220-1202 Sample Questions Answers

MDM hardening often includes enforcing stronger authentication on mobile devices. The phrase “unique to each user” points to something inherent to the individual—biometrics—rather than something the user knows (password/pattern) or something they have (PIV/smart card). Quentin Docter explains: “Biometric devices use physical characteristics to identify the user. This type of authentication is considered something that you are,” and lists common implementations including “fingerprint… scanners.” This exactly matches a fingerprint, which is unique per person and commonly enforced via device policies in MDM environments.

Docter also notes mobile devices increasingly implement biometrics for access control, specifically citing “fingerprint access control” adopted by manufacturers. A drawn pattern and a password are knowledge factors and can be shared/observed, while a PIV card is a possession factor (something you have) and can be lost or loaned. Because the question specifies a hardening technique “unique to each user,” the best match is the biometric factor: fingerprint (B).

A “central log-in” means users can authenticate using a centralized account database rather than separate local accounts on each PC—this is a core feature of a Windows domain . Mike Meyers explains that a Windows domain makes it easy for anyone with a domain account to log on to any computer in the domain with a single account , a process called “single sign-on (SSO),” and that users do not need a separate local account stored on every computer. The All-in-One guide reinforces the same: in a domain, the domain controller stores domain accounts and “a user logging on to any computer on the domain may use their one domain account to log on to the entire network.”

Active Directory is the directory service commonly used to implement domains, but the question asks what is required for centralized logon on the workstation side— the computer must be joined to the domain (domain membership). Workgroups use only local accounts, and Local Group Policy Editor manages policies locally, not centralized authentication.

An MSDS providessafety and emergency procedures, such as what to do if a battery leaks or catches fire. It is not a technical or setup guide.

FromTravis Everett – CompTIA A+ All-in-One Exam Guide:

“An MSDS contains safety information, including handling, storage, and emergency procedures related to potentially hazardous components like UPS batteries.”

The correct answer is A. gpedit.msc, which opens the Local Group Policy Editor. Group Policy allows administrators to configure and enforce security-related settings, including screensaver timeout, password protection, and automatic locking, across systems or user accounts.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, Group Policy is commonly used to enforce security policies such as inactivity timeouts, especially in departments handling sensitive data like finance or HR.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that screensaver timeout settings can be configured under User Configuration → Administrative Templates → Control Panel → Personalization, ensuring systems lock automatically after a defined period of inactivity.

The Mike Meyers / Mark Soper Lab Manual reinforces that tools like certmgr.msc manage certificates, devmgmt.msc manages hardware devices, and perfmon.msc monitors system performance. None of these tools control user security policies.

Because the requirement is to enforce a shorter screensaver timeout for security, Group Policy Editor is the correct and professional tool, making A the correct answer.

This is part of the user education step after a security incident to prevent future occurrences.

From Quentin Docter – Complete Study Guide:

“User education and awareness is a crucial part of preventing phishing attacks. After an incident, it is vital to train users on recognizing suspicious messages.” .

Because the gateway and internal file shares work, the device has basic network connectivity. The two symptoms that remain— certificate errors and authentication errors —share a very common underlying cause: incorrect system time. Quentin Docter explains that certificate problems often come from “ the proper setting of time and date ,” stating that “ The time on the host should always be checked along with the expiration of the SSL certificate.” If the clock is wrong, certificates can appear “not yet valid” or “expired,” triggering browser certificate warnings even when the site is fine.

Mike Meyers also ties time drift directly to authentication failures: “ All clocks—including those in computers—experience time drift… This clock drift can cause problems with time-sensitive applications and services (especially authentication services). ” That matches the exact scenario: apps show authentication errors while browsing shows certificate errors. Duplicate IP or DHCP “bad address” typically causes intermittent or total connectivity problems (which would likely break file shares), not specifically certificate/auth failures. Therefore, time drift is the best diagnosis.

