A customer’s smartphone has been overheating frequently and becoming unresponsive since installing an OS update. A technician has already performed a soft reboot of the device. Which of the following should the technician perform NEXT? (Choose two.)

Roll back the OS update
Update the PRL
Force stop running applications
Enable airplane mode
Perform a factory reset
Run application updates
Reset network settings

Answer(s): A,F

Show Answer Next Question

QUESTION: 42

Joe, a user, cannot read encrypted email messages on a corporate smartphone, but he has been able to read them in the past. A technician restarts Joe's smartphone, but the issue remains. The technician deletes the corporate email account and has Joe re-add it, verifying all settings are correct. Despite these steps, the issue persists.

Which of the following is MOST likely causing the issue?

The certificate is expired.
The TPM is bad.
The phone is not encrypted.
The incorrect mail server is selected in settings.

Answer(s): A

Show Answer Next Question

QUESTION: 43

A user moves a file from one NTFS disk to another NTFS disk. Which of the following describes the changes to the file permissions?

The file has both the source and destination permissions
The file keeps the source permissions
The file permissions have to be set manually
The file receives the destination permissions

Answer(s): D

Show Answer Next Question

QUESTION: 44

A technician has enabled port security on a switchport.

Which of the following BEST describes the effect this will have?

Devices must match a list of allowed MAC addresses before accessing the network.
Devices need to conform to the policies set forth by the MDM software.
Data loss prevention software will be monitoring for data exfiltration on the port.
A firewall is actively monitoring the network traffic using heuristic analysis.

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 14 of 64
Viewing questions 53 - 56 out of 701 questions

Post your Comments and Discuss CompTIA 220-1002 exam prep with other Community members:

Comments:

Name:

220-1002 Exam Discussions & Posts
220-1002 AI Verifications

anon on: March 04, 2025
Anyone use the free version to help them pass the test? Can't really afford the pdf version right now.
UNITED STATES

senan on: March 02, 2025
salam bu ne suallardi bele
AZERBAIJAN

HCipher on: February 12, 2025
i can certify for anyone planning to take the exam that these questions are up to date and representative of the actual exam, but i strongly urge you to read, and understand the material as comprehensively as you could ensuring you learned as best as you possibly could. before learning the dumps, as acquiring the certificate without any knowledge gained is a futile endeavor for your career progression and the likes
PORTUGAL

The Professor on: December 21, 2024
Passed the A+ today. Many of these questions are valid but be careful to read your questions first because the answer may change based on the conditions in the question
UNITED STATES

CompTIA on: December 03, 2024
These questions are valid but you can't rely on them. We do not use these questions no more. On god.
UNITED STATES

Jury on: April 10, 2024
i just passed my A+ core 2 today. 4 of my PBQ was exactly the same with this practice test. it6 is really worth understanding all the questions here. big help!! thank you so much!! Aiming for my Sec+ now before 601series expires in July
Anonymous

Marc on: March 14, 2024
This exam dumps is valid in US as of yesterday. I can say that it helped a lot with my exam. A lot of relevant topics.
UNITED STATES

Jacob on: February 12, 2024
This exam is one of the hardest ones. You cannot pass without using these exam dumps. Just an FYI to others, majority of these questions are in the exam.
Italy

GetGo on: August 11, 2023
It was pretty easy to pass this exam with the help of this exam dumps PDF. Free version is not complete. I paid for the full version with 50% sale.
Anonymous

AI Explanation - verified by User2893 on: August 05, 2026
Question 5:
Correct answer: No.
Azure virtual machines are an Infrastructure as a Service (IaaS) offering.

IaaS provides virtualized infrastructure, including VMs, disks, and networking. You manage the guest operating system and software installed on the VM.

PaaS provides a managed platform for deploying applications without managing the underlying VMs or operating systems. Examples include Azure App Service and Azure Functions.

Therefore, recommending PaaS would not satisfy a requirement to deploy Azure virtual machines. The answer key’s B — No is correct.
Los Angeles, United States

AI Explanation - verified by User9198 on: July 27, 2026
Question 30:
Question 30 asks which two are pillars of the AWS Well-Architected Framework.
Correct answers: B and E (Reliability and Operational Excellence).
Why:

The Well-Architected Framework has five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization.

Operational Excellence: how you run and improve your systems—monitoring, incident response, and evolving processes.

Reliability: the ability of a workload to recover from failures, maintain uptime, and scale as demand changes.

Why the others aren’t pillars:

Availability (A) is not a pillar name; it’s an outcome that relates to Reliability.

Scalability (C) isn’t a pillar name; scalability touches on Performance Efficiency.

Responsive design (D) is not a pillar in the Well-Architected Framework.

Busan, South Korea

AI Explanation - verified by sangeethasoftengg on: July 22, 2026
Question 43:
Question 43 is asking what must be built before using snippets to create region-specific unsubscribe footers.

Correct answer: A. Email templates

Why:

Snippets are reusable content blocks that you insert into email content, and they require an email template (or at least an email draft) to render.

You can store region-specific footers as snippets and include them in a template, but there would be nothing to render the snippet into without a template.

The other options aren’t prerequisites for using snippets:

- Tokens are placeholders you can use in templates/snippets, but you still need a template. - Segmentation determines who receives what, not whether you can use snippets. - Smart Lists are for grouping leads, not enabling snippet usage.
Tip: To implement per-region footers, create a snippet per region and insert them into an email template (potentially using segmentation or dynamic content to decide which snippet shows).
Coimbatore, India

AI Explanation - verified by User8587 on: August 10, 2026
Question 14:
Question 14: Yes — answer A is correct.
Synchronizing the on-premises Active Directory accounts to Azure Active Directory (now Microsoft Entra ID) helps minimize disruption when resources move to Azure.
Benefits include:

Users retain their existing usernames and passwords.

