A customer’s smartphone has been overheating frequently and becoming unresponsive since installing an OS update. A technician has already performed a soft reboot of the device. Which of the following should the technician perform NEXT? (Choose two.)

Roll back the OS update
Update the PRL
Force stop running applications
Enable airplane mode
Perform a factory reset
Run application updates
Reset network settings

Answer(s): A,F

Show Answer Next Question

QUESTION: 42

Joe, a user, cannot read encrypted email messages on a corporate smartphone, but he has been able to read them in the past. A technician restarts Joe's smartphone, but the issue remains. The technician deletes the corporate email account and has Joe re-add it, verifying all settings are correct. Despite these steps, the issue persists.

Which of the following is MOST likely causing the issue?

The certificate is expired.
The TPM is bad.
The phone is not encrypted.
The incorrect mail server is selected in settings.

Answer(s): A

Show Answer Next Question

QUESTION: 43

A user moves a file from one NTFS disk to another NTFS disk. Which of the following describes the changes to the file permissions?

The file has both the source and destination permissions
The file keeps the source permissions
The file permissions have to be set manually
The file receives the destination permissions

Answer(s): D

Show Answer Next Question

QUESTION: 44

A technician has enabled port security on a switchport.

Which of the following BEST describes the effect this will have?

Devices must match a list of allowed MAC addresses before accessing the network.
Devices need to conform to the policies set forth by the MDM software.
Data loss prevention software will be monitoring for data exfiltration on the port.
A firewall is actively monitoring the network traffic using heuristic analysis.

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 31 of 64
Viewing questions 121 - 124 out of 701 questions

Post your Comments and Discuss CompTIA 220-1002 exam prep with other Community members:

Comments:

Name:

220-1002 Exam Discussions & Posts
220-1002 AI Verifications

anon on: March 04, 2025
Anyone use the free version to help them pass the test? Can't really afford the pdf version right now.
UNITED STATES

senan on: March 02, 2025
salam bu ne suallardi bele
AZERBAIJAN

HCipher on: February 12, 2025
i can certify for anyone planning to take the exam that these questions are up to date and representative of the actual exam, but i strongly urge you to read, and understand the material as comprehensively as you could ensuring you learned as best as you possibly could. before learning the dumps, as acquiring the certificate without any knowledge gained is a futile endeavor for your career progression and the likes
PORTUGAL

The Professor on: December 21, 2024
Passed the A+ today. Many of these questions are valid but be careful to read your questions first because the answer may change based on the conditions in the question
UNITED STATES

CompTIA on: December 03, 2024
These questions are valid but you can't rely on them. We do not use these questions no more. On god.
UNITED STATES

Jury on: April 10, 2024
i just passed my A+ core 2 today. 4 of my PBQ was exactly the same with this practice test. it6 is really worth understanding all the questions here. big help!! thank you so much!! Aiming for my Sec+ now before 601series expires in July
Anonymous

Marc on: March 14, 2024
This exam dumps is valid in US as of yesterday. I can say that it helped a lot with my exam. A lot of relevant topics.
UNITED STATES

Jacob on: February 12, 2024
This exam is one of the hardest ones. You cannot pass without using these exam dumps. Just an FYI to others, majority of these questions are in the exam.
Italy

GetGo on: August 11, 2023
It was pretty easy to pass this exam with the help of this exam dumps PDF. Free version is not complete. I paid for the full version with 50% sale.
Anonymous

AI Explanation - verified by User2971 on: June 26, 2026
Question 22:
Question 22 asks which control plane protocol is used for mapping and resolving endpoints in a Cisco SD-Access fabric.
Correct answer: D) LISP
Explanation:

In SDA, the control plane uses LISP (Locator/ID Separation Protocol) to map Endpoint IDs (EIDs) to routing locators (RLOCs) and to resolve where endpoints are within the fabric.

The mapping information is distributed via the LISP control plane (MAP-REGISTER/MAP-REPLY to MAP-SERVER/MAP-NOTIFY as needed).

The overlay data plane in SDA is VXLAN, so VXLAN handles encapsulation, not endpoint mapping; DHCP handles addressing, not mapping, and SXP isn’t the endpoint-mapping protocol in this context.

Plano, United States

AI Explanation - verified by lilianobi28 on: July 08, 2026
Question 158:
Question 158 asks which method would most likely be used by attackers to perform credential harvesting.

Correct answer: A) Social engineering.

Why: Credential harvesting is about tricking users into revealing usernames and passwords. Social engineering (e.g., phishing, pretexting) directly targets people to disclose credentials, often via fake login pages or convincing messages.

Why the other options are less likely:

- Rainbow table: offline password cracking, not harvesting credentials from users. - Supply chain compromise: can lead to malware or compromised software, but not the direct act of collecting user credentials. - Third-party software: could be a vector for infection, but the explicit credential harvesting method is typically social engineering.
Defensive takeaways:

Train users to recognize phishing and social engineering attempts.

Implement MFA to reduce credential impact.

Use password managers and unique passwords.

Verify URLs and sender authenticity before entering credentials.

Run phishing simulations to strengthen awareness.

Lagos, Nigeria

AI Explanation - verified by User1229 on: June 29, 2026
Question 20:
Heads up — the answer key on this page lists B, but the correct choice is D: Your custom endpoint is not acknowledging messages within the acknowledgement deadline.
Why D is correct:

For push subscriptions, Pub/Sub expects your HTTPS endpoint to return a successful 200 response quickly to acknowledge each message.

If the endpoint doesn’t acknowledge within the configured ack deadline (or fails with an error), Pub/Sub will redeliver the message. This can lead to duplicates.