AnNDA (Non-Disclosure Agreement)is used to ensure confidentiality of sensitive company information, especially when interacting with external parties.

FromQUENTIN DOCTER - COMPTIA A+ COMPLETE study GUIDE:

“An NDA ensures that confidential information is not disclosed to unauthorized individuals, especially important in external communications.”

The correct answer is C. RDP (Remote Desktop Protocol), because RDP is the default remote access technology for Windows servers. It allows technicians to remotely connect to the graphical desktop environment of a Windows server to verify services, logs, and system status.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, RDP is built into Windows operating systems and is commonly used by administrators to manage Windows servers and workstations. It provides full access to the desktop, making it ideal for checking whether services such as IIS (Internet Information Services) are running properly.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that while SSH is commonly used for Linux and network devices, Windows servers typically rely on RDP for administrative access. VNC is a third-party remote desktop solution and is not enabled by default on Windows systems.

The Mike Meyers / Mark Soper Lab Manual reinforces that SPICE is primarily used in virtualized environments and is not a standard Windows remote access tool.

Because the technician needs to verify a Windows web server’s operational status using a built-in method, RDP is the most appropriate and likely technology, making C the correct answer.

Authenticator apps (e.g., Microsoft Authenticator, Google Authenticator, Duo) often support push notifications. When the user logs in, the app sends a push to their mobile device, prompting the user to approve or deny the authentication request — a common and user-friendly form of multi-factor authentication (MFA).

A. Phone call verification is a separate method involving voice-based confirmation.

C. Hardware tokens generate one-time codes but do not send push notifications.

D. SMS sends a text message with a code — again, no push mechanism.

The correct answer is D. Connect a wrist strap to a metal frame, because this action directly prevents electrostatic discharge (ESD), which is one of the most common causes of accidental hardware damage during device disassembly. Even when a device is powered off, static electricity stored in the technician’s body can discharge into sensitive components such as RAM, CPUs, and system boards.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, the most effective way to prevent ESD is to equalize electrical potential between the technician and the device. An ESD wrist strap, when connected to a grounded metal surface such as a computer chassis, safely dissipates static electricity before it can damage components.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that while antistatic mats and bags are useful, they are secondary controls. The wrist strap provides continuous grounding throughout the repair process, whereas mats and bags only protect components when they are placed on or inside them.

The Mike Meyers / Mark Soper Lab Manual reinforces that working on plastic surfaces does not guarantee grounding, and placing components in antistatic bags is something done after removal, not immediately after powering down.

Therefore, once the device is turned off, the next and most important step is to connect a wrist strap to a metal frame, making D the correct answer.

This is likely arogue antivirusor scareware tactic. The user shouldnot click " OK " and instead check Windows Security (or third-party antivirus) status and ensure real-time protection is enabled.

FromMark Soper – Mike Meyers ' Lab Manual:

“Users should verify security center settings if receiving suspicious pop-ups. Clicking unknown software updates can install malware. It’s safer to validate protection through legitimate system tools.”

Antivirus/antimalware detection depends heavily on its definitions/signatures. If those are outdated, new malware variants may not be recognized. Quentin Docter explains that the “definitions database” is a core antivirus component and that its effectiveness depends on “the frequency of updates and the comprehensiveness of the database signatures.” He adds that new signatures are discovered frequently and added to the database, meaning stale definitions leave gaps.

Docter is also explicit that security software “is not perfect” and that malware may get around it, “especially a new threat (and especially if you haven’t updated your definitions lately).” That statement directly matches this scenario: the software exists, but it failed to detect the infection—most likely because the detection data wasn’t current.

The other answers don’t fit as well: folder permissions and user permissions can limit what malware can change, but they don’t explain why security software didn’t detect it. Port security relates to network access control, not local signature detection. Therefore, Outdated definitions (B) is the best explanation.

Shreddingphysically destroys the platters, making data recovery virtually impossible. It ' s more effective and accessible than degaussing or low-level formatting.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Physical destruction methods like shredding are the most secure options for ensuring data on failed drives cannot be recovered.”

