A customer’s smartphone has been overheating frequently and becoming unresponsive since installing an OS update. A technician has already performed a soft reboot of the device. Which of the following should the technician perform NEXT? (Choose two.)

Roll back the OS update
Update the PRL
Force stop running applications
Enable airplane mode
Perform a factory reset
Run application updates
Reset network settings

Answer(s): A,F

Show Answer Next Question

QUESTION: 42

Joe, a user, cannot read encrypted email messages on a corporate smartphone, but he has been able to read them in the past. A technician restarts Joe's smartphone, but the issue remains. The technician deletes the corporate email account and has Joe re-add it, verifying all settings are correct. Despite these steps, the issue persists.

Which of the following is MOST likely causing the issue?

The certificate is expired.
The TPM is bad.
The phone is not encrypted.
The incorrect mail server is selected in settings.

Answer(s): A

Show Answer Next Question

QUESTION: 43

A user moves a file from one NTFS disk to another NTFS disk. Which of the following describes the changes to the file permissions?

The file has both the source and destination permissions
The file keeps the source permissions
The file permissions have to be set manually
The file receives the destination permissions

Answer(s): D

Show Answer Next Question

QUESTION: 44

A technician has enabled port security on a switchport.

Which of the following BEST describes the effect this will have?

Devices must match a list of allowed MAC addresses before accessing the network.
Devices need to conform to the policies set forth by the MDM software.
Data loss prevention software will be monitoring for data exfiltration on the port.
A firewall is actively monitoring the network traffic using heuristic analysis.

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 20 of 64
Viewing questions 77 - 80 out of 701 questions

Post your Comments and Discuss CompTIA 220-1002 exam prep with other Community members:

Comments:

Name:

220-1002 Exam Discussions & Posts
220-1002 AI Verifications

anon on: March 04, 2025
Anyone use the free version to help them pass the test? Can't really afford the pdf version right now.
UNITED STATES

senan on: March 02, 2025
salam bu ne suallardi bele
AZERBAIJAN

HCipher on: February 12, 2025
i can certify for anyone planning to take the exam that these questions are up to date and representative of the actual exam, but i strongly urge you to read, and understand the material as comprehensively as you could ensuring you learned as best as you possibly could. before learning the dumps, as acquiring the certificate without any knowledge gained is a futile endeavor for your career progression and the likes
PORTUGAL

The Professor on: December 21, 2024
Passed the A+ today. Many of these questions are valid but be careful to read your questions first because the answer may change based on the conditions in the question
UNITED STATES

CompTIA on: December 03, 2024
These questions are valid but you can't rely on them. We do not use these questions no more. On god.
UNITED STATES

Jury on: April 10, 2024
i just passed my A+ core 2 today. 4 of my PBQ was exactly the same with this practice test. it6 is really worth understanding all the questions here. big help!! thank you so much!! Aiming for my Sec+ now before 601series expires in July
Anonymous

Marc on: March 14, 2024
This exam dumps is valid in US as of yesterday. I can say that it helped a lot with my exam. A lot of relevant topics.
UNITED STATES

Jacob on: February 12, 2024
This exam is one of the hardest ones. You cannot pass without using these exam dumps. Just an FYI to others, majority of these questions are in the exam.
Italy

GetGo on: August 11, 2023
It was pretty easy to pass this exam with the help of this exam dumps PDF. Free version is not complete. I paid for the full version with 50% sale.
Anonymous

AI Explanation - verified by varshamadaan376 on: August 22, 2026
Question 16:
The answer key appears incorrect. The best answers are:

Use private connectivity from a cloud provider

Set up SSO for federated authentication

Why:

Private connectivity—such as a cloud provider’s private endpoint—keeps Snowflake access within the company’s private network path instead of exposing access over the public internet. This fits the VPN/VDI requirement.

SSO for federated authentication allows Snowflake users to authenticate using the credentials already managed by the company’s identity provider—the same identity system used for VDI—eliminating separate Snowflake passwords.

Why the keyed answers are not suitable:

Tri-Secret Secure protects encryption keys; it does not provide private network access or credential reuse.

A proxy Snowflake account outside the VPN conflicts with the requirement that Snowflake have no internet visibility and is not the normal solution for federated login reuse.

Therefore, I believe the correct choices should be C and D, not B and E.
Bengaluru, India

AI Explanation - verified by User9453 on: August 23, 2026
Question 7:
Question 7 answer: B — It buffers and queues packets above the committed rate.
Traffic shaping controls the transmission rate by temporarily storing excess packets in a buffer. When traffic exceeds the configured committed rate, the excess packets are queued and transmitted later when bandwidth becomes available.
Why the other options are incorrect:

Drops packets when traffic exceeds a certain bitrate: This describes traffic policing, not shaping.

Fragments large packets and queues them: Shaping does not fragment packets as its primary congestion-control action.

Drops packets randomly from lower-priority queues: Packet dropping may occur if a shaping queue becomes full, but it is not the defining behavior.

Key distinction:

Shaping: buffers and delays excess traffic.

Policing: drops or marks traffic that exceeds the configured rate.

Ranchi, India

AI Explanation - verified by curl_thyme6l on: August 29, 2026
Question 62:
Correct answer: C — Identity provider
In this scenario, employees access the Salesforce-based portal through Single Sign-On (SSO). Active Directory—typically through a federation service such as AD FS—authenticates the employee and sends a SAML assertion to Salesforce.

