Domain 2 of 4 · Chapter 1 of 2

Encryption & Access Control

Encrypting the disk: BitLocker, FileVault, LUKS, EFS

A laptop is stolen from a parked car. If the drive was encrypted, the thief who pulls it out and connects it to another machine sees only ciphertext; if it was not, they read every file, password store, and cached credential at leisure. That single scenario is why full-disk encryption (FDE) is the first data-protection control that domain 2.0, Security, of the CompTIA A+ Core 2 (220-1202) exam objectives[1] expects a technician to reach for. Screen locks and account passwords stop a live login, but they do nothing against an attacker who removes the disk; only encrypting the data at rest does.

This page owns the preventive half of the Security domain: encrypting data at rest, deciding which account may do what, proving identity, and securing wireless. Its sibling Malware Defense owns the other half, hostile code and its removal, so a reader arriving from there is starting a new topic rather than re-reading one. Two words recur throughout: a volume is the formatted region of a disk that gets its own drive letter, and NTFS is the Windows file system that stores a permission list on every file and folder. The sections that follow make four decisions routine: which encryption control fits a stated threat, what a given account may do to a given file, what counts as a genuine second factor, and which wireless settings to choose or switch off.

BitLocker on Windows

BitLocker encrypts an entire Windows volume with AES (XTS-AES on current Windows), and it ships on the Pro, Enterprise, and Education editions, not Home. Microsoft describes it as protection "especially when a device is lost or stolen" by encrypting "entire volumes" (BitLocker overview[2]). You manage it from the Control Panel applet or the manage-bde command line.

Command line: checking and enabling BitLocker with manage-bde

The manage-bde tool reports and controls encryption on a volume. The -status verb shows how far a volume is encrypted; -on starts encryption and -recoverypassword adds a numeric recovery key at the same time:

manage-bde -status C:
manage-bde -on C: -recoverypassword

The TPM and the recovery key

The Trusted Platform Module (TPM) is a hardware chip (version 1.2 or 2.0) that stores keys and performs cryptographic operations in tamper-resistant hardware (TPM overview[3]). BitLocker seals its volume key to the TPM and asks the TPM to release that key only when the measured startup path is unchanged. If the firmware, boot loader, or disk location changes, the TPM withholds the key (BitLocker countermeasures[4]). The -recoverypassword from the listing above is that break-glass path: a 48-digit recovery key that unlocks the volume when the TPM refuses, when someone forgets a PIN, or when the disk is moved to new hardware. Back it up off the device, to a Microsoft account, Active Directory, a printout, or a file, because a recovery key stored only on the encrypted drive is a recovery key you cannot reach (BitLocker recovery[5]). You can strengthen unlock by adding a startup PIN or USB key on top of the TPM, turning a silent unlock into a pre-boot factor. For removable drives, BitLocker To Go applies the same volume encryption to USB flash and external disks, unlocked by a password or smart card. The unlock decision the TPM makes at every boot is worth picturing, and the figure below traces it from power-on to unlock: a BitLocker recovery prompt on an otherwise healthy PC almost always lands on that figure's "No" branch.

EFS, FileVault, and LUKS

EFS (Encrypting File System) is the odd one out: instead of the whole volume, it encrypts individual files and folders on NTFS, keyed to one user's certificate, and decryption is transparent while that user is logged in (EFS overview[6]). It protects a file from other users of the same running machine, which BitLocker does not, but it leaves the rest of the disk in the clear, which BitLocker does not. The two are complementary, not substitutes. On other platforms the FDE role is filled by FileVault on macOS (whole-startup-disk XTS-AES, unlocked by the login password with a recovery key or iCloud fallback) and by LUKS (Linux Unified Key Setup) on Linux (whole disk or partition via dm-crypt, unlocked by a passphrase held in one of several key slots). The through-line: BitLocker, FileVault, and LUKS defend a powered-off device against disk theft, while EFS defends specific files on a running one.

Power on the PCTPM measures the startup pathMeasurements matchthe sealed key?TPM releases the keyvolume unlocks with no promptStartup path changedor disk movedenter 48-digit recovery keyYesNo
BitLocker's per-boot unlock: the TPM releases the key silently when startup measurements match, and falls back to the 48-digit recovery key when they do not.