An evil twin is a rogue wireless access point set up to mimic a legitimate Wi-Fi network. Unsuspecting users may connect to it, giving attackers the opportunity to intercept traffic, steal credentials, or install malware. The evil twin often uses the same SSID as the real network to fool users.

A. Stalkerware is spyware installed to track user activity, typically on personal devices.

C. Tailgating is a physical security breach involving unauthorized entry behind someone with access.

D. Shoulder surfing involves observing a person entering confidential data, such as PINs or passwords.

A zero-day vulnerability demands an emergency change to quickly secure the system, even if downtime is needed.

From Mike Meyers ' Lab Manual:

“Emergency changes bypass standard scheduling to quickly address critical vulnerabilities that pose immediate risks.” .

A low-level format (also referred to as a zero-fill or full format) writes over every sector on a storage device, effectively destroying the existing data and making recovery nearly impossible. Unlike degaussing, which renders the drive unusable, a low-level format maintains the integrity of the device, allowing it to be repurposed or reused.

A. Deleting partitions does not fully erase data; it only removes references in the partition table.

B. EFS (Encrypting File System) encrypts files but does not securely wipe them.

D. Degaussing destroys the magnetic structure of a drive, making it inoperable and not reusable.

Facial recognition is a biometric authentication method that ties access to a unique physical feature of the user. Unlike passcodes or pattern locks—which can be easily shared—facial recognition provides a more secure and non-transferable form of access. It also enhances user convenience and is widely supported by modern smartphones.

A. Pattern locks can still be shared and are less secure.

C. Device encryption protects data but does not prevent screen access if a passcode is shared.

D. Multifactor authentication typically applies to app or account access, not basic phone unlocking.

The correct answer is A. Check for malicious applications, because excessive data usage, device overheating, and rapid battery drain are classic indicators of mobile malware or spyware running in the background.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, malicious applications can continuously transmit data, mine cryptocurrency, or monitor user activity, all of which cause increased network usage and battery consumption—even when the device appears idle.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide emphasizes that the first step in mobile troubleshooting is identifying whether unauthorized or malicious apps are present. Reviewing installed applications and running a mobile security scan can quickly confirm the root cause.

The Mike Meyers / Mark Soper Lab Manual explains that disabling networks or enabling airplane mode only masks symptoms temporarily and does not remove malware. Factory resets are effective but should be used after confirming malware or if other remediation steps fail.

Because the symptoms strongly suggest malicious background activity, the most appropriate first action is to check for malicious applications, making A the correct answer.

The net use command in Windows is used to map (assign) a shared drive from the command line. The syntax typically looks like: net use X: \server\share where X is the drive letter and \server\share is the network path.

A. pathping tests network latency and packet loss.

B. nslookup is used for DNS troubleshooting.

D. tracert shows the route packets take to reach a destination — not for drive mapping.

When DHCP isn’t enabled, static IPs must be assigned manually, so the engineering team provides the IP details.

From Travis Everett – All-in-One Exam Guide:

“If DHCP is unavailable, technicians need the static IP configuration to connect devices to the network.” .

That browser warning with an “Advanced Options” bypass is a classic indicator of a certificate trust problem (expired, self-signed, wrong hostname, or untrusted CA). Quentin Docter explains that when “an untrusted SSL certificate is encountered, the web browser will alert you that the SSL certificate is not valid,” and the address bar may show “Not secure” even if you click through. Since this is an internal application, the correct fix is to ensure the site presents a valid certificate chain trusted by clients—i.e., install a proper SSL/TLS certificate (and ensure it matches the hostname). Docter also describes HTTPS (HTTP over SSL) and notes it uses PKI certificates to validate and encrypt communication.