Identity provider (IdP): Authenticates users and asserts their identity.

Service provider (SP): The application being accessed—in this case, Salesforce/the employee portal.

Identity store: A directory that stores user identities, such as Active Directory.

Authentication store: A system used to validate credentials.

Although Active Directory can function as an identity store and authentication system, its federated SSO role in this question is the identity provider.
Zagreb, Croatia

AI Explanation - verified by User4985 on: September 05, 2026
Question 12:
Correct answer: 5 network interfaces (A).
Reasoning:

Each Azure VM must have at least one network interface (NIC).

A single NIC can have:

- A private IP address in the virtual network. - A public IP address associated with its IP configuration.

Therefore, each of the five VMs needs only one NIC:

5 VMs × 1 NIC = 5 NICs
The requirement for identical inbound and outbound security rules does not require additional NICs. You can apply the same network security group (NSG) to all five NICs, or associate one NSG with the subnet containing the VMs.
The options suggesting 10, 20, or 40 NICs incorrectly assume that public and private IP addresses each require separate NICs. They do not.
Guangzhou, China

AI Explanation - verified by mphaladijd on: August 16, 2026
corect answer is bde
You’re right—B, D, and E are the intended correct choices. The page formatting appears to have split the answer options incorrectly.

B — Increase provisioned concurrency for Lambda

Provisioned concurrency keeps Lambda execution environments initialized, reducing cold-start latency during the initial request burst.

D — Refactor the Lambda functions

Database connection initialization should be moved outside the function handler, so warm execution environments can reuse connections. The page text appears to say “into” the handlers, which would be counterproductive and is likely a formatting/transcription error.

E — Use Amazon RDS Proxy

RDS Proxy pools and reuses database connections. This prevents a burst of Lambda invocations from opening many separate connections to Aurora and reduces connection overhead.
Reserved concurrency controls the maximum number of concurrent invocations but does not eliminate cold starts or database connection overhead. Aurora Global Database and cross-Region replicas are not needed for this latency/scalability issue.
Pretoria, South Africa

AI Explanation - verified by User8074 on: August 29, 2026
Question 35:
Correct answer: A. Residual risk
Residual risk is the risk that remains after security controls and other mitigating factors have been applied.
For example, an organization may deploy firewalls, encryption, and access controls. These reduce the likelihood or impact of a threat, but they usually cannot eliminate risk entirely. The remaining exposure is residual risk.
Why the others are incorrect:

Inherent risk: Risk that exists before controls are implemented.

Avoided risk: Risk eliminated by choosing not to perform the risky activity.

Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

The key phrase is “after controls and mitigating factors have been applied.”
Weston, Canada

AI Explanation - verified by molnarsignup2002 on: September 01, 2026
Question 228:
Correct answer: B — Azure Machine Learning Designer.
The name is not necessarily outdated, although Microsoft’s naming can be confusing:

Azure Machine Learning is the overall Azure service.

Machine Learning designer is the visual, drag-and-drop interface within Azure Machine Learning.

Microsoft may refer to the broader product as Azure Machine Learning studio, while “Designer” remains the specific visual workflow tool.

Designer lets you build machine-learning pipelines by connecting datasets, data-transformation steps, training modules, evaluation modules, and deployment components without writing all the code manually. It supports building, testing, and deploying predictive models.
The other options do different jobs:

Azure Logic Apps: Workflow and integration automation.

Azure Batch: Large-scale parallel or batch compute.

Azure Cosmos DB: Globally distributed NoSQL database.

Be careful not to confuse current Azure Machine Learning Designer with the older Azure Machine Learning Studio (classic), which was a separate legacy offering.
Budapest, Hungary

AI Explanation - verified by User9607 on: August 22, 2026
Question 4:
Correct answer: No.
The proposed solution installs the Docker client and runs:

bash docker run -it microsoft/azure-cli:0.10.17

This does not deploy the Kubernetes YAML manifest because:

docker run starts an Azure CLI container; it does not automatically connect to the AKS cluster.

The command does not run kubectl apply.

The container would need the appropriate Kubernetes tools and AKS credentials.

The device or container must obtain cluster credentials, typically using an AKS credential command, before running Kubernetes commands.

To deploy the manifest, the administrator should use kubectl, for example:

bash az aks get-credentials --resource-group <resource-group> --name <aks-cluster> kubectl apply -f myapp.yaml

Therefore, the Docker client and the docker run command alone do not meet the goal. This contrasts with Question 3, where installing Azure CLI and running kubectl apply would meet the goal, assuming kubectl and cluster credentials are available.
Pune, India

AI Explanation - verified by User8693 on: September 07, 2026
Question 172:
For Question 172, the answer key’s A is the stronger answer—not B.
A. Implement access controls and encryption.
Because the company already processes and stores sensitive data, its first priority should be protecting that data through:

Access controls — ensuring only authorized users can access it.

Encryption — protecting the data if it is intercepted or exposed.

B. Training on data protection policies is important for compliance, but training alone does not directly secure the stored sensitive data. It would typically follow the establishment of essential technical safeguards.
Lagos, Nigeria

AI Explanation - verified by User9951 on: September 02, 2026
Question 7:
The correct choices are B and D.

D — Create sibling resource pools for the Production VMs and Test VMs.

This separates the workloads into distinct resource pools under the cluster, so their resource allocation can be managed independently.

B — Configure a memory reservation on the Production resource pool.