Existing accounts can be used to access Azure-based resources.

Administrators avoid manually recreating thousands of accounts.

The transition is less disruptive before the on-premises data center is retired.

This is typically implemented with Microsoft Entra Connect, which synchronizes identities from on-premises Active Directory to Microsoft Entra ID. Depending on the authentication configuration, users may also continue using their on-premises passwords for cloud sign-in.
Cape Town, South Africa

AI Explanation - verified by sophielargeaudproust on: July 26, 2026
Question 11:

Correct answer: D (Special category data)

Why:

- The system uses behavioral biometric data (typing speed, rhythm, pressure) to create a unique user profile. - When biometric data is used to uniquely identify individuals, it is treated as a special category data under privacy regimes like GDPR due to its sensitivity and impact on privacy. - Because this data can uniquely identify a person, it triggers higher safeguards and stricter processing requirements.

Quick notes:

- If the data were purely non-identifying or anonymized, the classification could be different, but here its purpose is to identify/authenticate a specific person. - Practical implications: ensure a lawful basis for processing, implement data minimization, strong security, and consider additional protections (e.g., explicit consent where required).
Saint-Priest, France

AI Explanation - verified by User3032 on: August 18, 2026
Question 15:
Question 15’s stated answer appears incorrect.
The requirement is to expose file metadata only and not store CSV contents. Selecting Combine Content creates a combined query from the CSV binaries, which imports the file data and violates the requirement.
The correct sequence should be conceptually:

Get Data ? Folder in Power BI Desktop.

In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.

Remove the Content column (and any other data columns you do not need).

The Folder connector returns a table containing metadata columns such as:

Name

Extension

Date accessed

Date modified

Folder Path

Attributes

Content

The Content column contains each CSV as binary data. Removing it ensures that only metadata is loaded into the dataset.
Why the answer key is problematic: it says to combine the Content column, but that action is specifically used to combine the actual CSV files, not merely their metadata.
Zurich, Switzerland

AI Explanation - verified by User9056 on: August 02, 2026
Question 19:
The correct choice is No (B).
Why:

The 99.99% availability SLA for VMs is achieved when you run VMs across two or more Availability Zones.

Two VMs in a single Availability Zone do not meet the 99.99% target (their SLA is lower, e.g., around 99.95% or less depending on configuration).

What to do to meet the goal with the minimum resources:

Deploy at least two VMs across two different Availability Zones (one VM in each zone, or both in two zones with a load balancer).

This provides the required zone redundancy and the 99.99% SLA.

Reference: https://docs.microsoft.com/en-us/azure/availability-zones/az-overview
Maramag, Philippines

AI Explanation - verified by User2560 on: July 26, 2026
Question 1:
Correct answers: A and B

Azure Resource Manager templates: Use ARM templates to define the VM infrastructure and baseline configuration as code. This ensures all Windows Server 2016 VMs are created with a uniform setup, minimizing manual configuration.

PowerShell Desired State Configuration (DSC) extension for Windows: DSC enforces a defined state across all servers and can automatically remediate drift. This keeps the VMs in the desired configuration with minimal ongoing admin effort.

Why not C? The Custom Script Extension runs scripts on a VM but doesn’t enforce or continuously maintain a uniform state across multiple VMs, so it’s less suitable for ongoing configuration management.
Chennai, India

AI Explanation - verified by User6887 on: July 21, 2026
Question 28:
Correct answer: D
Explanation:

CAPWAP (Control And Provisioning of Wireless Access Points) creates a tunnel between the AP and the Wireless LAN Controller over the IP network. The AP and WLC communicate via this CAPWAP tunnel, which can traverse Layer 2 or Layer 3 networks.

The AP does not have to be on the same switch as the WLC. It can connect to any switch in the network, as long as there is IP reachability between the AP and the WLC. This is why option D is correct.

The other options are incorrect:

- A: Connecting the AP to the wired network won’t inherently create a loop; loops are prevented by proper network design. - B: The AP does not need to be on the same switch as the WLC. - C: The AP does not need a direct copper link to the WLC.
Notes: CAPWAP uses UDP for control and data channels (commonly on ports 5246/5247) and is designed to allow centralized management across a distributed campus.
Thiruvananthapuram, India

AI Explanation - verified by User5321 on: July 21, 2026
So when you make the image on prem all you're really doing is making a vhd, then you upload that vhd and then add-azimage targetting that vhd after?
Yes, that’s the right mental model.

On-prem you generalize and capture the VM as a VHD.

Upload the VHD to Azure with Add-AzVhd.

Register the VHD as an image in Azure with Add-AzImage (or New-AzImage) so it appears as a selectable image.

Create new VMs from that image (e.g., with New-AzVM -Image ...).

So the flow is: VHD created on-prem ? upload via Add-AzVhd ? create/register image via Add-AzImage ? deploy VMs from that image. The exam answer for the upload step is Add-AzVhd, but you’ll typically follow with Add-AzImage to actually use it as an image.
Rotherham, United Kingdom

AI Explanation - verified by User9769 on: August 06, 2026
Question 9:
Correct answer: B — A reservation for the server based on its MAC address
A DHCP reservation permanently assigns the same IP address to a specific device by matching its MAC address. This is ideal for a file server because users and services need a predictable address, while the organization can continue managing addressing through DHCP.
Why the others are incorrect:

A separate scope using a /32 subnet: A /32 identifies one host, but it is not a practical DHCP scope for this purpose.