Mike Meyers’ material reinforces that browsers rely on trusted root CAs and warns users when certificates are “expired” or not trusted. The All-in-One guide similarly states that public keys are delivered as digital certificates signed by a trusted CA, and certificate warnings often mean the site is misconfigured or potentially compromised.

Therefore, the technician should install a proper SSL/TLS certificate for the site (B).

An Acceptable Use Policy (AUP) outlines the rules and guidelines for employees or users regarding the appropriate use of company systems, resources, and internet access. It defines permitted and prohibited activities, helping to mitigate security risks and establish clear behavioral expectations.

B. MNDA (Mutual Non-Disclosure Agreement) deals with confidentiality, not usage guidelines.

C. DRM (Digital Rights Management) controls access to copyrighted content.

D. EULA (End User License Agreement) pertains to software licensing, not internal policies.

Credential managers or password vaults (e.g., Windows Credential Manager, KeePass, or LastPass) store passwords securely. The integrity of such tools heavily depends on the strength of the master password protecting the vault. If compromised, all saved credentials could be exposed. Therefore, setting a secure master password is crucial.

A. Login time restrictions are general user account settings, not specific to credential managers.

C. TPM is used more commonly for full disk encryption, not specifically required for password managers.

D. The lock screen protects general access but does not protect stored credentials alone.

A “utility failure” means the building’s AC power source has dropped out (blackout) or sagged severely, causing the workstation to lose power instantly and shut down. The best way to prevent an immediate shutdown during these events is an Uninterruptible Power Supply (UPS), which contains a battery and can continue supplying AC power long enough to keep the PC running briefly and allow a graceful shutdown. Mike Meyers’ Lab Manual states that a UPS “continues to supply AC power…during both brownouts and blackouts via a battery,” preventing the computer from instantly losing power when the utility fails. Quentin Docter likewise explains that UPS devices protect against “power sags and even power outages,” using stored battery energy so the administrator (or OS integration) can safely shut down rather than crash off.

A surge suppressor protects from spikes, not outages. A redundant PSU only helps if the PSU fails, and Docter notes it cannot keep a system running during a power outage. A line voltage regulator helps stabilize voltage but doesn’t provide power when utility power is absent.

The best answer is B because Linux, macOS, and Windows handle application installation differently, so the technician should use the correct tool or deployment method for each operating system. The A+ Core 2 objectives specifically include diverse OS environments, macOS application installation file types such as .dmg, .pkg, and .app , and Linux tools such as apt-get and yum . The Mike Meyers/Mark Soper material explains that macOS software may be installed from the App Store, a .dmg disk image, or a .pkg installer, while Linux commonly uses package-management tools and distro software stores. The All-in-One Exam Guide also emphasizes that package managers install and update software while handling dependencies, which is especially important in Linux. A single Windows batch script would not properly apply to macOS and Linux. Sending users to the manufacturer’s website bypasses organizational control, and manual installation on every system is inefficient and error-prone.

The user’s issue likely stems from amobile data restriction or cap, especially since uploads work on Wi-Fi but not cellular. Checkingdata usage limitswill help determine if mobile uploads are blocked.

FromAll-in-One Exam Guide:

“When data-intensive functions fail on mobile networks but not on Wi-Fi, it’s often due to data caps or metered connection limits.”

To work remotely without physically transporting a workstation, the user needs:

C. RDP (Remote Desktop Protocol): Allows graphical remote access to a Windows PC at the office.

D. VPN (Virtual Private Network): Establishes a secure tunnel to access the corporate network remotely, making the internal PC reachable.

A. SPICE is used in virtual machine environments and is not typically used for end-user remote desktop access.

B. SSH is a text-based remote access tool used mostly for Linux systems.

E. RMM (Remote Monitoring and Management) is used by IT administrators for support — not end-user remote access.

F. WinRM is used for Windows remote management via PowerShell, not for full desktop access.

User offboarding involves disabling the departing user ' s access to company systems and facilities. Two key tasks typically include:

Deactivating physical access credentials (e.g., key fobs or badges) to prevent unauthorized entry (B).