Accounts, least privilege, and UAC

Two questions decide who can touch what on a Windows machine: which account you log in as, and what that account is allowed to do to each file. Both answer to one rule, least privilege: give every account only the access its job needs, and no more. This section takes up the first question; the next takes up the second.

Standard vs administrator accounts

A standard user account can run installed apps and change its own settings but cannot install software system-wide, change other users, or alter protected system areas. An administrator account can. The best-practice pattern is to do daily work in a standard account and keep administrator rights for the moments that genuinely need them, so that a piece of malware running in your session inherits only standard-user power and cannot silently reconfigure the system.

User Account Control

User Account Control (UAC) is what enforces that separation in practice. When an action needs administrator rights, UAC interrupts on a dimmed secure desktop and asks for approval before the action proceeds (UAC: how it works[7]). The prompt differs by account: a standard user must type an administrator's credentials (an over-the-shoulder elevation), while an administrator only clicks to consent. Even an administrator runs most of the time with a standard token and is elevated only for the approved action. A UAC prompt is therefore the system working as designed, not a fault, and disabling UAC to stop the prompts removes the elevation gate malware would otherwise have to pass.

NTFS permissions, inheritance, and share permissions

Which account you log in as is only half the answer; the other half is what that account may do to each file, and over the network a second permission layer joins in.

NTFS permissions and inheritance

Once you are logged in, NTFS permissions decide what you can do to each file and folder. NTFS grants permissions to a user or group at levels that build on each other: Read, then Read & Execute and List Folder Contents, then Write, then Modify, then Full Control (Windows access control lists[8]). Permissions are set once high in the tree and flow down: by default a child object inherits the permissions of its parent folder, so a subfolder and the files in it receive whatever the parent grants (ACE inheritance[9]). You can break inheritance on a child to manage it independently, converting the inherited entries to explicit ones or removing them. Two ordering rules decide conflicts: an explicit Deny overrides an Allow, and an explicit permission set on the object itself overrides one it would have inherited.

The diagram below traces that downward flow: Modify granted once on the parent reaches the file two levels down without being set again.

NTFS vs share permissions

One distinction the exam presses on: NTFS permissions apply to every access, local or network, while share permissions apply only when the folder is reached over the network. When both are in play, the effective permission for a network user is the most restrictive combination of the two. So a share that grants Full Control but sits on a folder whose NTFS permission is Read yields Read for a remote user, and a local user (who never touches the share layer) is governed by NTFS alone.

Parent folderModify granted to Staff group (explicit)Subfolderinherits Modify from the parentFileinherits Modify from the subfolderinheritsinherits
NTFS inheritance: a permission granted once on a parent folder flows down to subfolders and files until inheritance is broken.

Authentication: passwords, MFA, biometrics, tokens, SSO

A help-desk ticket says an account was compromised even though it had a long password. The fix is almost never a longer password; it is a second factor. Authentication on the exam is built from a small set of factor types, and the strong answers combine them.

Passwords and lockout: the floor

A password policy sets minimum length, complexity, history (no reuse), and maximum age, among other account-policy settings, and "complexity" is itself a rule set rather than a single switch. On its own a password is a single secret an attacker can guess, so it is paired with an account-lockout policy that locks the account after a set number of failed attempts, which stops automated online guessing cold (account lockout policy[10]). Lockout is the floor of authentication, not the ceiling.

Multifactor authentication

Multifactor authentication (MFA) requires two or more factors from different categories:

  • Something you know: a password, PIN, or security question.
  • Something you have: a hardware token, smart card, security key, or a phone running an authenticator app.
  • Something you are: a biometric such as a fingerprint or facial recognition.

The categories matter more than the count. A password plus a PIN is still single-factor, because both are things you know; a password plus a code from an authenticator app is true MFA, because it adds a different category. That is why a leaked password alone no longer grants access under MFA: the attacker is missing the second category. The figure below groups the common mechanisms into the three factor categories, which are the core of most authentication questions.

Biometrics, tokens, and SSO

Biometrics are the "are" factor. Windows Hello, for example, signs a user in with a fingerprint, facial recognition, or an iris scan instead of a typed password (Windows Hello[11]). A biometric is convenient and hard to steal remotely, but it cannot be changed if it is ever compromised, which is why it is usually one factor among several rather than the only one.

Tokens are the "have" factor and come in two forms. A hardware token is a physical device: a key-fob that shows a rotating one-time code, a smart card, or a FIDO2 security key that plugs into USB. A software token is an authenticator app on a phone that generates the same style of time-based one-time code without dedicated hardware (OATH software vs hardware tokens[12]).