A static IP within the DHCP range: This can cause an IP address conflict if DHCP assigns that address to another device.

SLAAC: Used for automatic IPv6 address configuration, not for assigning a predictable IPv4 address through DHCP.

A reservation combines the benefits of centralized DHCP management with a consistent address for the server.
Morrow, United States

AI Explanation - verified by User8950 on: July 19, 2026
Question 12:
The correct answers are A and B.
Why:

A. Custom and standard objects have standard fields. True. Both object types include standard fields (for example, CreatedDate, LastModifiedDate, Owner). Custom objects also have the Name field, which is a standard field on all objects.

B. Standard objects are included with Salesforce. True. Standard objects (like Account, Contact, etc.) come with Salesforce out of the box.

C. A new standard object can be created. False. You can create custom objects, but you cannot create new standard objects.

D. Only standard objects support master-detail relationships. False. Master-detail relationships can be used with both standard and custom objects.

Kolhapur, India

AI Explanation - verified by User5015 on: July 22, 2026
Question 10:
Question 10 asks if migrating all VMs to an Azure pay-as-you-go subscription uses the “elastic expenditure model.”
Here’s the right way to think about it:

In Azure, the typical cost approach for pay-as-you-go VMs is an Operational Expenditure (OPEX) model. You’re billed for actual usage each month.

The term “elastic expenditure model” isn’t a standard Azure cost category. Elasticity describes scaling capacity, not the billing category itself.

So recommending the elastic expenditure model is not correct for this goal.

Conclusion:

The solution does not meet the goal. Answer: No (B).

Why this matters:

Pay-as-you-go aligns with OPEX because costs vary with usage.

Elasticity is about scaling resources, which affects performance and capacity, not the fundamental cost model.

If you want, I can compare this with the other questions in this set (11 and 12) to highlight how the correct expenditure models differ in each scenario.
San Antonio, United States

AI Explanation - verified by User8336 on: July 21, 2026
Question 22:

Answer: No.

Why: Microsoft Managed Desktop (MD) is a managed service for end-user desktops (Windows devices used by people), not a service for provisioning, managing, or lifecycle-managing large fleets of virtual machines. It won’t help automate weekly creation and deletion of many VMs, especially with mixed OS (Windows and Linux).

Relevant concept: To reduce administrative effort for rapidly provisioning and tearing down VMs, an Azure service like Azure DevTest Labs is appropriate. DevTest Labs lets you:

- Create lab templates from Windows and Linux images. - Automatically provision and delete VMs on a schedule or via self-service. - Apply cost controls and policies to manage waste. - Support mixed environments (Windows and Linux) and automate lifecycle tasks.

Takeaway: The proposed solution (MD) does not meet the goal; the correct approach is to use a lab-oriented service such as Azure DevTest Labs for frequent, ephemeral VM deployments.

San José, Costa Rica

AI Explanation - verified by User2066 on: August 03, 2026
Question 27:
My take: The correct option is B.
Why B is the right choice:

The problem describes the class updating field-level security on some profiles. To prevent updating fields that are not updateable for the current user, you should check each field’s updateability before making changes. Use DescribeFieldResult.isUpdateable() (e.g., via Field.describe() on each field) to guard updates.

Why the other options are less suitable:

A and D (With Sharing): Running a class with Sharing affects record visibility, not whether a field can be updated by a user. It doesn’t prevent updates to fields the user shouldn’t modify.

C (WITH SECURITY_ENFORCED in SOQL): This enforces FLS/FRC during queries, but it doesn’t control whether the Apex code updates fields or modifies permissions. It’s not addressing the update behavior directly.

Note: In practice you might combine With Sharing with per-field guards, but if choosing a single fix, IsUpdateable() is the core mechanism to stop updates to non-updateable fields.
Kolkata, India

AI Explanation - verified by nanrany on: July 30, 2026
Question 320:
The correct answer is A: Amazon Kendra.
Why:

Amazon Kendra is a managed enterprise search service that can index content stored in S3 and support natural-language queries to find text inside documents (PDFs, Word files, etc.).

Why the others aren’t suitable:

Rekognition analyzes images/videos, not document text search.

Polly is a text-to-speech service.

Lex is a chatbot service.

How to implement quickly:

Create a Kendra index.

Add a data source of type S3 and point it to your bucket (with an IAM role that allows access).

Configure/document conversion if needed, then index the data.

Use the Kendra API or console to run natural-language queries against your indexed documents.

Busan, South Korea

AI Explanation - verified by is.chan.army on: August 03, 2026
Question 50:
Question 50 explains a scenario where DoS/DDoS is suspected and the team uses manual techniques to detect it. The best command is:

Answer: C – netstat -an

Why:

netstat -an lists all active connections and listening ports with numeric addresses, without resolving names. This lets you spot DoS patterns such as a flood of connections to a specific port or many connections from a single or few IPs.

The other options don’t help as directly:

- netstat -r shows the routing table, not active connections. - nbtstat commands deal with NetBIOS name table (Windows local network info), not DoS traffic. - /c (clear) isn’t relevant to detection.
How to use in practice:

Windows: netstat -an and look for numerous ESTABLISHED connections to a service or many SYNs to a port.

Filter by port, e.g., netstat -an | findstr :80, or on Linux: ss -tunap | grep ':80'.

Limitations:

Netstat provides a snapshot. DoS detection often benefits from continuous monitoring, flow data, and IDS/IPS logs.