Set the reservation to the amount of memory the Production VMs require. A reservation guarantees that memory under contention, provided the cluster has sufficient physical resources.
Why the others are insufficient:

Shares only determine relative priority when resources are scarce; they do not guarantee memory.

A parent resource pool alone does not provide a guarantee.

A child pool for Test VMs does not reserve memory for Production.

DRS balances workloads, but it does not by itself guarantee that a VM receives its full configured memory. The reservation provides that guarantee.
South Tangerang, Indonesia

AI Explanation - verified by francis4fnc on: August 25, 2026
Question 2:
Correct answer: D.
Apply a temporary explicit Deny in the S3 bucket policy for s3:GetObject on the bucket’s object resources:

json "Resource": "arn:aws:s3:::bucket-name/*"

This immediately prevents further object downloads, including downloads made with the attacker’s already-issued temporary credentials. The policy can be removed or narrowed after the development team deploys the fix.
Why the others are weaker:

A: Revoking or changing an instance profile does not reliably invalidate temporary credentials that have already been issued and may still be valid.

B: Changing the EC2 security group does not necessarily stop the attacker from using the stolen credentials from elsewhere.

C: Amazon Macie helps discover sensitive data; Object Lock prevents modification/deletion, not reads or downloads.

The bucket policy will also block legitimate reads temporarily, so the security engineer should scope the denial carefully and document the emergency change.
Lagos, Nigeria

AI Explanation - verified by User3103 on: September 01, 2026
Question 4:
Correct answer: D. Shadow IT
Shadow IT is the use of hardware, software, cloud services, or systems without the organization’s approval or oversight.
In this scenario, the R&D department is accessing company-related services without using the company VPN. This suggests they may be using unauthorized or unmanaged methods to access resources, creating visibility and security risks for the organization.

Espionage: Stealing information for intelligence or competitive purposes.

Data exfiltration: Unauthorized removal or transfer of data.

Nation-state attack: An attack sponsored or conducted by a government.

Shadow IT: Technology or access methods used outside approved IT processes.

The key clue is activity occurring outside the company’s approved security controls.
Biloxi, United States

AI Explanation - verified by User8074 on: August 31, 2026
Question 104:
Correct answer: C. WAF (Web Application Firewall)
A WAF is specifically designed to protect web applications and their associated web portals. It inspects HTTP/HTTPS requests and can block attacks such as:

SQL injection

Cross-site scripting (XSS)

Malicious file uploads

Common web-application exploits

Why the others are less suitable:

Layer 4 firewall: Filters primarily by IP addresses, ports, and transport protocols; it lacks detailed web-application inspection.

NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specialized for protecting web applications.

UTM: Combines several security functions in one device, but it is not specifically focused on web-application attacks.

The key clue is “customers access through a web portal”—that points directly to a WAF.
Weston, Canada

AI Explanation - verified by User5804 on: August 20, 2026
Question 3:
Na questão 3, a resposta é A — Árvores de decisão, porque o requisito principal é documentar como o modelo chega ao resultado.

Árvores de decisão: usam regras sequenciais, como “se característica X > valor, siga para este ramo”. São fáceis de visualizar e explicar. Atendem bem a problemas de classificação e regressão com alta interpretabilidade.

Regressão linear: prevê um valor numérico contínuo, como preço, custo ou temperatura. Não é a escolha principal para classificar genes em categorias.

Regressão logística: calcula a probabilidade de uma categoria. Pode atender à classificação, inclusive multiclasses, mas sua explicação costuma ser menos intuitiva que uma árvore para documentar decisões.

Redes neurais: atendem a tarefas complexas, como imagens, texto e padrões não lineares. Porém, são menos interpretáveis, funcionando mais como uma “caixa-preta”.

Resumo: como a empresa precisa entender e documentar o mecanismo interno do modelo, a árvore de decisão é a opção mais adequada.
Itu, Brazil

AI Explanation - verified by User2519 on: August 16, 2026
Question 6:
Correct answer: Governance (C)
The AWS Cloud Adoption Framework (AWS CAF) organizes guidance into six perspectives:

Business

People

Governance

Platform

Security

Operations

The Governance perspective includes foundational capabilities needed to manage and control cloud adoption, such as:

Cloud financial management

Portfolio and program management

Risk management

Data governance

Compliance and oversight

Sustainability, Performance efficiency, and Reliability are AWS Well-Architected Framework design principles or pillars—not AWS CAF perspectives.
Kuala Lumpur, Malaysia

AI Explanation - verified by User6592 on: September 02, 2026
Question 8:
Correct answers: B. Deterrent and F. Detective

CCTV system — Detective control: Cameras monitor and record activity, helping identify or investigate security incidents after—or while—they occur.

Signs about being filmed — Deterrent control: The signs discourage people from attempting unauthorized or criminal activity because they know surveillance is present.

Why the others don’t fit:

Preventive: Stops an incident from occurring, such as a lock or access-control system.

Corrective: Restores systems after an incident.

Directive: Instructs people to behave in a certain way, such as a security policy.

Compensating: Provides an alternative control when the preferred control cannot be implemented.

The key distinction is that the cameras detect, while the warning signs discourage.
Atlanta, United States

AI Explanation - verified by alaafawzyelbahrawy on: August 26, 2026
what is the diff between B and C
The key difference is whether the streaming query keeps running:

B: Trigger.Once + scheduled job

- The query starts, processes all currently available data, then stops. - The Databricks job starts it again every 10 minutes. - This avoids paying for an always-running streaming job and avoids repeated empty microbatches.