The other options are unlikely causes of duplicates:

- Message size being too large would typically cause a delivery error, not repeated duplicates. - An out-of-date SSL certificate would cause TLS failures, not repeated successful deliveries. - If the topic has too many messages, Pub/Sub would throttle or backlog, but not inherently create duplicates.
What to do:

Ensure the endpoint responds quickly with 200 OK.

Consider increasing the ack deadline if processing takes longer, or design the endpoint to be idempotent.

Implement robust error handling and retries with backoff. Consider a dead-letter topic if delivery consistently fails.

Emsworth, United Kingdom

AI Explanation - verified by User2092 on: June 26, 2026
Question 4:
Question 4 asks about what’s most important to consider around data in AI projects.
Stated answer on the page: C.
My take (based on data-centric AI principles and PMI objectives):

The best choice is likely D: “Have team members that have experience, understanding of tools, and the ability to deal with massive volumes of data.”

Why:

- AI success hinges on not just data but on how well people can manage it—data governance, quality, labeling, provenance, and data pipelines require skilled teams. - This option emphasizes the capability to handle data at scale, which supports proper data management and governance.

Why the others are less fitting:

- A and B promote collecting or hoarding data without addressing governance/quality. - C focuses on choosing algorithms, which is important but secondary to having the right data and data-management skills.
Note: The exam page warns that some answer keys may be wrong. If you’re studying for the real exam, use this explanation to compare with your own understanding of data governance and data-centric AI, and test against the official objectives.
Bengaluru, India

AI Explanation - verified by User8896 on: June 16, 2026
Question 14:
Question 14: The correct answer is A (Fairness).
Why:

The sentence emphasizes fairness as a core ethical principle in AI.

Fairness aims to prevent discriminatory or biased decisions based on attributes like gender, race, sexual orientation, or religion.

What this means in practice:

Ensure AI decisions are non-discriminatory and treat people equitably.

Use bias checks, diverse and representative data, and regular audits to detect and mitigate unfair outcomes.

Align with trusted AI guidance by incorporating fairness into design, testing, and monitoring processes.

Kaohsiung, Taiwan

AI Explanation - verified by User5856 on: June 29, 2026
Question 41:

The correct answer: Health policy

Explanation:

In Cisco Firepower Management Center (FMC), health data from managed devices is handled by the health monitoring system. The Health policy defines how health information from devices (health modules, hardware/software status) is collected, interpreted, and how alerts are generated and displayed in FMC.

This is distinct from:

- system policy — global/system settings on devices - correlation policy — rules for correlating and aggregating alerts - access control policy — traffic allow/deny rules

So, when asked which policy collects health module alerts from managed devices, you look to the Health policy.

Johannesburg, South Africa

AI Explanation - verified by User3355 on: June 22, 2026
Question 1:
You're right — the correct answer is D (1).
Explanation:

Network Security Groups (NSGs) contain the inbound/outbound rules.

If all five VMs are in the same subnet, you can attach a single NSG to that subnet.

That one NSG will apply to all NICs in the subnet, giving identical rules to all VMs.

Attaching NSGs to NICs individually would require up to five NSGs, which is not minimal.

Sandton, South Africa

AI Explanation - verified by User6170 on: June 16, 2026
Question 53:

Answer: C

Why: The scenario describes BYOD (employees using personal devices). The correct stance is that the company may not own the device, but it is responsible for protecting the business data on any device used for work. This aligns with data-protection principles that data remains the company’s responsibility regardless of device ownership, so appropriate controls (e.g., encryption, access controls) should be applied to protect that data.

Why the others are weaker:

- A downplays increased risk from BYOD, which isn’t consistent with risk-based security. - B suggests the company always owns the device, which isn’t realistic in BYOD contexts. - D suggests reducing BYOD, which isn’t a proactive data-protection approach.
Curitiba, Brazil

AI Explanation - verified by User8237 on: July 07, 2026
Question 2:
You're right—Finland means User2 does not meet the Left side of the rule.
Updated takeaway for User2:

Left side (usageLocation in ["US","AU"] AND department == "Sales" AND NOT (jobTitle == "Manager")) cannot be true for a user in Finland.

The only way to include User2 is if the Right side is true: jobTitle == "SalesRep".

So, User2 is added to the group only if their jobTitle is SalesRep. If not, they are not included.
What I need to finalize for you:

What is User2’s jobTitle (and, if possible, the jobTitles for User1 and User3)?

If none have SalesRep, then none would be added unless they meet the Left-side conditions (US/AU location, Sales department, not Manager).

Share the jobTitle data and I’ll pinpoint exactly who belongs.
Rozendaal, The Netherlands

AI Explanation - verified by User3355 on: June 22, 2026
Question 15:
Question 15 explanation:

Correct answer: C. You should restore the VM to a new Azure VM.

Why:

In a ransomware scenario, you want to recover from a known-good backup in a clean environment to avoid reinfection.

Azure Backup Instant Restore lets you mount the backup and bring it up as a new VM, isolating it from the infected VM.

Restoring to the infected VM (A), or to any existing VM (B), risks reinfecting or conflicts, and restoring to an on-premises device (D) is not supported by Azure Backup Instant Restore.

After validating the new VM is clean, you can securely recover data and redeploy as needed.

Sandton, South Africa

AI Explanation - verified by User9999 on: July 04, 2026
Question 24:
Question 24 asks: A LTM device needs to load balance active and passive FTP traffic while using only a single virtual server. Which virtual server type should be configured?

Correct answer (per the key): Forwarding (IP) [option E].

Why this works:

FTP uses dynamic data ports and has two modes:

- Active: server connects back to the client for the data channel. - Passive: client connects to the server for the data channel.