Tamarac, United States

AI Explanation - verified by sophielargeaudproust on: July 26, 2026
Question 97:
The correct answer is D.
Why: After deploying an AI model, documentation should capture the model's architecture, performance metrics, and updates. This supports transparency, reproducibility, and ongoing maintenance.
Why the other options are less appropriate as the core deployment documentation:

A (training data, hyperparameters, stakeholder feedback) focuses on training provenance; these details are important but are typically part of pre-deployment/training records, not the primary post-deployment documentation.

B (encountered issues, monitoring process, risks) relates to governance and monitoring rather than the core documentation you’d publish about the deployed model itself.

C (licensing information, the team, business goals) covers governance context but not the technical traceability and performance-based record needed for ongoing maintenance.

Saint-Priest, France

AI Explanation - verified by User5640 on: August 10, 2026
You have been tasked with making sure that users who connect to Azure AD via the internet from an unidentified IP address, are automatically encouraged to change passwords. Solution: You configure the use of Azure AD Identity Protection. Does the solution meet the goal?
Yes.
Azure AD Identity Protection can detect risky sign-ins, including sign-ins from unfamiliar or suspicious IP addresses. You can configure a sign-in risk policy to require remediation, such as:

Multi-factor authentication

A secure password change for users whose credentials may be compromised

The policy must be configured with the appropriate risk level and user scope. Identity Protection does not treat every unknown IP as automatically malicious; it evaluates the sign-in risk before applying the policy.
The service is now called Microsoft Entra ID Protection.
Sandton, South Africa

AI Explanation - verified by abccba on: August 07, 2026
Question 6:
Question 6: Answer A — Download and reinstall the VPN client configuration package.
A Point-to-Site (P2S) VPN client receives routing information in its VPN client configuration package. When the client package was originally downloaded, it contained the route for VirtualNetworkA, but not the newly peered VirtualNetworkB address space.
After creating the peering:

Download the updated VPN client configuration package from the Azure VPN gateway.

Remove or update the existing VPN client configuration on the Windows 10 workstation.

Install the new package and reconnect.

The updated client configuration includes the route needed to reach VirtualNetworkB.
The gateway-transit options in the other choices are not the appropriate fix in this scenario. Also, gateway transit normally involves configuring the gateway VNet to allow gateway transit and the peered VNet to use remote gateways; selecting only one setting would not complete that configuration.
Batley, United Kingdom

AI Explanation - verified by User6626 on: August 17, 2026
Question 3:
Question 3 tests GitHub Copilot data retention for Business and Enterprise accounts.
The page’s answer key says B and C:

B — Prompts and suggestions retained for 28 days

C — User engagement data kept for two years

However, the 28-day answer may be outdated. GitHub’s current privacy documentation has stated for some Business and Enterprise contexts that prompts and suggestions are not retained, while limited engagement/usage data may be retained for longer—commonly listed as up to two years.
So:

The key distinction is between content data—your prompts, code context, and generated suggestions—and engagement data, such as usage activity.

Do not confuse retention with training: enterprise Copilot data is generally not used to train GitHub’s models without appropriate authorization.

For a current exam, verify the policy version cited by the exam provider. The key’s C is likely correct, but B should be treated cautiously and may no longer reflect the current policy.

Pune, India

AI Explanation - verified by User9493 on: July 22, 2026
Question 14:
Question 14 asks how to obtain remote access to a network appliance that has failed to start up properly.

Answer: D) Out-of-band management

Why this is correct:

- When a device isn’t booting, in-band methods like SSH or a web GUI aren’t available because the OS isn’t up. - Out-of-band management uses a dedicated management interface (e.g., BMC/IPMI, iLO, DRAC) on a separate network path. This allows you to access the device’s console, view POST/BIOS output, and perform power cycling or recovery actions even if the main network path is down. - It provides remote console access, remote power control, and configuration recovery capabilities independent of the device’s primary OS.

Why the other options aren’t suitable here:

- Crash cart: physical presence required; not remote. - Jump box: a remote intermediary, but it still relies on the device being reachable and booted; not specifically for a startup failure. - Secure Shell: requires the device to be up and reachable over the network; not usable if it failed to start.
In short, use out-of-band management to recover or administer a device that won’t boot.
Essex, United States

AI Explanation - verified by User5866 on: August 10, 2026
Question 12:
Correct answer: B — Enabling data roaming
When traveling internationally, the phone may connect to a partner carrier for voice calls but keep cellular data roaming disabled. Email requires a data connection, so the user can call but cannot send or receive email.

Disabling GPS: Affects location services, not email connectivity.

Configuring 4G usage only: Does not enable international data access and could prevent connectivity if 4G is unavailable.

Connecting using a hotspot: Could provide data, but it is not the most direct solution and depends on another network or device.

Data roaming allows the phone to use cellular data through a foreign carrier’s network. It may incur additional charges, so users should check their carrier’s international plan.
Chicago, United States

AI Explanation - verified by User3634 on: July 23, 2026
Question 7:

Answer: A

Reason: The Standard web tier is the lowest tier that provides dedicated compute, built-in load balancing across instances, and sufficient storage to host multiple apps with custom domains. Basic may lack the required scalability/storage, while Free/Shared do not offer dedicated compute or proper load balancing.

Gurugram, India

AI Explanation - verified by User8251 on: August 03, 2026
Question 6:
The function you should use is Table.Profile (Power Query M).

Why: Table.Profile returns a per-column profile that includes statistics such as count, null count, distinct count, and standard deviation. It also provides min/max and average where applicable, which matches the requested metrics (Count, Average, Null count, Distinct count, Standard deviation).