C: 10-minute processing-time trigger

- The query remains continuously active. - It wakes up every 10 minutes, checks the source, processes available data, and waits again. - This reduces source checks compared with the default trigger, but compute resources remain allocated between batches.
Therefore, B is better for cost reduction when data only needs to be processed within 10 minutes. The exam’s intended pattern is a scheduled finite query, commonly using Trigger.Once—or, in newer Spark/Databricks usage, often Trigger.AvailableNow.
Cairo, Egypt

AI Explanation - verified by User2538 on: August 19, 2026
Question 2:
Correct answer: Read-access geo-redundant storage (RA-GRS).
Why it fits:

Multiple nodes: Data is replicated several times in the primary region.

Separate geography: A copy is asynchronously replicated to a secondary Azure region.

Readable secondary: RA-GRS provides read-only access to the secondary replica, even when the primary region is available.

Why the others don’t fit:

GRS: Replicates to another region but the secondary copy isn’t normally readable.

ZRS: Replicates across availability zones in the same region, not a separate geographic region.

LRS: Keeps replicas within a single datacenter or region and provides no geographic redundancy.

Therefore, select Read-access geo-redundant storage (RA-GRS).
Pune, India

AI Explanation - verified by ravi.chidananda on: August 20, 2026
Question 149:
Correct answers: A and B — AWS Audit Manager and AWS Config.

AWS Audit Manager continuously collects evidence from AWS services and helps assess whether workloads comply with regulatory frameworks and internal policies. It can produce audit-ready reports.

AWS Config records resource configurations and evaluates them against compliance rules. For example, it can check whether encryption, logging, or access settings meet company requirements.

Why the others are less suitable:

Amazon Inspector identifies software vulnerabilities and unintended network exposure, not general policy or regulatory compliance.

Amazon CloudWatch monitors metrics, logs, and operational events, but is not primarily a compliance assessment service.

AWS CloudTrail records API activity for auditing and investigation. It supports compliance, but does not itself provide the structured compliance assessment capabilities of Audit Manager and Config.

The key distinction is: Audit Manager assesses and reports compliance; Config continuously checks resource configurations against rules.
Bengaluru, India

AI Explanation - verified by User7779 on: August 31, 2026
Question 9:
Correct answer: D — Network segments remain private if unneeded to access the internet.
The least privilege principle means granting only the access necessary for a user, system, service, or network resource to perform its required function.
In a cloud environment, this includes limiting network exposure:

Resources that do not need internet access should remain on private network segments.

Internet-facing access should be restricted to systems that require it.

Access should be explicitly allowed rather than broadly exposed.

Why the other options are weaker:

A: A single administrator with access to core functions may violate least privilege if that access is broader than necessary.

B: Inspecting traffic supports monitoring and defense, but does not itself limit privileges.

C: Updating routing configurations supports availability and connectivity, not least privilege.

So, D best represents limiting unnecessary access and exposure.
Singapore, Singapore

AI Explanation - verified by User3884 on: August 28, 2026
Question 7:
Correct answer: A — The ITIL service value system (SVS)
The ITIL service value system describes how all the components and activities of an organization work together to facilitate value creation. It provides a holistic view of service management.
The SVS includes:

Guiding principles

Governance

Service value chain

Practices

Continual improvement

Together, these help transform opportunities and demand into value for both the service provider and consumers.
Why the other options are incorrect:

Guiding principles: Recommendations that guide decisions and actions; they do not describe the entire system.

Four dimensions: Perspectives used to ensure a balanced approach to service management.

Service relationship: Describes cooperation between a service provider and service consumer, rather than the whole value-creation system.

Morrow, United States

AI Explanation - verified by User4025 on: September 01, 2026
Question 27:
Correct answer: A. Trusted devices
A trusted device solution allows access only from registered or managed devices. Once a device is enrolled and trusted, the employee can usually log in with minimal additional interaction, providing a seamless experience.
It best meets the requirements because:

Employees can use approved devices from remote locations or worldwide offices.

Users do not need to carry or insert extra hardware.

It helps prevent account takeovers from unknown devices.

Why the others are less suitable:

Geotagging: Restricts access based on location, which could interfere with remote work and travel.

Smart cards: Require additional physical equipment and card readers.

Time-based logins: Limit access according to time but do not strongly bind access to an authorized user device.

Nashville, United States

AI Explanation - verified by User8942 on: August 23, 2026
Question 2:
Correct answer: C — Statistical metrics measuring capacity utilization
When analyzing computer performance, an auditor needs objective, quantitative data. Metrics such as CPU, memory, disk, network utilization, throughput, and response time help determine whether resources are appropriately sized and where bottlenecks exist.
Why the other options are less useful:

A. Tuning system software: This is a corrective action, not an analysis method. Tuning should be based on measured performance data.

B. User dissatisfaction reports: Useful as an indicator, but subjective and insufficient for diagnosing the cause.

D. Off-peak utilization and response time: This may hide problems occurring during peak periods. Performance analysis should cover representative or peak workloads.

The exam principle is: Use measurable performance and capacity data before making optimization decisions.
Hyderabad, India

AI Explanation - verified by User3703 on: August 22, 2026
Question 1:
Correct answer: D — Use a Common Connected App Handler using Apex.
The classified system needs a real-time access decision whenever the user attempts SSO. The handler can evaluate the user’s current Salesforce data—specifically, whether they own an open Case with record type Classified—and allow or deny access accordingly.
Why the other options are weaker:

A — Reports: Reports are informational and don’t enforce access during an SSO transaction.