A non-terminating, IP-forwarding virtual server (Forwarding (IP)) simply passes traffic to the pool members without terminating the TCP session. This avoids the complexities of FTP port range translation and protocol handling inside the LTM, allowing both active and passive connections to be established through a single VIP.

In contrast, a Standard virtual server terminates the connection and would require FTP protocol handling (FTP profiles) and can complicate single-VIP support for both modes.

In short: Forwarding (IP) preserves end-to-end FTP behavior for both active and passive modes using one virtual server.
Thalwil, Switzerland

AI Explanation - verified by sshuang68 on: June 28, 2026
Question 325:
Question 325: Which algorithms are used to secure REST API from brute attacks and minimize the impact?
Answer: D) PBKDF2, BCrypt, and SCrypt
Why:

These are password hashing / key-derivation algorithms designed to be slow and salted, which dramatically lowers the success rate of brute-force and rainbow-table attacks.

PBKDF2 uses a hash function with a configurable number of iterations and a salt.

BCrypt uses Blowfish with a cost factor and built-in salt.

SCrypt adds memory-hardness to resist GPU/ASIC cracking.

Why the others are less suitable:

A (SHA-512 and SHA-384): fast hashes; no inherent salting or work factor, making brute-force easier.

B (MD5 and SHA-384): MD5 is insecure; even with SHA-384, these are not designed for password hashing.

C (SHA-1, SHA-256, and SHA-512): hashing without salt or work factor; vulnerable to brute-force and precomputed attacks.

Key idea: Use slow, salted, memory-aware hashing (PBKDF2, BCrypt, SCrypt) to protect credentials or derived keys in REST API authentication workflows.
Plano, United States

AI Explanation - verified by toabhi1 on: June 17, 2026
Question 129:
Yes. For automatic load balancing across multiple read-only replicas, you should use the Hyperscale service tier.
In Q129 the intended combo is:

Box 1: A single Azure SQL Database

Box 2: Hyperscale

Reason: Hyperscale supports multiple read-only replicas and read-scale-out, which distributes read requests across the replicas and minimizes admin effort. (Note: in Premium/Business Critical, only one read-only replica is accessible at a time, so that wouldn’t meet the “load balance across all replicas” requirement.)
Vagholi, India

AI Explanation - verified by User1830 on: June 12, 2026
Question 12:
Correct answer: B) AWS Service Catalog
Explanation:

AWS Service Catalog lets you create and manage a catalog of IT services and resources that are approved for use. This provides governance over what can be deployed, including Infrastructure as Code (IaC) templates like CloudFormation stacks.

It enforces access controls, approvals, and standardization, so deployed IT services follow your internal policies.

Why others aren’t correct:

- AWS Resource Explorer helps discover resources, not govern IaC templates. - AWS Organizations handles account structure and policies across accounts, not IaC governance. - AWS Systems Manager offers automation and management of resources, but not the centralized governance of IaC templates in a catalog.
Mumbai, India

AI Explanation - verified by User7912 on: June 28, 2026
Question 58:
Question 58 is about Azure Policy scope and exclusions.
Key idea:

Policy can be assigned at any of the fourScope levels: management groups, subscriptions, resource groups, or individual resources. You can also exclude a subscope from the assignment.

Based on the hotspot:

Box 1 (where you can assign Policy1): Tenant Root Group, ManagementGroup1, Subscription1, RG1, and VM1.

- You can place a policy at the top of the hierarchy (root), a specific management group, a subscription, a resource group, or a single resource.

Box 2 (what you can exclude from Policy1): ManagementGroup1, Subscription1, RG1, and VM1.

- You can exclude a subscope from the assignment, such as a particular management group, subscription, resource group, or even a specific resource.
Why this matters:

Assigning at a higher scope applies the policy broadly; exclusions let you carve out exceptions without moving the policy.

There are four levels of scope, and exclusions apply to subscopes within the chosen assignment.

Québec, Canada

AI Explanation - verified by User4394 on: June 16, 2026
Question 3:
Question 3 asks which filter option to use on a Cortex XSIAM dashboard widget when you want data filtered by more than one dynamic value.

Answer: B — Multi-select.

Why: The Multi-select filter lets you choose multiple dynamic values for a widget, enabling the visualization to show data that matches any or all of those selected values (depending on the widget’s configuration). This is essential when you want to explore data across multiple criteria at once.
What the other options do:

Free text/number: filters by arbitrary text or numeric input, not constrained to predefined dynamic values.

Fixed filter: filters by a single, fixed value.

Single-select: filters by only one dynamic value at a time.

Example: If you want a widget to show events from multiple hosts (hostA, hostB, hostC), use Multi-select to select all three hosts.
Hyderabad, India

AI Explanation - verified by User7110 on: June 26, 2026
Question 50:

Correct answer: Multivariate Anomaly Detection (C)

Why: Your system analyzes multiple engine sensor metrics (rotation speed, angle, temperature, pressure). Detecting atypical values across several metrics together requires modeling the correlation between metrics over time. Multivariate Anomaly Detection detects anomalies in groups of metrics, helping you identify unusual patterns that single-metric methods might miss.

Why the others are less suitable:

- Application Insights in Azure Monitor is for app telemetry and not specifically for multi-mensor anomaly detection. - metric alerts in Azure Monitor are typically threshold-based on individual metrics, not looking at joint patterns. - Univariate Anomaly Detection handles only one metric at a time, missing cross-metric anomalies.

How it fits: Use the Anomaly Detector service’s multivariate API to ingest time-series data from all sensors and configure alerts when the model flags anomalies. This avoids needing labeled data and leverages AI to detect complex, joint anomalies.

Holbeck, United Kingdom

AI Explanation - verified by User6244 on: June 23, 2026
Question 16:
Here’s the breakdown for question 16.