Syntax: Table.Profile(table as table, optional additionalAggregates as nullable list) as table

How it helps: After running Table.Profile on your table, you can extract the per-column stats you need and display them in your semantic model or report.

Other options shown (Table.Schema, Table.View, Table.FuzzyGroup) do not provide the full column profiling statistics you need.
Bengaluru, India

AI Explanation - verified by User4280 on: July 22, 2026
Question 6:
Question 6 asks how TCP and UDP establish a connection between two endpoints.
Correct answer: A — TCP uses the three-way handshake, and UDP does not guarantee message delivery.
Why:

TCP is connection-oriented. It establishes a connection before data transfer using a three-way handshake (SYN, SYN-ACK, ACK), enabling reliable delivery, ordering, and flow control.

UDP is connectionless. It sends datagrams without a prior connection and provides no guarantee of delivery, order, or protection against duplicates; any reliability is up to the application.

Why the other options are incorrect:

B incorrectly states UDP uses acknowledgment packets; UDP has no built-in ACKs.

C wrongly claims UDP provides reliable transfer and that TCP is connectionless.

D misstates framing bits; neither protocol uses the listed TCP/UDP handshake bits in frames.

Takeaway: TCP = reliable, connection-oriented with a handshake; UDP = best-effort, connectionless.
San Luis Obispo, United States

AI Explanation - verified by User1509 on: August 07, 2026
Question 103:
Question 103 is a VPN configuration simulation. The required settings are:

Strongest encryption algorithms: Choose the strongest available encryption and integrity options, typically AES with the largest key size and a secure integrity algorithm.

Encrypt all traffic: Select tunnel mode rather than transport mode. Tunnel mode encrypts the entire original IP packet, which is appropriate for a site-to-site VPN between branch networks.

Secret-password authentication: Configure a pre-shared key (PSK) on both VPN concentrators. The key must match at both ends.

The answer key shows A, but the screenshots are unavailable here, so I cannot verify which specific controls correspond to A. The important concepts are strong algorithms + tunnel mode + matching pre-shared key. Also ensure the same compatible VPN parameters are configured on both concentrators; otherwise, the tunnel will not establish.
Miami Beach, United States

AI Explanation - verified by User1404 on: August 10, 2026
Question 17:
Correct answer: B — Enabling malware detection through a UTM.
A public file-upload feature creates a risk that attackers will upload a malicious PDF containing malware or an exploit. A unified threat management (UTM) appliance can inspect traffic and uploaded files using security functions such as antimalware scanning, helping detect and block malicious content before it reaches internal systems.
Why the others are weaker:

A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.

C. Load balancer: Distributes traffic among servers but does not inspect files for malware.

D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

In a real deployment, additional controls such as file-type validation, sandboxing, antivirus scanning, content disarm and reconstruction, and storing uploads outside the web root would also be appropriate.
Beau Bassin-Rose Hill, Mauritius

AI Explanation - verified by User8116 on: August 13, 2026
Question 63:
Correct answer: C — Amazon RDS
Amazon RDS is a managed relational database service that supports PostgreSQL. PostgreSQL is commonly used for online transaction processing (OLTP)—applications that handle frequent, short transactions such as inserts, updates, and queries.
AWS manages tasks such as database provisioning, backups, patching, and maintenance.
Why the others are incorrect:

Amazon DynamoDB — Managed NoSQL database, not PostgreSQL.

Amazon Athena — Serverless service for querying data in S3; intended for analytics, not OLTP.

Amazon EMR — Managed cluster platform for big-data frameworks such as Hadoop and Spark.

Exam memory aid: RDS supports managed relational engines, including PostgreSQL, while OLTP generally uses relational databases.
Sapporo, Japan

AI Explanation - verified by User3779 on: July 24, 2026
Question 121:

The correct answer: C. Tokenization

Why:

- Tokenization replaces sensitive data (like credit card numbers) with a non-value token. The actual data lives in a secure vault, not in the database, so a breach of the database won’t expose real card data. - This approach is widely used for payment card data and reduces exposure risk and PCI scope because the tokens themselves are meaningless outside the tokenization context.

Why the others are weaker:

- Hashing: irreversible, so you can’t retrieve the actual card number to process a transaction. - Obfuscation: typically not secure enough; can often be reversed. - Masking: only hides data in display; the actual data remains stored elsewhere and vulnerable.
Vila Velha, Brazil

AI Explanation - verified by User9750 on: August 13, 2026
Question 5:
Correct answer: A — Extensible Authentication Protocol (EAP).
WPA2, particularly WPA2-Enterprise, uses 802.1X with EAP to authenticate users through an authentication server. This provides stronger, individual user authentication than a shared Wi-Fi password.
Why the other options are incorrect:

IPsec: Protects traffic at the network layer, commonly for VPNs; it is not WPA2’s authentication protocol.

SSL: Protects specific application sessions and has largely been replaced by TLS.

SSH: Secures remote command-line administration.

A useful nuance: WPA2 also protects wireless traffic using encryption, commonly AES-CCMP. However, among the listed choices, EAP is the protocol associated with stronger WPA2-Enterprise authentication. WPA2-Personal instead typically uses a pre-shared key rather than EAP.
Dhahran, Saudi Arabia

AI Explanation - verified by bill.dailey on: July 25, 2026
Question 159:
Question 159 asks about the primary benefit of adding automation and orchestration to a SIEM.
Answer: D) acts as a workforce multiplier.
Why:

Automation handles repetitive tasks, and orchestration coordinates responses across tools (SIEM, SOAR, EDR, etc.).