Suspending or disabling the user’s email account to prevent future use and to retain business communications (D).

A. Quarantining a hard drive is not standard unless malware or legal issues are involved.

C. Purging PII must follow legal retention policies; it ' s not typically an immediate offboarding task.

E. Disabling network ports may be relevant in some cases but is not a standard offboarding step.

F. Blocking MAC addresses is not typical unless the device is considered a security threat.

Standard Operating Procedures (SOPs) define the mandatory steps and expectations technicians must follow during support calls. This includes documentation standards such as logging user info, asset details, and issue descriptions in the ticketing system. Implementing SOPs ensures consistency and accountability.

A. SLAs define response/resolution times but not documentation practices.

B. Call categories organize types of issues but don ' t guide technician actions.

D. Knowledge base articles provide solutions to known problems but don ' t ensure proper ticket documentation.

Cryptominersexploit system resources to mine cryptocurrency, often without user consent, leading to high CPU and GPU usage.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Cryptomining malware can cause significant performance degradation by monopolizing system resources like CPU and GPU to mine digital currency.”

In the context of artificial intelligence, " hallucinations " refer to instances where an AI system generates information that is plausible-sounding but factually incorrect or entirely fabricated. This is a known limitation of large language models, including generative AI tools.

A. Data privacy refers to the protection of personal or sensitive data, not content accuracy.

C. Appropriate use relates to ethical and policy-based concerns, not factual correctness.

D. Plagiarism involves presenting someone else ' s work as your own — this situation is about accuracy, not ownership.

FAT32cannot support files larger than 4GB.NTFSsupports large file sizes and is compatible across Windows systems, making it the correct choice for transferring a 4.57GB file.

FromAll-in-One Exam Guide:

“NTFS is the preferred file system for large file transfers within Windows. FAT32 has a 4GB file size limit, which makes it unsuitable for modern use cases involving large files.”

The correct answer is B. SSID configuration, because controlling SSID visibility and behavior directly affects which wireless networks devices can see and attempt to join. In shared office environments, multiple Wi-Fi networks may be present, increasing the risk of users accidentally connecting to the wrong network.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, SSIDs define how wireless networks are advertised and discovered. By modifying SSID settings—such as disabling broadcast or restricting auto-join behavior—technicians can prevent devices from attempting to connect to unauthorized or unintended networks.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that MDM solutions often preconfigure approved wireless profiles. Adjusting SSID configuration ensures devices only recognize and connect to sanctioned networks, reducing accidental associations and security risks.

The Mike Meyers / Mark Soper Lab Manual clarifies that IP filtering, content filtering, and port forwarding are network traffic control mechanisms. They do not prevent a device from seeing or attempting to connect to nearby Wi-Fi networks.

Because the goal is to prevent accidental Wi-Fi access, not filter traffic after connection, modifying SSID configuration is the correct and most effective solution.

Inbox mail 1 -Account Locked- Phishing - Report email to Information Security

Inbox mail 2 -Share your feedback - Legitimate - Perform no additional actions

Inbox mail 3 –Employee orientation - Legitimate - Perform no additional actions

Inbox mail 4 –Security Update – Spam - Report email to Information Security

Inbox mail 5 –Interview - Legitimate - Perform no additional actions

—

This issue happens when Windows is hiding known file extensions. If extensions are hidden, the user may only be changing the visible name (for example, changing “Document” to “Document.xml”), while the real filename remains something like Document.xml.txt. Windows Explorer then displays “Document.xml,” but file properties still show the true type as Text Document (.txt) because the actual extension at the end is still .txt, and Windows determines file type by that extension. The fix is to show file extensions by turning off the “hide extensions” behavior—i.e., uncheck “Hide extensions for known file types” in File Explorer Options/View settings. Quentin Docter specifically calls out that “Hide Extensions For Known File Types” is commonly changed because seeing extensions is “really handy,” and shows steps to deselect “Hide File Extensions For Known File Types.” The All-in-One guide and Mike Meyers’ Lab Manual both reinforce that you toggle extensions by deselecting “Hide extensions for known file types.”

