CompTIA A+ · Domain 7 · 28% of the examCore 2 (220-1202) · Security
10 practice questions. Tap an option to check it, or open “Show answer” for the explanation.
1. A user's authenticator app shows a six-digit code that changes every 30 seconds, which she enters after her password. What kind of authentication is this?
Objective 2.1Show answerHide answer
Answer: B. A time-based one-time password (TOTP)
A TOTP is generated on the device from a shared secret and the current time, so it changes on a fixed interval. An SMS code is sent to the phone by text message rather than generated in an app.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
2. A folder is shared with Everyone: Full Control as the share permission, and the Sales group has only NTFS Read on the folder. A Sales user opens the folder over the network and tries to save a file. What happens?
Objective 2.2Show answerHide answer
Answer: C. She can open files but can't save, because the more restrictive of the share and NTFS permissions applies
Over the network, the effective permission is the most restrictive combination of share and NTFS permissions, which here is Read. Full Control on the share doesn't override a more restrictive NTFS permission.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
3. A company wants each employee to sign in to the Wi-Fi with their own directory username and password, so that access can be revoked for one person when they leave. What should be configured?
Objective 2.3Show answerHide answer
Answer: A. WPA3-Enterprise with 802.1X and a RADIUS server
Enterprise mode authenticates each user individually through a RADIUS server using 802.1X. WPA3-Personal uses one shared passphrase, so removing a single person means changing it for everyone.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
4. A user thinks someone who had access to her phone is tracking her location and reading her messages. A scan finds a hidden app she didn't install with permissions for location, SMS and the microphone. What type of malware is this?
Objective 2.4Show answerHide answer
Answer: D. Stalkerware
Stalkerware secretly monitors a person's location, messages and calls and sends them to someone else. Adware shows unwanted ads but doesn't covertly forward personal data.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
5. Accounts payable gets an email from the CFO's real company mailbox asking them to change a supplier's bank details before Friday's payment run. It later turns out an attacker had taken over the CFO's mailbox. What kind of attack is this?
Objective 2.5Show answerHide answer
Answer: B. Business email compromise (BEC)
BEC uses a compromised or impersonated business email account to redirect payments or data. Whaling targets an executive as the victim; here the executive's account is the tool used to defraud others.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
6. A technician has confirmed that a home-office PC shows malware symptoms. What is the next step in the recommended malware removal procedure?
Objective 2.6Show answerHide answer
Answer: C. Quarantine the infected system by disconnecting it from the network
The order is: investigate and verify, quarantine, disable System Restore (Windows Home), remediate, schedule scans and updates, re-enable System Restore and create a restore point, then educate the user. Disabling System Restore is a real step, but it comes after quarantine.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
7. After a USB stick found in the parking lot spread malware, the security team wants to stop removable media from automatically launching anything when it's inserted into Windows workstations. What should they configure?
Objective 2.7Show answerHide answer
Answer: A. Disable AutoRun and AutoPlay
Turning off AutoRun and AutoPlay stops inserted media from starting programs automatically. A firmware password protects boot and setup settings but does nothing about media inserted while Windows is running.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
8. A manager left his company phone in a taxi, and it can't be recovered. It holds company email and client contacts. What should IT do?
Objective 2.8Show answerHide answer
Answer: D. Send a remote wipe command through MDM
A remote wipe erases company data before anyone can get at it. Locating the phone is useful when recovery is possible, but this one can't be recovered, so waiting only leaves the data exposed.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
9. A company is retiring 40 SSDs that held customer records and won't reuse them. It needs proof that the data was destroyed. What is the most appropriate method?
Objective 2.9Show answerHide answer
Answer: B. Physically shred them using a vendor that provides a certificate of destruction
Shredding destroys the flash chips, and a certificate of destruction documents it. Degaussing only works on magnetic media and has no effect on the flash memory in an SSD.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
10. A coffee shop owner wants customers to have Wi-Fi without being able to reach the shop's point-of-sale terminals and office PC, which are on the same router. What should be configured?
Objective 2.10Show answerHide answer
Answer: C. A separate guest wireless network isolated from the internal LAN
A guest network keeps visitors on a separate segment that can reach only the internet. A hidden SSID is easy to discover and doesn't separate customer traffic from internal devices.
Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026
Original practice questions written from CompTIA’s published exam objectives, not real exam questions. CompTIA is a trademark of CompTIA, Inc.; this site isn’t affiliated with CompTIA.