This allows the security team to process more events with the same number of people, improving throughput and response times.

Analysts can focus on more complex tasks like investigation and threat hunting instead of manual triage.

Why the other options aren’t the primary benefit:

It increases complexity: automation can reduce complexity when well-implemented; complexity is not the main intended benefit.

It removes technical debt: automation/OR focuses on current incident response efficiency, not primarily on architectural debt.

It adds additional guard rails: governance is important but not the core value of automation/orchestration within a SIEM.

Virginia Beach, United States

AI Explanation - verified by User6887 on: July 21, 2026
Question 31:
The two correct choices are A and B.

Quick context: In a three-tier network (Access, Distribution, Core), roles are:

- Access: connects end devices. - Distribution: aggregates and enforces policies, can route between VLANs. - Core: high-speed backbone with redundancy to keep the network up.

Why A is correct: The Distribution layer runs Layer 2 and Layer 3 technologies. It often handles VLAN access (L2) and can perform inter-VLAN routing or connect to the core (L3). So it makes sense for the distribution layer to support both L2 and L3.

Why B is correct: The Core layer is designed to maintain continuous connectivity when devices fail. It is built for high availability and redundancy, providing multiple paths so the network remains reachable even if some components fail.

Why the others are not correct:

- C: The Access layer is not primarily for routing between domains; inter-VLAN routing is typically done in the Distribution (or Core) layer. - D: The Core layer does not maintain wired connections for each host; that’s the role of the Access layer. - E: The Core and Distribution layers do not perform the same functions; they have distinct roles.
Thiruvananthapuram, India

AI Explanation - verified by User9941 on: July 24, 2026
Question 12:
Question 12 asks you to judge the accuracy of the underlined statement about inventory adjustment journals.
Key points about the statement:

What it says: you can add a cost when you adjust inventory, and that cost is posted automatically to a specific GL account.

Reality: yes, you can adjust both quantity and value via an inventory adjustment journal. The cost on the journal line affects the inventory value.

Important nuance:

The general ledger postings are not arbitrary. the actual accounts used are determined by your item posting group and the system’s posting definitions. In practice, the adjustment debits/credits the appropriate inventory-related accounts (e.g., Inventory asset and a related offset such as an adjustment or COGS account) based on configuration.

So, the cost change does not go to a single “manual” GL account you pick per line unless your posting setup maps to that account.

Bottom line:

The concept is true (you can adjust cost and have GL impact), but the claim that it posts to a single, specific GL account is oversimplified—the accounts come from your posting configuration.

Bengaluru, India

AI Explanation - verified by User4029 on: July 30, 2026
Question 1:
For Question 1, the two actions you should take are:

Enable the owner dimension

Allocate a standard costing inventory model

Why these are correct:

Owner dimension (B): This dimension Lets you track who owns the stock. By enabling the owner dimension, items can be configured as either company owned or consignment (vendor-owned) when you create or edit items. Without enabling this dimension, you can’t designate ownership per item.

Standard costing inventory model (D): Selecting a costing model determines how item costs are calculated and posted. Standard costing provides a fixed cost per unit, which is commonly used for agreed pricing scenarios like consignment arrangements for easier accounting and valuation. It helps ensure consistent cost treatment across transactions for items that can be owned by the company or on consignment.

Why not the others:

Batch dimension (A): Batch tracking is unrelated to ownership and isn’t required to support company-owned vs. consignment configurations.

Moving average costing (C): This is an alternative costing method. It’s not required to enable ownership config, and the exam’s expected choice focuses on standard costing for this scenario.

Tip: In Dynamics 365, enable the Owner dimension under Inventory dimensions, and set the item’s costing method to Standard; then you can assign ownership per item as Company Owned or Vendor Owned (consignment).
Concord, United States

AI Explanation - verified by User5097 on: August 09, 2026
Question 2:
Correct answer: C — The flow is a before-save flow.
A before-save record-triggered flow runs before the record is committed to the database. It is optimized for quickly updating fields on the triggering record.
Because of these restrictions, its toolbox contains only elements that support that limited processing:

Assignment

Decision

Get Records

Loop

It does not support screens or actions such as sending emails, creating related records, or submitting for approval.
Why the others are incorrect:

Screen flow: Would include a Screen element.

Inactive version: Inactive status does not restrict the available elements.

Activated version: Activation status also does not determine the toolbox contents.

The key clue is the toolbox showing only those four elements, which identifies a before-save flow.
Gurugram, India

AI Explanation - verified by User3588 on: August 17, 2026
Event | where EventType == "error" also listed as incorrect?
No. Event | where EventType == "error" is valid KQL and is arguably the most precise query for the requirement.
The important distinction is the operator:

kusto Event | where EventType == "error"

== is the KQL equality operator.

-eq is a PowerShell operator, not KQL.

is is not the correct equality operator in this context.

The displayed option appears to use:

text Event | where EventType –eq "error"

That is why it is marked incorrect: it uses –eq rather than ==—and it may also be a typographical/en-dash representation.
So the answer key’s statement is inconsistent:

Event | search "error" — valid, broad search.

search in (Event) "error" — valid, broad search.

Event | where EventType == "error" — valid, targeted filter.