Correct answer: On-Demand Instances (D)

Why:

The app runs for only 2 months each year, with a strict uptime requirement.

On-Demand has no long-term commitment and costs only for the hours used, making it the most cost-effective option for short, predictable windows.

Reserved Instances (long-term 1-year or 3-year commitments) would waste money for just 2 months.

Spot Instances are cheaper but can be interrupted, which violates the “no downtime” requirement.

Dedicated Hosts are unnecessary for standard workloads and are more expensive, usually used for licensing/compliance needs.

Tip to meet uptime: even with on-demand, design your app architecture across multiple Availability Zones and use health checks/auto-scaling to tolerate zone failures and minimize downtime.
New Delhi, India

AI Explanation - verified by User5486 on: June 22, 2026
Question 1:

Correct options: C and D — Support Group and Owned by Group.

Why: When a Technology Management Service Offering is related to a Dynamic CI Group, the offering’s Support Group and Owned by Group are synchronized to the member CIs. This maintains consistent operational ownership and support alignment across the CIs in the group.

Why not A or B: Approval Group and Managed by Group are not synchronized in this scenario, so they aren’t automatically pushed to the member CIs.

Pune, India

AI Explanation - verified by User8662 on: June 15, 2026
What is a Voting model in AutoML

A Voting model in AutoML is an ensemble that combines predictions from multiple trained models to produce a final prediction.

Types:

- Hard voting: uses the majority class label among the base models. - Soft voting: averages the predicted class probabilities from the base models and picks the class with the highest average probability. - For regression, it typically averages the predictions from the base models.

Why use it: leverages diversity among models to improve accuracy and robustness by reducing bias/variance.

When to use: when several models have complementary strengths and you want a more stable, better-performing predictor.

Forest Hill, United Kingdom

AI Explanation - verified by User8554 on: June 22, 2026
Do these questions come for the exam
Short answer: not reliably. These questions come from a community-contributed bank and are not guaranteed to appear on the actual exam. In fact, the page itself notes that a meaningful percentage of the provided answers are WRONG.
What you should do instead:

Focus on official objectives and Microsoft Learn material for the exam topic.

Use these questions only as rough practice to check understanding of concepts, not as a predictor of exact exam content.

If a question contains an image you can’t see here, describe it and I’ll explain the underlying concept.

If you want verified answers for the full question bank, that’s available with the premium/full version. I can also walk through any concept from these questions and map it to the official objectives. Which topic or item would you like to review?
Erode, India

AI Explanation - verified by User1889 on: July 01, 2026
Question 9:
Question 9 asks you to combine the products from two Excel tables (Table1 and Table2) into a single column with no duplicates, using Power Query Editor.
Key idea:

You want a single list of unique products. To do this, align the source columns, stack the rows, then remove duplicates.

Typical three-action sequence (conceptual):

Keep only the product column in each table (use Remove Other Columns or Select Columns and rename to a common name, e.g., Product).

Append Queries (combine the two tables so their product columns become one column in a single table).

Remove Duplicates (on the appended table) to ensure only unique product values remain.

Why this order works:

Aligning/renaming columns ensures the append produces a single column instead of multiple columns.

Appending stacks all products from both tables into one list.

Removing duplicates yields the final table with one column of unique products.

If you can share the exact three actions shown in the image, I can map them precisely to this order.
Islamabad, Pakistan

AI Explanation - verified by User4554 on: June 19, 2026
Question 8:

Answer: B) Problem management

Why: Problem management handles the lifecycle of problems, including root-cause analysis and permanent fixes to prevent recurrence. If vulnerabilities are discovered after go-live, they’re problems that need investigation and remediation, not just a one-off change or a user service request.

How it differs from the others:

- Change control: manages approval and coordination of changes to implement fixes (but the core practice for handling the post-live vulnerability is problem management). - Service level management: focuses on ensuring services meet agreed performance and quality levels. - Service desk / Service request management: handles user requests and single incidents, not the root-cause analysis of underlying vulnerabilities.

In short, post-go-live vulnerabilities are addressed primarily by problem management, with fixes potentially moving into changes through the Change Control process.

Kuala Lumpur, Malaysia

AI Explanation - verified by User4575 on: June 17, 2026
you have said the correct answer in the last response. The Answer is A
You’re right—in your UI, using Save as New Template (A) is the practical path when there is no Clone option.
Why A can be correct in your environment:

It creates an editable copy of the standard template without altering the original.

It works when cloning isn’t available or permitted by your admins.

Concise steps for A:

Open the Standard Version Email Prompt Template.

Use the option Save as New Template (or equivalent).

Name it (e.g., “UC_Custom_Email_Prompt”) and save.

Open the new template and edit as needed (tone, grounding, output format).

Test with sample data.

If you see any discrepancy on exam guidance versus your UI, I can help explain the reasoning and map it to the objective. Want me to quickly review how this question aligns with the exam objectives or walk through another item with your UI in mind?
Sydney, Australia

AI Explanation - verified by User2971 on: June 26, 2026
Question 38:
Question 38 is about migrating a campus from a traditional design to a programmable fabric (SD-Access style). The core idea is: to ease the move to a fabric, start with a simpler, more migration-friendly design at the access layer.
Key concepts:

Traditional campus: often a three-tier design (Access ? Distribution ? Core) with lots of routing at the access layer.

Programmable fabric design: relies on centralized policy, overlay networks, and fabric-enabled switches that join a single fabric.

Why two-tier Layer 2 helps migration:

A two-tier/Layer 2 access approach keeps host connectivity in a large L2 domain at the edge while the fabric overlay handles policy and segmentation. This makes it easier to introduce fabric components gradually without reworking every access switch.