Single sign-on (SSO) authenticates you once and then reaches many systems without a fresh login at each, which is why signing in to a Windows domain can open file shares, mail, and intranet apps with no further prompt. SSO cuts password fatigue, but it also means one captured credential unlocks everything behind it, so SSO is meant to be layered with MFA rather than used as a security control by itself.

Something you knowPasswordPINSecurity questionSomething you haveAuthenticator appSecurity keySmart cardSomething you areFingerprintFacial recognitionIris scan
The three authentication factor categories; MFA means combining factors from two or more of them, not two from one.

Wireless security: WPA2, WPA3, and what to disable

A home-office router ships with a security dropdown offering WEP, WPA, WPA2, and WPA3. Picking the right entry, and turning off the wrong feature, is a recurring technician task and a reliable exam question. The rule in one line: choose WPA3, accept WPA2 with AES if a client is too old for WPA3, and never settle for WEP or leave WPS on.

The four protocols

Wireless security has gone through four generations, and each fixed the last one's break:

Protocol Cipher Authentication Status
WEP RC4 Shared key Broken; crackable in minutes
WPA TKIP PSK or Enterprise Deprecated; TKIP is weak
WPA2 AES-CCMP PSK or Enterprise Acceptable with AES
WPA3 AES (CCMP/GCMP) SAE or Enterprise Current standard

WEP (Wired Equivalent Privacy) uses the RC4 cipher with a weak initialization vector and can be recovered in minutes with captured traffic, so it is never an acceptable answer. WPA was an interim fix built on TKIP, which is now deprecated and weak. WPA2 introduced AES-CCMP (the Counter Mode with CBC-MAC Protocol, built on AES) and remains acceptable as long as AES, not TKIP, is selected. WPA3 is the current standard, giving stronger protection against password-guessing attempts and greater cryptographic strength (Wi-Fi Alliance security[13]); it uses AES and, in Personal mode, the SAE handshake covered next. When a stem offers both AES and TKIP, AES/CCMP is the strong choice and TKIP is the trap.

SAE: why WPA3 resists password cracking

WPA3-Personal replaces WPA2's pre-shared-key four-way handshake with SAE (Simultaneous Authentication of Equals). The practical payoff for a technician is one specific thing: an attacker who captures the SAE exchange cannot take it home and brute-force the passphrase offline (SAE / Dragonfly, RFC 7664[14]), the attack that has long threatened WPA2 networks with weak passwords. SAE also gives forward secrecy, so cracking one session does not expose past traffic.

Personal vs Enterprise

Both WPA2 and WPA3 come in two modes that differ in who verifies the credential:

  • Personal mode uses a single pre-shared key (PSK): one passphrase configured on the access point and shared by everyone on the network. Simple for a home or small office, but the shared secret cannot be revoked for one person without changing it for all.
  • Enterprise mode uses 802.1X: the device (the supplicant) authenticates through the access point (the authenticator), which relays credentials via EAP to a RADIUS authentication server that verifies each user individually before the port opens (802.1X and EAP[15], RADIUS, RFC 2865[16]). Each user gets their own revocable credential, so removing one person does not disturb the rest.

The figure below puts the two paths side by side: one shared passphrase checked at the access point, or credentials relayed onward to a RADIUS server that answers for each user individually.

Turn WPS off

Wi-Fi Protected Setup (WPS) lets a user join by pressing a button or entering an eight-digit PIN. The PIN method is the problem: a design flaw lets an attacker brute-force it in hours because the router validates the PIN in two halves, collapsing the search space. Disable WPS on any network you care about, regardless of which WPA version protects it.

Personal mode: one shared passphrase (PSK)DeviceAccess pointchecks the shared keyWi-Fi networkone passphrasejoinEnterprise mode: 802.1X to a RADIUS serverDevice(supplicant)Access point(authenticator)RADIUS serververifies each userEAP loginrelays
Personal mode: the access point checks one shared passphrase. Enterprise mode: the access point relays 802.1X credentials to a RADIUS server that verifies each user.

Exam-pattern recognition

Security questions on this exam reward matching the symptom in the stem to the one named control that fits it. The wrong answers are almost always real controls aimed at the wrong problem.