If the actual option uses ==, it should not be marked incorrect.
Birmingham, United Kingdom

AI Explanation - verified by User9769 on: August 06, 2026
Question 10:
Correct answer: A — PKI
X.509 certificates are digital certificates used primarily within a Public Key Infrastructure (PKI). They bind an identity—such as a user, server, or organization—to a public key and are digitally signed by a trusted certificate authority.
Common uses include:

Authenticating websites with TLS/HTTPS

Enabling certificate-based VPN authentication

Signing or encrypting email

Supporting device or user authentication

Why the other options are incorrect:

VLAN tagging: Uses network-frame tags, such as 802.1Q; it does not rely on X.509 certificates.

LDAP: May integrate with PKI in some environments, but X.509 certificates are not most commonly associated with LDAP itself.

MFA: Certificates can be one authentication factor, but X.509 is fundamentally a PKI technology.

Morrow, United States

AI Explanation - verified by User4647 on: July 22, 2026
Question 2:
Question 2 asks which VM type is non-migratable during cluster updates.

VMs without NGT: Not clearly a migration blocker on its own; NGT (Nutanix Guest Tools) status isn’t the typical gating factor for live migration during maintenance.

VMs marked as an Agent: Not a standard, widely-known migration blocker; agents aren’t the typical reason a VM can’t be migrated.

Memory Overcommitted VMs: While memory pressure can affect placement, memory overcommitment isn’t a fundamental reason a VM would be labeled non-migratable during maintenance.

VMs with attached Volume Groups: This is the strongest candidate. A Volume Group is a set of volumes bound to a VM; moving the VM would entail relocating and reattaching those volumes, which can complicate or block live migration during maintenance.

Answer: D — VMs with attached Volume Groups.
Why: During maintenance/upgrades, Nutanix aims to minimize risk by only migrating VMs that can be safely moved. VMs with Volume Groups tie the VM to a specific storage configuration, making live migration more complex and often non-migratable until volumes are relocated or reconfigured.
If you want, I can walk through how Nutanix handles live migration during maintenance and what storage constructs (like Volume Groups) imply for mobility.
Lagos, Nigeria

AI Explanation - verified by User9758 on: July 25, 2026
Question 147:
Question 147 asks which enterprise security capability best detects employees accessing systems and data unrelated to their duties.

Correct answer: UBA (A)

Why: UBA (User Behavior Analytics) analyzes user activity, builds baselines of normal access patterns, and flags deviations (e.g., accessing sensitive projects not related to the user’s role). This insider-threat detection is exactly what the scenario requires.

Why not the others:

- EDR focuses on endpoint malware/host threats, not broad user access behavior. - NAC controls device/network access, not ongoing monitoring of which resources a user accesses. - DLP prevents data leakage but doesn’t primarily detect who is accessing data or deviating from normal access patterns.
Tip: Look for the option that monitors and flags unusual user behavior rather than focusing on devices, data content, or endpoint threats.
Virginia Beach, United States

AI Explanation - verified by User8963 on: July 26, 2026
Question 13:
Question 13 asks which are the key architecture domains.

The standard Enterprise Architecture domains are: Business, Data, Application, Technology (BDAT).

Option analysis:

A: Business, strategy, application and technology — includes business and application/tech but uses “strategy” instead of data.

B: Zachman, TOGAF, Cobit, and Heath architectures — names frameworks, not domains.

C: Business, data, infrastructure and technology — has business, data, and technology; lacks a distinct application domain (uses “infrastructure” instead).

D: Process, database, software and technology — covers data (database), application (software), and technology, but omits business.

Notes:

The four BDAT domains (business, data, application, technology) is the conventional model you should study.

None of the options perfectly lists all four BDAT domains. The closest are C (if you map infrastructure to technology) and D (data/application/technology but no business).

The answer key here (D) seems questionable; the core concept to know is BDAT.
Nuenen, The Netherlands

AI Explanation - verified by User6290 on: July 20, 2026
Question 3:
Question 3 asks: In the Create Bulk Cases module, which Filter by options are available in the dropdown? (Choose four.)

According to the provided answer key, the four options are: Upload File, User Criteria, HR Profiles, HR Criteria (options B, D, F, G).

What each means:

Upload File: Filter by a file you upload (e.g., CSV) that provides data for bulk case creation.

User Criteria: Filter by criteria related to users (e.g., role, department) to select target users.

HR Profiles: Filter by HR profile data associated with users.

HR Criteria: Filter by HR-related criteria or attributes.

The other options (Document Template, HR Service Template, HR Template) are more about templates, not typical filtering criteria in this context.
Note: Some communities note that exam answer keys can be incorrect. If you’re unsure, check the official ServiceNow documentation for Create Bulk Cases in your version.
Kolkata, India

AI Explanation - verified by User3759 on: August 05, 2026
Question 6:
Question 6 answer: B — a data pipeline
You need to copy data from:

Source: on-premises SQL Server Database1

Destination: Fabric Warehouse Warehouse1

Connectivity: on-premises data gateway

A data pipeline is designed for orchestrating data movement between sources and destinations. Its Copy Data activity can use the on-premises gateway to access SQL Server and load the data into the warehouse.
Why the other options are weaker:

Dataflow Gen1: Primarily for Power Query transformations and isn’t the best Fabric-native choice for this copy operation.

KQL queryset: Queries data; it does not orchestrate copying from SQL Server.

Notebook: Could perform custom code-based movement, but it is unnecessary and less direct than a pipeline.

Exam cue: “Copy data from one system to another,” especially with a gateway or scheduled movement ? data pipeline.
Fredericton, Canada

AI Explanation - verified by User4614 on: July 24, 2026
Question 27:
Question 27 asks which solution lets you host an ML model and serve predictions in production without managing infrastructure.

Answer: A. Use Amazon SageMaker Serverless Inference to deploy the model.