It reduces early complexity from routing decisions at the access layer and aligns with the initial fabric deployment model, where the focus is on policy, segmentation, and centralized management.

Why three-tier routed access is less ideal for a gradual fabric migration:

It enforces more routing at the access layer and can complicate the integration of fabric overlays and centralized policies during the migration.

Note: The answer key on the page shows D, but based on SDA concepts, two-tier Layer 2 access (A) is typically the design that facilitates this migration. If you’re unsure, verify against Cisco SDA design guides to see which option they intend for your exam version.
Plano, United States

AI Explanation - verified by anush.g2589 on: June 18, 2026
Question 3:
I can’t see the image for question 3, so I can’t tell which host the system indicates as the origin. Here’s how to approach a hotspot/forensics style question like this:

Goal: identify the origin host (where the infection started) and then classify the other hosts as clean or infected.

Step 1: gather logs from all sources

- Host logs (process creation, file changes, network activity) - Firewall/IDS/IPS logs (incoming/outgoing connections, unusual destinations) - DNS logs, authentication logs, and any SIEM alerts - Any indicators of compromise (hashes, mutexes, registry changes)

Step 2: build a timeline

- Find the earliest suspicious event across hosts. - Note the sequence of events: which host first communicates with a suspicious external address, which host shows lateral movement, etc.

Step 3: determine the origin

- The origin host typically shows the initial compromise before other hosts are affected. - Look for the first beaconing, first unusual process, or first external connection that matches later activity on other hosts.

Step 4: classify other hosts

- If a host shows IOC matches (same malware hash, same C2 domain, same suspicious process), label it infected. - If a host has no IOC matches and no anomalous activity, consider it clean, but verify with cross-host comparisons.

Helpful clues

- Shared IOC across hosts (same file hash, same C2 domain) - Similar persistence mechanisms or scheduled tasks appearing on multiple machines - Coordinated timing between hosts around a specif
Hyderabad, India

AI Explanation - verified by cyberexus on: June 18, 2026
Question 27:
For Question 27, the best choice is B: capacity analysis of IT operations.
Why:

Capacity analysis assesses current resource utilization and forecasts future demand, helping determine whether IT resources (people, hardware, software, facilities) are sufficient to meet business needs. This directly evaluates the effectiveness of IT resource planning.

Why the others are less appropriate:

A. Budget execution status shows spending against budget, not whether resources are adequate or planned appropriately.

C. Succession plan for key IT personnel focuses on continuity of personnel, not overall resource planning effectiveness.

D. A list of new applications to be implemented describes future initiatives, not whether resource planning has properly anticipated needs.

So, capacity analysis provides the most direct evidence of whether IT resource planning is effective.
Kyiv, Ukraine

AI Explanation - verified by User1740 on: July 07, 2026
Question 72:
Question 72 asks for a service to rotate database user credentials with the least operational overhead.

Correct answer: B) AWS Secrets Manager

Why:

AWS Secrets Manager is designed to securely store and rotate secrets, including database credentials.

It supports automatic rotation for many databases (e.g., RDS) with built-in templates, reducing manual automation work.

This minimizes operational overhead because you don’t have to build and maintain your own rotation logic.

Why the others are less suitable:

AWS Systems Manager: can store credentials, but rotation typically requires custom automation and scripting, leading to more overhead.

AWS License Manager: not related to credential rotation.

AWS Managed Services: helps operate your environment but isn’t a built-in solution for rotating database credentials.

Rawalpindi, Pakistan

AI Explanation - verified by tjgalti on: July 05, 2026
Question 29:

Key concept: The LTM has an SSL Transactions Per Second (TPS) license limit. Any TLS transactions beyond that limit in a given second are dropped (silently).

Given:

- TLS TPS license limit: 500 - New TLS transactions attempted: 2560 per second

Calculation:

- Accepted: 500 - Discarded: 2560 - 500 = 2060

Correct option: “2060 new TLS transactions will be silently discarded due to the SSL TPS license limit.”

Note: The exam page lists the first option (560 discarded) as the answer, but that is incorrect based on the 500 TPS limit and 2560 attempts.

Thalwil, Switzerland

AI Explanation - verified by rajasree4525 on: June 25, 2026
Question 164:
I can explain the concept behind Q164. I can’t view the [Image], but here’s how to reason it.

Key constraint: Azure Cosmos DB for NoSQL has a maximum item (document) size of 2 MB. The error “413 Entity too large” means the item you’re uploading would exceed this limit.

Implication: If you’re uploading multiple files as separate items, each file must be <= 2 MB. Files larger than 2 MB cannot be uploaded as a single document.

Given the provided answer key (B: File1 and File2 only), that means File1 and File2 are <= 2 MB, while File3, File4, and File5 exceed the limit.

If you want to verify yourself, check the sizes of File1–File5 and confirm which are under 2 MB. If you need to store larger data, consider keeping large binaries in Blob Storage and store references (URIs) in Cosmos DB.
Pathanamthitta, India

AI Explanation - verified by User1224 on: July 06, 2026
Question 8:

Answer: No

Why: HTTP health probes are meant for web services and expect HTTP responses. SQL Server does not speak HTTP on port 1433, so an HTTP probe will fail even if the backend is up.

Correct approach: Use a TCP health probe on port 1433 (or the port used by your AG listener). A TCP probe simply checks that a TCP connection can be established to the backend, which is appropriate for SQL Server.

Additional notes:

- Ensure the AG listener port matches the probe port (default 1433 for SQL Server). - If you use a non-default port, configure the probe accordingly. - Make sure firewall/NIC/NSG rules allow traffic on that port to the backend SQL Server instances.
Noida, India

AI Explanation - verified by User9262 on: June 29, 2026
Question 487:
The correct answer is C (21).

