooting: check Event Viewer (Service Control Manager events) for login failures, then validate the service’s Log On tab configuration and the account state.

The All-in-One guide also reinforces validating services via the Services console and correcting service settings when services fail to start.

Therefore, the best cause given the options is that the service account is locked out (C).