B — Apex trigger and Permission Sets: A trigger could update permissions when a Case changes, but this creates synchronization and timing issues. It also changes Salesforce permissions rather than making a direct, real-time decision for the external system.

C — Custom SAML JIT Provisioning: JIT provisioning is primarily for creating or updating users at login. It isn’t the appropriate mechanism for dynamically querying business records and deciding whether access should be granted.

D — Connected App Handler: Designed for custom, programmatic control during connected-app authentication and authorization. Apex can check the user’s current open classified cases and permit or reject the SSO request.

The key exam clue is dynamic authorization based on current Salesforce data at login time.
Melbourne, Australia

AI Explanation - verified by User4811 on: August 23, 2026
Question 53:
Correct answer: A. Disk encryption
The administrator wants to protect data if a corporate laptop is stolen. Full-disk encryption encrypts the data stored on the drive, so an attacker generally cannot read it simply by removing the drive or booting another operating system.

B. Data loss prevention (DLP): Helps prevent sensitive data from being copied, emailed, or exfiltrated. It is not the primary control for protecting a stolen laptop’s stored data.

C. Operating system hardening: Reduces vulnerabilities by disabling unnecessary services and applying secure settings, but it does not necessarily protect the files if the disk is accessed directly.

D. Boot security: Helps ensure the device starts only through trusted software or approved processes. It supports platform integrity but does not itself encrypt stored files.

Exam clue: when the scenario says “laptop is stolen” and asks about protecting data at rest, choose disk encryption.
Atlanta, United States

AI Explanation - verified by User3438 on: August 27, 2026
Question 15:
Correct answer: B. VLAN hopping
VLAN hopping is an attack that can allow traffic to move from one VLAN to another without authorization. One method, called double-tagging, places multiple 802.1Q VLAN tags in a single Ethernet frame.
The first switch removes the outer tag, and the next switch may process the remaining tag as a valid VLAN identifier. This can cause the frame to reach a different VLAN.
Why the others are incorrect:

MAC flooding: Overwhelms a switch’s MAC address table, potentially causing traffic to be broadcast.

DNS spoofing: Provides false DNS responses to redirect users.

ARP poisoning: Sends false ARP information to associate an attacker’s MAC address with another device’s IP address.

The clue is “a network packet that contains multiple network tags,” which points to VLAN double-tagging.
Pretoria, South Africa

AI Explanation - verified by User9849 on: August 31, 2026
Explain saml
SAML (Security Assertion Markup Language) is a standard used to exchange authentication and authorization information between an identity provider (IdP) and a service provider (SP).
In an SSO scenario:

You try to access a cloud application, such as accounting software.

The application redirects you to the company’s IdP.

You authenticate with the IdP.

The IdP sends a digitally signed SAML assertion to the application.

The application validates the assertion and grants access.

A SAML assertion can communicate details such as:

The user’s identity

Whether authentication succeeded

Roles or group membership

Access-related attributes

Key exam point: SAML is commonly used for enterprise SSO, especially between an organization and cloud-based applications. It is based on XML and uses assertions issued by the IdP; it does not directly share the user’s password with the application.
Philadelphia, United States

AI Explanation - verified by User2283 on: August 29, 2026
Question 6:
Correct answer: Governance
The AWS Cloud Adoption Framework (AWS CAF) organizes cloud adoption guidance into six perspectives:

Business

People

Governance

Platform

Security

Operations

The Governance perspective contains foundational capabilities for managing and controlling cloud adoption, such as:

Cloud financial management

Portfolio management

Data governance

Risk management

Compliance

The other options—Sustainability, Performance efficiency, and Reliability—are pillars of the AWS Well-Architected Framework, not AWS CAF perspectives.
Philadelphia, United States

AI Explanation - verified by User3237 on: August 19, 2026
Question 1:
Correct answer: D — Verify that the VPC route table includes a route for the Amazon S3 gateway endpoint.
When an AWS Glue job runs inside a VPC and accesses Amazon S3 privately, the subnet’s route table must be associated with an S3 gateway VPC endpoint. The endpoint adds a route for S3 traffic, allowing the job to reach S3 without using a NAT gateway or internet gateway.
Why the other options are not best:

A: Security groups do not control traffic to an S3 gateway endpoint in this way. Gateway endpoints are configured through route tables.

B: An S3 bucket policy may be needed for authorization, but the error specifically indicates a connectivity or endpoint-routing problem.

C: Glue connection settings do not require a fully qualified domain name to resolve this endpoint issue.

Strictly speaking, gateway endpoints require the appropriate route-table association and endpoint route; “inbound and outbound routes” is imprecise because the key requirement is the route directing S3 traffic to the endpoint.
Piracaia, Brazil

AI Explanation - verified by User8434 on: August 29, 2026
Question 1:
Correct answer: D. TTP provides useful insights on the strategy and behavior of an attacker.
Tactics, techniques, and procedures (TTPs) describe how an attacker operates:

Tactics: The attacker’s overall goal, such as gaining persistence or exfiltrating data

Techniques: The methods used to achieve that goal

Procedures: The specific implementation or sequence of actions

TTPs are valuable because they focus on behavior, which is often more stable than specific indicators. An attacker can change an IP address, hash, or tool relatively easily, but changing the underlying methods and objectives may be more difficult.
Why the others are weaker:

IP addresses and hash values: Useful indicators, but they can change quickly.