Why: SageMaker Serverless Inference hosts the model and serves real-time predictions without you provisioning or managing servers. It scales automatically and handles deployment details.

Why the others aren’t suitable:

- CloudFront: a content delivery network; not for hosting or serving ML model predictions. - API Gateway: exposes APIs but requires underlying compute (e.g., Lambda or SageMaker) to actually run the model; not a true serverless model-hosting solution by itself. - AWS Batch: designed for batch processing, not real-time inference.

Quick example flow: web app ? SageMaker Serverless Inference endpoint ? model ? response.

Tokyo, Japan

AI Explanation - verified by ramudridhanush on: August 08, 2026
Question 241:
Question 241 tests the AWS shared responsibility model for Amazon DynamoDB.
Correct answers: D and E

D. Provide public endpoints to store and retrieve data

AWS operates and provides the DynamoDB service endpoints that applications use to access tables.

E. Manage the infrastructure layer and the operating system

DynamoDB is a fully managed, serverless database service. AWS manages the underlying data centers, hardware, networking, infrastructure, and operating systems.
The customer remains responsible for:

Classifying data

Configuring access permissions, such as IAM policies

Selecting or configuring available encryption options, depending on the requirement

The key exam concept is: with managed services such as DynamoDB, AWS manages the underlying infrastructure and platform, while the customer manages data, access, and service configuration.
Chennai, India

AI Explanation - verified by bartoromeo98 on: August 14, 2026
Question 14:
The stated answer B, E is incomplete. The question asks for three access levels, and the least-privilege combination should be:

Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.

Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.

Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

Do not grant:

Contributor access to Production (F), because that could allow changes or deployment there.

Viewer access to Development/Test (C), because Viewer is insufficient for deployment.

Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

So the likely correct selection is B, D, and E. The community answer key appears to have omitted D.
Jaworzno, Poland

AI Explanation - verified by bmccloskey on: July 27, 2026
Question 17:
Question 17 asks which conditions will prevent an OSPF adjacency from reaching the Full state. The three correct options are A, B, and D.

A) MTU mismatch: OSPF neighbors must exchange Hello packets with a compatible MTU. If MTUs differ, the neighbor conversation fails and the adjacency cannot become Full.

B) Incorrect subnet mask: Routers must be in the same IP subnet on the connected link to form a neighbor relationship. A subnet mismatch prevents Hello packets from being considered valid on the same network.

D) Area ID not the same: Neighbors must share the same Area ID. A mismatch stops adjacency from forming beyond the 2-Way state.

Why the others aren’t correct (in this context):

E) Different metric set on each end of the link: Cost differences do not prevent OSPF adjacency; they affect routing decisions, not neighbor formation.

F) Router ID not defined: OSPF can auto-choose a router ID; an undefined ID is not a prerequisite for adjacency to reach Full.

C is sometimes a consideration (if the interface isn’t running OSPF at all), but the official key lists A, B, D as the three factors.
Hilo, United States

AI Explanation - verified by deanswalsh on: August 16, 2026
Question 112:
Yes—the displayed name Document.xml is exactly why this question is confusing. If Hide extensions for known file types is enabled, Windows hides the real .txt extension:

Actual filename: Document.xml.txt

Explorer displays: Document.xml

File type: Text Document (.txt)

When the user “renames” the displayed name to Document.xml, they are only changing the visible base name. Windows still retains the hidden .txt extension, so the file remains a text document.
The correct answer is D: Hide extensions—more precisely, disable Hide extensions for known file types in File Explorer’s Folder Options. Then the user can see and replace the complete filename:

text Document.txt ? Document.xml

The file type shown in Properties confirms that .txt is still the actual extension. Note that changing an extension does not convert the file’s contents; it only changes how Windows and applications identify it.
Anonymous

AI Explanation - verified by kotharianushika01 on: August 15, 2026
Question 41:
Correct answer: A — AWS::SageMaker::Model
An Amazon SageMaker model resource defines the model that SageMaker will use for inference, including:

The inference container image or built-in algorithm

The location of model artifacts in Amazon S3

IAM permissions through the execution role

Optional environment variables and networking settings

An endpoint is a separate hosting resource. Typically, the deployment flow is:

Create AWS::SageMaker::Model

Create an AWS::SageMaker::EndpointConfig that references the model

Create AWS::SageMaker::Endpoint that references the endpoint configuration

Why the other options are incorrect:

AWS::SageMaker::Endpoint hosts a model but does not define the model itself.

AWS::SageMaker::NotebookInstance provides a development environment.

AWS::SageMaker::Pipeline orchestrates ML workflow steps.

Therefore, to declare the ML model that an endpoint will host, use AWS::SageMaker::Model.
Bengaluru, India

AI Explanation - verified by User7866 on: July 20, 2026
Question 52:

Correct answer: D.

Why: In a service offering, a service action is the activity performed by the service provider to deliver or support the service. A service desk agent provides support to a user is the actual action.

Why the others aren’t service actions:

- A: A mobile phone enabling remote work is a product/asset, not an action. - B: A password allowing a user to connect to WiFi is an access credential. - C: A license allows installation of software and is an entitlement, not an action.
Kuching, Malaysia

AI Tutor 👋 I’m here to help!

CompTIA 220-1002 Exam Actual Questions (Retired and replaced with 220-1201) (Page 14 )

QUESTION: 41

QUESTION: 42

QUESTION: 43

QUESTION: 44

CompTIA 220-1002 Exam Actual Questions
(Retired and replaced with 220-1201) (Page 14 )