The FTP control plane uses a TCP connection to port 21 on the server. This channel carries the FTP commands (USER, PASS, LIST, RETR, STOR, etc.) and responses.

The data plane (actual file transfer) uses a separate connection. In active mode it typically uses port 20 on the server side, while in passive mode the server selects a dynamic high port for data transfer.

The other ports listed are for different protocols: 23 (Telnet), 22 (SSH), and 24 is not the FTP control port.

So, for the question about the FTP control plane port, you should choose 21.
Bekasi, Indonesia

AI Explanation - verified by User7120 on: July 07, 2026
Question 1:
Question 1 asks how to configure items so they can be set as either company-owned or consignment when the item is created.
What the options mean and why they matter:

Enable the Owner dimension (option B): This introduces an ownership attribute for inventory. By turning on Owner, you can assign stock to “Company” or “Vendor/Consignment” ownership, which is exactly how you distinguish company-owned from consignment items in D365.

Enable the Batch dimension (option A): Batch tracking is for lot/batch numbering, not ownership. It doesn’t help you model ownership (consignment vs. company-owned), so it’s not required for this objective.

Costing model choices (options C and D): The costing method (e.g., Moving average vs. Standard costing) is a separate setting from ownership. You can choose either method depending on your cost policy; however, the question’s objective is about ownership configuration, not cost valuation.

Reason the stated answer makes sense: B is clearly needed to model ownership. D is presented as the chosen costing model to accompany ownership in this scenario; the costing method is a separate decision, but standard costing is a common choice for stable valuation.
If you want, I can walk through how to enable the Owner dimension in the item setup.
Chennai, India

AI Explanation - verified by User7240 on: June 13, 2026
Question 10:
The answer is No.
Why:

For migrating VMs to an Azure pay-as-you-go subscription, the appropriate expenditure model is Operational Expenditure (OpEx), i.e., pay-as-you-go consumption costs.

The term elastic expenditure model isn’t a standard Azure cost model. It’s not the recognized way to bill pay-as-you-go cloud resources.

Therefore, recommending the elastic expenditure model does not meet the goal; the correct approach would be OpEx (pay-as-you-go).

Frankfurt Am Main, Germany

AI Explanation - verified by User1035 on: June 23, 2026
Question 144:
Answer: D

Why: In a regulated rollout that must stay flexible, a product backlog provides a living, prioritized list of work items, including regulatory or compliance changes. It lets the PMO and team adapt priorities as constraints evolve.

Why not A: A burndown chart shows remaining work over time, not visibility into regulatory constraints.

Why not B: A burnup chart shows scope vs. progress, but it still focuses on metrics rather than explicitly capturing regulatory constraints.

Why not C: A kanban board improves flow and accountability, but it doesn’t explicitly facilitate visibility into regulatory constraints.

How this helps: Represent regulatory requirements and changes as backlog items with clear acceptance criteria, and continuously re-prioritize as regulations evolve, maintaining governance without stalling delivery.

Marupe, Latvia

AI Explanation - verified by juris.siksna on: June 29, 2026
Question 456:
The question asks what to do during closing when a deliverable isn’t meeting customer expectations. The best move is to address the gap by renegotiating scope so that both parties are satisfied.
Answer: C
Why:

Closing doesn’t mean ignoring issues. If a deliverable doesn’t meet expectations, you should work with the customer to agree on a revised scope that will satisfy both sides. This may involve a change in scope that is processed through the change control process, leading to new acceptance criteria and sign-off.

This keeps the project aligned with customer needs while ensuring formal acceptance or a clearly defined path to resolution.

Why the other options are weaker:

A suggests the customer must issue a change request, which isn’t typically how the PM handles defects or gaps; changes usually come from the project team or customer through formal change control.

B is vague and doesn’t drive a path to resolution or re-define acceptance criteria.

D inappropriately escalates to the sponsor before attempting direct negotiation for a revised scope.

Key takeaways:

In closing, address unmet deliverables via a negotiated scope change that satisfies both parties and leads to formal acceptance.

Riga, Latvia

AI Explanation - verified by User6680 on: July 07, 2026
Question 332:
Correct answer: C

In IT asset management, the most significant risk is that unregistered assets are not included in security documentation. Without a complete, up-to-date asset inventory and linked documentation, you can’t apply proper controls, assess risk, or ensure compliance.

Why not the others:

- A) IT assets used for private purposes is a nuisance risk, but it’s primarily an acceptable-use or policy issue, not the core security risk of asset management. - B) Unregistered assets may not be supported is important, but its impact is downstream of not having assets documented at all. - D) Unregistered assets may not be configured properly stems from missing documentation, but the root problem is the absence of inventory and records (C).

Relationship to ISACA risk management: effective risk management requires a complete asset inventory linked to security controls and documentation; if assets aren’t documented, you can’t manage or measure risk properly.

Grovetown, United States

AI Explanation - verified by mohamedmusaraf05 on: July 06, 2026
Question 418:
Question 418 is about making sure a default route is advertised into OSPF.

Core idea: The command “default-information originate” only injects a default route into OSPF if the router actually has a default route (0.0.0.0/0) in its own routing table.

Why C is correct: Configure a static default on R1 pointing to the Internet gateway (for example, 10.10.10.18). This gives R1 a 0.0.0.0/0 route, so the router will originate a default into OSPF and VLAN 20 at Site B can reach the Internet DNS.