First Chat Response:When the user mentions setting up a new router, the best initial response to maintain a helpful and professional tone is:

> Select reply: " I am happy to assist you today. "

Second Chat Response:When the user states that they need to set up basic security settings:

> Select reply: " Is this the first router in your office? "

Third Chat Response:After learning it ' s a replacement router and the user is logged into the router ' s web page:

> Select reply: " The first thing you need to do is change the default password. "

Fourth Chat Response:For the response about password settings:

> Select reply: " Create a new password with an uppercase, a lowercase, and a special character. "

Fifth Chat Response:When the router prompts to reboot:

> Select reply: " Yes, reboot please. "

Study Guide Reference: The CompTIA A+ Core 2 guide highlights the importance of changing default credentials and using strong password policies, particularly in SOHO environments where routers are often targeted.

1st CLI Resolution

copy " C:\Program Files\Testing\msvcp100.dll " " User-PC02\C$\Windows\System32 " /v /y

2nd CLI Resolution

regsvr32 msvcp100.dll

Why These Are the Correct Choices (Exam Logic)

Why the COPY command is first

The error explicitly states MSVCP100.dll is missing

Other users can run the app → the DLL exists on another system

The fastest, least disruptive fix (preferred by CompTIA) is to:

Copy the known-good DLL into C:\Windows\System32

The /v switch verifies the copy, and /y suppresses prompts — both are enterprise-safe defaults

This restores the missing runtime dependency immediately.

Why REGSVR32 is second

After copying a DLL, Windows may not recognize or properly load it

regsvr32 registers the DLL with the operating system

This ensures:

The Testing application can properly call the runtime library

The fix persists after reboot

Host 2, Host 3, Host 4 , Host 5 ,Host 6, Host 7, Host 8 , Media Server - Stop All unwanted and malicious service (Persistance.j1zpxn Installer Service) from all the listed host and Media servers

Refer screenshot below on the required service started/stopped on host2, same service to be started and stopped across all host servers.

A screenshot of a computer AI-

A screenshot of a computer AI-

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig

Issue (drop-down)

Limited network connectivity

Why this matches:

“Internet Down” most commonly indicates the workstation has lost valid Layer 3 connectivity (bad/expired DHCP lease, APIPA address, wrong gateway, etc.). In CompTIA A+ terms, this aligns best with limited connectivity symptoms (can’t reach internet resources).

Resolution (drop-down)

Refresh DHCP

Why this is the most efficient fix:

If the client has:

an expired lease

an APIPA address (169.254.x.x) because DHCP failed

an incorrect IP/gateway from a bad lease

…then the fastest first remediation is to renew DHCP to obtain a correct IP address, default gateway, and DNS servers. This is a standard CompTIA A+ troubleshooting action (quick, low-risk, high-success).

Verify/Resolve (drop-down)

ipconfig

Why this is the correct verification tool:

ipconfig is the primary Windows CLI tool to:

check current IP settings (ipconfig /all)

release/renew DHCP (ipconfig /release and ipconfig /renew)

confirm you received a valid IP + gateway + DNS, which is required for internet access.

What you would do (mapped to those choices)

Using ipconfig to complete “Refresh DHCP” and confirm the fix:

Check current addressing

ipconfig /all

Look for:

Valid IPv4 (not 169.254.x.x)

Valid Default Gateway

DNS servers present

Refresh the DHCP lease

ipconfig /release

ipconfig /renew

Verify outcome

Run ipconfig again to confirm:

You now have a correct IP for the network

Default gateway is populated

If the gateway/DNS populate correctly, internet access typically returns.