Indicators of compromise: TTPs may help identify IOCs, but their main value is describing behavior.

Tools: Attackers can replace tools or use legitimate administrative utilities.

This allows defenders to detect similar attacks even when the exact malware or infrastructure is new.
Santa Clara, United States

AI Explanation - verified by User7614 on: August 31, 2026
Question 29:
Correct answers: A — Configure the AWS-provided security group firewall, and B — Classify company assets in the AWS Cloud
Under the AWS shared responsibility model, AWS secures the underlying infrastructure, while the customer is responsible for configuring and using AWS services securely.

A: Configure security groups — Customers define inbound and outbound rules for resources such as Amazon EC2 instances.

B: Classify company assets — Customers decide how their data and assets should be classified and protected.

Why the others are incorrect:

C: Amazon S3 is a regional service; customers select a Region, not individual Availability Zones for buckets.

D: AWS manages the infrastructure and patching for Amazon DynamoDB.

E: AWS manages the infrastructure used by AWS Lambda; customers do not select EC2 instances for Lambda functions.

Bengaluru, India

AI Explanation - verified by walter.kgaphola on: August 24, 2026
Question 2:
Correct answer: Automatic Call Distribution (ACD)
ACD automatically places incoming calls into queues and distributes them to available agents according to configured routing rules. This helps reduce caller wait time by:

Sending calls to available agents quickly

Balancing interactions across agents

Preventing calls from being handled manually one at a time

Why the other options are less appropriate:

Workforce Management: Forecasts demand and schedules enough staff; it supports wait-time reduction but does not directly distribute calls.

Skill-based Routing: Routes calls based on agent skills and may improve the customer experience, but the question is asking about the core feature that distributes calls efficiently.

IVR: Lets callers navigate menus and self-service options; it does not primarily assign calls to agents.

The answer key’s A is consistent with the usual Genesys Cloud CX exam objective.
Pretoria, South Africa

AI Explanation - verified by User7520 on: September 03, 2026
Question 2:
Correct answer: C. Risk register
A risk register is a centralized document used to track:

Identified risks

Risk owners or responsible parties

Likelihood and impact

Risk response plans

Current status

Risk thresholds or trigger conditions

Why the others are incorrect:

Risk tolerance: The amount and type of risk an organization is willing to accept; it is not primarily a tracking document.

Risk transfer: Moving the financial or operational impact of a risk to another party, such as through insurance or outsourcing.

Risk analysis: The process of evaluating a risk’s likelihood and impact.

The key clue is “document risks and responsible parties.” That directly describes a risk register.
Houston, United States

AI Explanation - verified by User1782 on: August 31, 2026
Question 101:
Correct answer: A. Data architecture
The AWS Cloud Adoption Framework (AWS CAF) platform perspective focuses on building and managing the technical foundation of the cloud, including:

Cloud architecture

Data architecture

Platform engineering

Data engineering

Provisioning and modernization

Why the others are less suitable:

Data protection is associated mainly with security and risk management.

Data governance belongs to the governance perspective.

Data science is not an AWS CAF capability.

The key distinction is that data architecture describes how data stores, pipelines, and data systems are designed as part of the cloud platform.
Gurugram, India

AI Explanation - verified by User6574 on: August 24, 2026
Question 1:
Correct answer: B. vSmart
In Cisco SD-WAN:

vSmart controls the overlay control plane. It uses OMP to exchange routing information, distribute policies, and determine how WAN Edge devices reach one another.

vManage is the centralized management and configuration platform.

vBond is the orchestrator. It helps devices authenticate, discover controllers, and traverse NAT during onboarding.

APIC-EM is not the SD-WAN control-plane component described here.

Therefore, the component that establishes, adjusts, and maintains the logical relationships in the SD-WAN fabric is vSmart.
Gaborone, Botswana

AI Explanation - verified by User5962 on: August 30, 2026
Question 10:
The answer key shows D, but I believe the correct answer is B: Determine if the pattern is a data issue or a new insight.
Einstein Discovery can identify correlations or patterns that business users did not expect. The proper next step is to validate the finding with departmental experts and investigate the underlying data:

Check whether the data is accurate, complete, and properly prepared.

Confirm that the pattern is not caused by an outlier, data-quality problem, or modeling issue.

If the data is valid, treat the result as a potentially valuable new business insight.

Why the other options are weaker:

A: A data scientist may help, but expert validation and data-quality checking come first.

C: Filtering out inconvenient data risks hiding a valid insight.

D: Einstein’s result should not be accepted without verification simply because it produced the finding.

Minsk, Belarus

AI Explanation - verified by User9607 on: August 22, 2026
Question 1:
Correct answer: C. From the Redeploy blade, click Redeploy.
For an Azure VM, you cannot directly choose or control the underlying physical Azure host. Selecting Redeploy stops the VM, moves it to a different physical node in Azure, and starts it again.
Important points:

The VM keeps its configuration, disks, IP settings, and associated resources.

The operation may cause downtime.

You cannot guarantee that it will move specifically to Host2; Azure selects the new host.

Update management is for update configuration, not host relocation.

Moving to another subscription does not move the VM to a different physical host.

Usage location is unrelated to VM placement.