Why the other options aren’t ideal:

- A: Adding default-information originate on R2 isn’t necessary since R1 already originates it once it has a default route; R2 would learn the default from R1. - B: Using the always keyword (default-information originate always) causes R1 to advertise a default even without a real 0.0.0.0/0 route, which can lead to blackholes. - D: Configuring a default on R2 (to 10.10.10.2) may not point toward the actual Internet gateway and won’t ensure R1 is advertising a valid default into OSPF.
Answer: C
Chennai, India

AI Explanation - verified by raman.thulasi71 on: June 24, 2026
Question 204:
Answer: C. AWS Cost and Usage Report
Explanation:

The goal is to build QuickSight dashboards from billing data on a weekly cadence. The Cost and Usage Report (CUR) provides detailed, granular billing data that you can export to S3 and then feed into QuickSight (via Athena/Direct) for dashboards.

AWS Budgets tracks budgets and alerts; it isn’t a data source for BI dashboards.

AWS Cost Explorer offers insights through a UI, but isn’t designed as a direct data feed for automated BI dashboards.

AWS Cost Anomaly Detection focuses on identifying spend anomalies, not providing raw billing data for dashboards.

Chennai, India

AI Explanation - verified by User3601 on: June 17, 2026
Question 3:
Here’s why Server3 can access Server1’s file shares even though it has no connection security rule:

Connection Security Rules (IPsec) are separate from inbound file-sharing rules. You don’t need an IPsec rule on Server3 to access SMB shares.

File shares are allowed by inbound firewall rules on the destination. If Server1 has an inbound SMB rule (SMB-In) that permits traffic on port 445, Server3 can connect as long as authentication/permissions succeed.

If there’s an Isolation-type connection security rule on Server1, it would apply only if the traffic must be authenticated via IPsec. In this scenario, the SMB-In rule suffices.

What to verify quickly:

On Server1: run Get-NetFirewallRule -DisplayName "SMB" to confirm SMB-In is enabled.

Test connectivity to the SMB port: Test-NetConnection -ComputerName Server1 -Port 445.

Ensure Server3 is domain-joined (if an Isolation rule exists, it will still allow domain-joined machines).

Bottom line: Server3 doesn’t need a connection security rule to access a file share; the inbound SMB firewall rule on Server1 and proper authentication/permissions are what matter.
Melbourne, Australia

AI Explanation - verified by sshuang68 on: June 28, 2026
Question 303:
Answer: A
Reasoning:

To enforce a password expiry/age policy for local (local database) accounts on a Cisco gateway, you can attach the Common Criteria policy to the local user. The command would look like:

username admin privilege 15 password 0 Cisco13579! common-criteria-policy

The common-criteria-policy applies a baseline password policy that includes expiry (60 days in your scenario) and other criteria defined by the Common Criteria-compatible policy.

The other options don’t configure local-password expiry:

- B (AAA server) handles authentication on the server side, not the local account expiry on the gateway itself. - C, D don’t address the local-password expiry requirement.
So, enabling a Common Criteria policy on the local user is the correct way to ensure local passwords expire after 60 days. The referenced Cisco doc discusses the common-criteria-password policy for this purpose.
Plano, United States

AI Explanation - verified by canttouchthisemail2042 on: June 16, 2026
Question 104:
Answer: D
In ITIL 4, an incident is an unplanned interruption to a service or a reduction in the quality of a service. Option D mentions a service interruption, which captures the core idea of an incident. The phrase “resolved by the use of self-help tools” describes one possible resolution path (e.g., a user workaround), but the definition itself does not require self-help tools. The other options describe changes, risks, or outcomes that don’t define an incident.
Fayetteville, United States

AI Explanation - verified by User8648 on: June 27, 2026
Question 1:
Question 1 answer: A
Why:

S3 Transfer Acceleration uses CloudFront’s globally distributed edge locations to optimize uploads directly to the target bucket, reducing latency for cross-continent transfers. This fits “aggregate data from all sites as quickly as possible” into a single S3 bucket with minimal ops.

Using multipart uploads with the accelerated endpoint helps handle the large daily volume (500 GB per site) efficiently, enabling fast, reliable uploads of large objects.

This approach avoids the overhead of cross-region replicas, batch devices, or multiple storage/services that require more orchestration.

Why the other options are weaker:

B (Cross-Region Replication) adds lag and ongoing management; it won’t minimize operational overhead for a single central bucket.

C (Snowball Edge) is batch/manual and slower for continuous ingestion.

D (EC2/EBS with snapshots) adds complex cross-region data transfer and orchestration, not suited for rapid global ingestion into S3.

In short: enable S3 Transfer Acceleration on the destination bucket and use multipart uploads to ingest site data directly, which minimizes operational overhead while maximizing throughput.
Coimbatore, India

AI Explanation - verified by User7618 on: July 07, 2026
Question 73:
Correct answers: C and D

C Bastion host: inbound SSH (port 22) allowed only from the company’s external IP range. This restricts initial access to the bastion from the on-premises network over the public internet.

D Application instances: inbound SSH (port 22) allowed only from the bastion host’s private IP. This ensures subsequent access from the bastion to the private EC2 instances stays on the private VPC path.

Why not A, B, or E:

A would block the initial SSH from the on-premises network to the bastion.

B would allow only internal IPs, which would block access coming from the on-premises network via the internet.

E would allow inbound SSH from the bastion’s public IP, which is not how traffic originates when going through the bastion (the source for traffic to the private instances will be the bastion’s private IP).

Belgrade, Serbia

AI Explanation - verified by User6689 on: June 29, 2026
Question 26:

Short answer: No. Azure Information Protection is not the right fit to protect admin credentials during deployment.

Why: Azure Information Protection (AIP) protects data (documents, emails) by classification and rights management. It isn’t a secret management or credential vault for deployment pipelines. To securely handle credentials in automation, you need a secrets store and controlled access, not just encryption of data at rest/in transit.