Ticket #8675310

Issue: Limited network connectivity

Resolution: Refresh DHCP

Verify/Resolve: ipconfig /renew

For the Low priority ticket #8675310 (“A small yellow triangle appeared in the taskbar. I am no longer able to access network resources.”), the Windows yellow triangle on the network icon is the classic indicator of limited connectivity (often caused by a bad/expired DHCP lease, APIPA address, missing default gateway, or DNS info not being assigned).

Correct PBQ Selections (Ticket #8675310)

Issue

Limited network connectivity

Why (CompTIA logic):

That yellow warning triangle means the NIC is connected at Layer 2 (link is up), but the system likely doesn’t have valid Layer 3 config (IP/gateway/DNS), so it can’t reach network resources.

Resolution

Refresh DHCP

Why this is the most efficient fix:

When a Windows PC can’t access network resources and shows “limited connectivity,” the fastest, lowest-risk fix is to renew DHCP so the PC can pull:

a valid IP address

default gateway

DNS servers

This directly resolves the most common root cause behind that icon.

Verify / Resolve

ipconfig /renew

Why this is the correct verification/remediation command:

ipconfig /renew is the direct command to request a fresh DHCP lease. After renewal, the user should regain access to network resources if DHCP was the issue.

What this fixes (what you’d expect to see)

Before the fix, the attachment (Output.txt) in these PBQs typically shows symptoms like:

169.254.x.x (APIPA) → DHCP failed

Missing/blank Default Gateway

DNS not present or incorrect

After ipconfig /renew, you should see a normal private IP (like 192.168.x.x / 10.x.x.x / 172.16-31.x.x) and a valid gateway/DNS.

The completed configuration:

1. Wireless AP (LAN side)

1. LAN IP: 192.168.10.1

2. Encryption: WPA2 PSK

2. Router (port-forward rule)

1. Allow TCP Any 3389

This forwards inbound RDP traffic (TCP/3389) from the Internet to the Windows PC, enabling Remote Desktop access.

3. Firewall (screened subnet side)

1. LAN IP: 10.100.0.1

4. Device placement

1. PC: place behind the router (where the port-forward rule points).

2. Game console: place on the Wireless AP (so it can use chat and extra services over WPA2 PSK).

3. Firewall: place in front of the screened subnet (with its 10.100.0.1 IP facing that subnet).

The Windows PC is placed in the screened subnet (behind the firewall) for enhanced security. Remote access to this PC requires port forwarding of TCP port 3389 (RDP), which is correctly configured through the router.

The Game Console is placed on the Wireless AP LAN, using WPA2 PSK for a secure wireless connection. Game consoles typically use peer-to-peer chat and online services that require open access without firewall restrictions, which is why the console is not placed behind the firewall.

CompTIA A+ 220-1102 Reference Points:

Objective 3.4: Given a scenario, implement best practices associated with data and device security.

Objective 2.4: Given a scenario, use appropriate tools to support and configure network settings.

Study Guide Reference: CompTIA A+ Core 2 guides recommend using screened subnets (a type of DMZ) for systems needing controlled external access, such as remote desktops, while placing gaming and media devices on less restricted networks for full functionality.

When defaults are too permissive across multiple Windows workstations, the most efficient and scalable fix is to enforce a standardized security baseline using Group Policy. The All-in-One guide explains that Windows provides extensive “security features” such as requiring complex passwords, limiting logon times, and controlling whether users can install applications—“and the list goes on to thousands of security features.” It states that “To configure these features, you use group policies,” and that you configure them using the Group Policy Editor (gpedit.msc).

This directly matches the scenario: repeated unauthorized attempts suggest the need to tighten multiple security settings consistently. While enabling account lockout policies (D) is one good control, the question is broader—“default security settings may be too permissive”—so the best action is to implement the overall appropriate group policy that can include lockout, password complexity, auditing, and other controls together. Updates and password resets are useful, but they don’t systematically correct permissive baseline settings across systems. Therefore, implementing an appropriate group policy is the best answer.