The question’s wording is slightly misleading because Host1 and Host2 sound like selectable Hyper-V hosts. For an Azure VM, they represent infrastructure nodes that Azure manages, so Redeploy is the applicable action.
Pune, India

AI Explanation - verified by User4094 on: August 23, 2026
Question 3:
Correct answer: B — RelayState
In SP-initiated SAML SSO, the user first requests a protected resource from the Service Provider (SP). The SP redirects the user to the Identity Provider (IdP) for authentication.
The SP includes:

SAMLRequest: the SAML authentication request

RelayState: the original destination or application state

After authentication, the IdP returns the SAML response along with the same RelayState value. The Salesforce SP uses it to send the user back to the resource they originally requested.
Why the others are incorrect:

RedirectURL: not the standard SAML parameter for preserving the original request.

DisplayState: not a standard SAML SSO parameter.

StartURL: Salesforce-related terminology, but not the standard parameter used in this SAML exchange.

Remember: RelayState preserves context or the return destination during SAML authentication.
Zagreb, Croatia

AI Explanation - verified by arnishaclincy on: August 28, 2026
Question 1:
Correct answer: B. Transfer
Purchasing cyber insurance transfers some of the organization’s financial risk to an insurance provider. If a covered incident occurs, the insurer may help pay for costs such as recovery, legal services, notification, or regulatory penalties, depending on the policy.

Accept: Acknowledging the risk without taking additional action.

Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.

Avoid: Eliminating the activity or condition that creates the risk.

Transfer: Shifting the consequences—usually financial—to another party, such as an insurer.

Stone Mountain, United States

AI Explanation - verified by User4059 on: September 02, 2026
Question 9:
Correct answer: A — vBond
In Cisco SD-WAN, the components have distinct roles:

vBond — orchestration plane: Authenticates devices, helps them discover each other, and assists with NAT traversal and initial control-connection setup.

vSmart — control plane: Distributes routing and policy information to WAN Edge devices using the overlay control plane.

vManage — management plane: Provides centralized configuration, monitoring, and orchestration through its GUI/API.

WAN Edge — data plane: Forwards user traffic across the SD-WAN fabric.

The term orchestration points directly to vBond, which acts as the initial coordination point when SD-WAN devices join and establish their overlay relationships.
Frankfurt Am Main, Germany

AI Explanation - verified by User9431 on: August 25, 2026
Question 22:
Correct answer: B — AAA
A RADIUS server provides centralized:

Authentication: Verifies a user’s identity, such as username and password.

Authorization: Determines what the authenticated user is allowed to access.

Accounting: Records connection and usage details, such as login time or session duration.

RADIUS is commonly used for network access, including wireless networks, VPNs, and network device administration.
Why the other options are incorrect:

CIA: Confidentiality, integrity, and availability are broad security objectives, not a specific RADIUS function.

ACL: An access control list contains permit/deny rules on systems or network devices. RADIUS can support access decisions but is not itself an ACL.

PEM: Privacy-Enhanced Mail is also associated with certificate and key encoding formats; it is unrelated to RADIUS’s primary purpose.

Seattle, United States

AI Explanation - verified by User5804 on: August 20, 2026
Question 5:
A resposta é A — Ajustar o prompt.
O prompt pode instruir diretamente o LLM sobre:

Idioma: “Responda em português.”

Tamanho: “Responda em até três frases.”

Formato: “Use uma lista com três recomendações.”

Objetivo: “Recomende produtos com base nas necessidades do cliente.”

As outras opções:

Mudar o tamanho do LLM: pode alterar capacidade e custo, mas não garante idioma ou respostas curtas.

Aumentar a temperatura: aumenta a criatividade e a aleatoriedade; não controla diretamente o tamanho ou idioma.

Aumentar o Top K: permite considerar mais tokens prováveis, aumentando a variedade; também não é o mecanismo principal para controlar idioma ou comprimento.

Portanto, quando a necessidade é alinhar o comportamento e o formato da resposta às expectativas da empresa, deve-se começar por melhorar o prompt.
Itu, Brazil

AI Explanation - verified by marcjacob324 on: August 17, 2026
Question 8:
Correct answer: LLDP (Link Layer Discovery Protocol)
LLDP is a Layer 2 discovery protocol that lets network devices advertise information about themselves to directly connected devices. It can reveal the neighboring switch, its management information, and the specific switch port involved.
Why the other options are incorrect:

IKE: Negotiates security parameters for IPsec VPNs; it does not identify switch ports.

VLAN: A logical network segmentation method, not a discovery protocol.

netstat: Displays local network connections and listening services, but cannot identify the physical switch or port.

Because the laptop works when connected to the same port, the technician can use LLDP information to determine which switch and interface serve that connection, then verify whether the VoIP handset or its configuration is the problem.
Atlanta, United States

AI Explanation - verified by User8035 on: August 27, 2026
Question 25:
Question 25 asks which search returns events containing a tag named Privileged.
Correct answer: B — tag=Priv*

tag=Priv searches the tag field for values beginning with Priv. The wildcard can match the remaining characters, so it matches Privileged.

tag=Priv would search for the exact tag Priv, not Privileged.

tag=priv* uses lowercase priv; tag matching is treated as case-sensitive here, so it may not match the tag Privileged.

tag=privileged uses the wrong capitalization for the exact tag.