Better approach: Use a secrets management solution such as Azure Key Vault.

- Store admin credentials (or, preferably, deploy-time credentials) as secrets or certificates in Key Vault. - Use a service principal or Managed Identity for your deployment automation to access Key Vault with least privilege (Get secrets). - Reference Key Vault secrets from your deployment templates or scripts (ARM templates, Terraform, or CI/CD pipelines) without exposing plaintext credentials.

Summary: AIP does not provide the proper secret management for automated deployments. The correct solution is to store and access credentials securely via Azure Key Vault (with proper access controls).

San José, Costa Rica

AI Explanation - verified by User9195 on: June 14, 2026
Question 21:
For Question 21, the recommended answer is B: Create an Action.
Why this is correct:

Quick Actions (Create a Record actions) allow users to create a child record directly from the parent Opportunity page, which is ideal for mobile entry.

You can configure the action on the Analysis object as a “Create a Record” action and add it to the Opportunity page layout. When tapped on mobile, it opens a simple form with the Opportunity prepopulated, enabling fast entry of a new Analysis.

Why the other options are less suitable:

Create a custom object tab: Gives access to the object but doesn’t streamline creating a new Analysis from the Opportunity context, especially on mobile.

Create a Visualforce page: More complex to build and maintain; not as mobile-friendly as a standard Quick Action.

Create a related list button: possible, but less optimal for mobile quick-entry and requires navigating the related list; Quick Actions are more directly accessible from the parent record.

In short, use a Quick Action labeled something like “New Analysis” on the Opportunity to enable easy mobile creation of Analysis records.
Bengaluru, India

AI Explanation - verified by User4006 on: June 17, 2026
Question 9:
Question 9 explanation:

Correct answer: D — ACID-compliant transactions.

Why: ACID guarantees atomicity, consistency, isolation, and durability for data operations. In a traditional data lake, writes can be partial or interleaved, leading to inconsistent or dirty reads during concurrent ingests. With ACID transactions in a lakehouse, each write is all-or-nothing, reads see a consistent state, concurrent operations don’t corrupt data, and committed data is durable. This directly improves data quality and reliability.
Why the other options don’t directly improve data quality:

Storing data in open formats helps interoperability, not necessarily data quality.

SQL query capability aids usability, but not guaranteed data correctness.

Storing both structured and unstructured data is a capability, not a quality guarantee.

So, the key feature driving data quality improvements over a traditional data lake is ACID-compliant transactions.
Kolkata, India

AI Explanation - verified by User8952 on: June 27, 2026
Question 4:
Question 4: Correct answer is C: Form Recognizer.
Why this fits:

Form Recognizer is built for automated data extraction from forms/receipts. It can identify and extract key data (e.g., vendor, transaction total) and return structured data with relationships, bounding boxes, and confidence.

It includes prebuilt models for receipts, invoices, etc., which minimizes development effort since you don’t need to train from scratch.

Why the others aren’t correct:

A. Custom Vision: for image classification/detection, not structured data extraction from forms.

B. Personalizer: for personalized recommendations, not receipts processing.

D. Computer Vision: provides general OCR, but not the specialized, structured extraction you get with Form Recognizer (no ready-made receipt model to pull vendor/total reliably).

Bottom line: use Form Recognizer to quickly and accurately extract top-level receipt data with minimal development.
Anonymous

AI Explanation - verified by User9195 on: June 14, 2026
Question 20:
Question 20 is about fixing performance issues when sharing rules are changed for a large number of accounts owned by a generic user.

Why A is correct: Ensure the generic user has NOT been assigned to a role. If the owner is not in a role, there’s less involvement of the role hierarchy in sharing calculations, which reduces the overhead when sharing rules are updated.

Why not B: Modifying the Modify All Data permission would grant broad access but doesn’t address the root cause or improve performance. It also introduces security risk.

Why not C: Asking Salesforce to index the account object might help some workloads, but it doesn’t address the sharing recalculation problem caused by ownership and role hierarchy, and indexing isn’t a guaranteed fix for this scenario.

Why not D: Setting OWD to public read/write would increase data access and complexity, likely worsening performance and security, not improving the issue.

Answer: A
Bengaluru, India

AI Explanation - verified by User9392 on: July 05, 2026
Question 23:
Question 23 explanation

Correct answer: A

Why this works:

- To see revenue by marketing campaign, use a standard Campaign report type that includes related Opportunities (Campaigns with Opportunities). This lets you pull Opportunity fields like Amount and filter to won opportunities. - By filtering for Won Opportunities, you attribute only actual revenue to each campaign, and you can sum the Opportunity Amounts grouped by Campaign.

Why the other options aren’t suitable:

- B: Periodic data jobs aren’t needed when you can report on live data from the Campaigns with Opportunities report type. - C: Roll-up summary fields require a Master-Detail relationship. Opportunities relate to Campaigns via a lookup, so you can’t create a roll-up from Opportunity to Campaign out-of-the-box. - D: A custom Total Value field with a workflow would require cross-object summing and isn’t feasible with standard automation on a lookup relationship without additional tools.

Quick steps to implement:

- Use the report type: "Campaigns with Opportunities." - Add columns: Campaign Name, Opportunity Amount. - Add a filter: Opportunity Stage = Closed Won. - Group by Campaign and summarize Amount to see revenue per campaign.
Edison, United States

AI Tutor 👋 I’m here to help!

CompTIA 220-1002 Exam Actual Questions (Retired and replaced with 220-1201) (Page 31 )

QUESTION: 41

QUESTION: 42

QUESTION: 43

QUESTION: 44

CompTIA 220-1002 Exam Actual Questions
(Retired and replaced with 220-1201) (Page 31 )