The important exam concept is that Splunk supports wildcard matching in tag searches, and the wildcard lets Priv* match tag values that start with Priv.
Bangkok, Thailand

AI Explanation - verified by deanswalsh on: August 16, 2026
Question 112:
Yes—the displayed name Document.xml is exactly why this question is confusing. If Hide extensions for known file types is enabled, Windows hides the real .txt extension:

Actual filename: Document.xml.txt

Explorer displays: Document.xml

File type: Text Document (.txt)

When the user “renames” the displayed name to Document.xml, they are only changing the visible base name. Windows still retains the hidden .txt extension, so the file remains a text document.
The correct answer is D: Hide extensions—more precisely, disable Hide extensions for known file types in File Explorer’s Folder Options. Then the user can see and replace the complete filename:

text Document.txt ? Document.xml

The file type shown in Properties confirms that .txt is still the actual extension. Note that changing an extension does not convert the file’s contents; it only changes how Windows and applications identify it.
Anonymous

AI Explanation - verified by User8779 on: September 01, 2026
Question 6:
Correct answer: D — Coldline Storage
For disaster recovery backups, data is usually stored for long periods and retrieved only during an incident. Coldline Storage is designed for data accessed less than once per quarter, including:

Disaster recovery backups

Long-term backup retention

Data archiving that still needs occasional access

Why the others are less suitable:

Multi-Regional Storage: Intended for frequently accessed data needing broad geographic availability; it costs more.

Regional Storage: Suitable for frequently accessed data within one region.

Nearline Storage: Intended for data accessed roughly once per month, such as monthly backups.

Coldline Storage: Better fit for backups accessed only during a disaster or occasional recovery event.

The key exam clue is backup data for disaster recovery: infrequent access with a need for relatively quick retrieval, which points to Coldline, rather than Archive Storage.
San Jose, United States

AI Explanation - verified by bmaxcollins on: September 03, 2026
Question 866:
Correct answer: B — Chief information security officer (CISO).
The CISO’s primary responsibility is to direct and coordinate the organization’s information security program. This includes:

Reviewing security objectives to ensure they support business goals.

Ensuring security requirements are integrated consistently across business units.

Coordinating security policies, risk management, controls, and awareness activities.

Why the others are less appropriate:

Executive management: Provides direction, funding, and support, but usually does not manage day-to-day security integration.

Board of directors: Provides governance and oversight, not operational security coordination.

Steering committee: Helps coordinate and prioritize initiatives, but the CISO typically owns the overall security program and ensures its integration.

The key distinction is between governance and execution: senior leadership and the board govern and support security, while the CISO manages and integrates the security program.
Kampala, Uganda

AI Explanation - verified by User8087 on: August 26, 2026
Question 72:
Correct answer: B. Patching the CA
The attacker exploited a flaw in the internal PKI by creating specially crafted certificates that granted domain administrator rights. The Certificate Authority (CA) is responsible for issuing and validating those certificates, so it must be patched or otherwise remediated to eliminate the vulnerability.
Why the other options are less suitable:

Updating the CRL: Revokes compromised certificates, but does not fix the CA flaw that allowed them to be created.

Changing passwords: May be necessary if accounts were compromised, but it does not address the certificate-generation vulnerability.

Implementing SOAR: Improves security automation and response; it does not remediate the underlying PKI weakness.

A useful exam distinction: certificate revocation handles the immediate compromise; patching the CA fixes the root cause.
Durham, United Kingdom

AI Explanation - verified by User8449 on: September 01, 2026
Question 23:
Correct answer: D — Hashing
Hashing creates a fixed-length integrity value for the source code. Tom can compare the current file’s hash with a trusted baseline hash:

Matching hashes suggest the file has not changed.

Different hashes indicate that the file was modified, whether authorized or unauthorized.

Why the others are weaker:

Backup: Helps recover the previous version but does not identify or stop unauthorized changes.

File labels: Classify or mark files; they do not verify integrity.

Security audit: May discover weaknesses or improper changes, but is periodic and not a direct technical integrity control.

Important nuance: Hashing primarily detects unauthorized modification rather than preventing it. In a real DevOps environment, prevention would also involve version control, access restrictions, code review, and change management. Given these choices, hashing is the best answer because it provides reliable change detection.
Lisbon, Portugal

AI Explanation - verified by User3451 on: September 02, 2026
Question 9:
The answer key shows A, but its explanation is technically misleading.
Because the objects use SSE-S3, Amazon S3 manages the encryption keys. The Amazon Bedrock execution role does not need kms:Decrypt permission or access to a customer-managed KMS key.
The role should instead have the required Amazon S3 permissions, such as:

s3:GetObject for the relevant objects

s3:ListBucket if listing is required

Appropriate bucket and object resource permissions

Therefore, A is the closest option, but it should be interpreted as ensuring that the Bedrock role has permission to access the S3 data—not as granting KMS decryption permissions.
Why the others are wrong:

B: Making the bucket public is insecure and unnecessary.

C: Prompt engineering cannot override AWS IAM or encryption permissions.

D: Data sensitivity does not determine whether the role can access it.

If the data used SSE-KMS instead, then the role would additionally need kms:Decrypt permission on the KMS key.
Bengaluru, India

AI Tutor 👋 I’m here to help!

CompTIA 220-1002 Exam Prep (Retired and replaced with 220-1201) (Page 20 )

QUESTION: 41

QUESTION: 42

QUESTION: 43

QUESTION: 44

CompTIA 220-1002 Exam Prep
(Retired and replaced with 220-1201) (Page 20 )