  1. "Protect data on a laptop that could be lost or stolen." The answer is full-disk encryption: BitLocker on Windows, FileVault on macOS. A screen-lock password is the distractor, because it does nothing once the disk is removed.
  2. "BitLocker keeps prompting for the recovery key on a healthy PC." Something in the boot path changed or the disk moved, so the TPM withheld the key. Enter the 48-digit recovery key and investigate the firmware or hardware change; the recovery prompt is the design, not a bug.
  3. "Encrypt a couple of sensitive files for one user, not the whole disk." The answer is EFS. BitLocker is the trap here, because it encrypts entire volumes rather than individual files.
  4. "A standard user tries to install software and gets a prompt for an administrator password." That is UAC requesting elevation, and it is working correctly. Supply admin credentials for the install; disabling UAC to stop the prompt is the wrong move.
  5. "Give a group read-only access to a shared folder." Set the NTFS Read permission for that group, and remember that over the network the effective access is the most restrictive of the NTFS and share permissions, and that an explicit Deny overrides an Allow.
  6. "Stop repeated password-guessing against an account." The answer is an account-lockout policy, which locks the account after a set number of failed attempts. A longer password does not stop automated guessing the way lockout does.
  7. "Add a second authentication factor." The answer is MFA using a different category, such as an authenticator app (have) or a fingerprint (are). Requiring a second password or a PIN on top of a password is the trap: both are things you know, so it stays single-factor.
  8. "An access point is still on WEP or TKIP." Upgrade to WPA3, or WPA2 with AES if a device is too old for WPA3. Choosing WPA2 with TKIP, or leaving WEP, are the distractors.
  9. "Neighbors are joining the Wi-Fi using the router's PIN or button." WPS is enabled; disable it, because its eight-digit PIN is brute-forceable.
  10. "Each employee needs an individual, revocable Wi-Fi login." The answer is WPA2/WPA3-Enterprise with 802.1X and a RADIUS server, not a single pre-shared key that everyone shares.

Data-at-rest encryption tools compared

AspectBitLockerEFSFileVaultLUKS
PlatformWindows Pro/Ent/EduWindows Pro/Ent/EdumacOSLinux
ScopeWhole volumeIndividual files/foldersWhole startup diskWhole disk or partition
Bound toThe device (TPM)The user's certificateThe device and login passwordA passphrase (key slots)
Unlock and recoveryTPM, PIN, or USB key; 48-digit recovery keyUser certificate; data-recovery agentLogin password; recovery key or iCloudPassphrase; multiple key slots
CipherXTS-AESAES per fileXTS-AESAES via dm-crypt

Decision tree

Encrypt the whole volume?Windows Pro/Ent/Edu?macOS?EFSper-file, Windows Pro+BitLockerwhole volume; To Go for USBFileVaultmacOS startup diskLUKSLinux disk or partitionWindows Home: no BitLocker or EFS managementuse Device Encryption where the hardware supports itNo: filesYes: whole volumeYesNoYes: macOSNo: Linux
Cheat sheet

Sharp facts the exam loves — give these one last read before exam day.

Cheat sheet

Sharp facts the exam loves — scan these before test day.

Full-disk encryption is what protects a lost or stolen device

Full-disk encryption (FDE) is the control for data at rest on portable devices, because it turns a removed drive into ciphertext an attacker cannot read on another machine. A screen lock or account password only blocks a live login; it does nothing once the disk is pulled out. BitLocker (Windows), FileVault (macOS), and LUKS (Linux) all encrypt the whole volume with AES.

Trap Relying on a login or screen-lock password to protect data at rest; it is bypassed the moment the drive is removed and read on another computer.

6 questions test this
Match the full-disk encryption tool to the operating system

Each OS has its own full-disk encryption tool: BitLocker on Windows, FileVault on macOS, and LUKS on Linux. They are not interchangeable, so the right answer follows the platform in the stem. All three encrypt the entire volume rather than selected files.

Trap Answering BitLocker for a Mac or Linux host; BitLocker is Windows-only, and those platforms use FileVault and LUKS.

4 questions test this
BitLocker needs Windows Pro, Enterprise, or Education

BitLocker is available on the Pro, Enterprise, and Education editions of Windows, not Home, and it encrypts an entire volume with AES. You manage it from the Control Panel applet or the manage-bde command line. Windows Home instead offers Device Encryption on hardware that supports it, which is a more limited, automatic form.

Trap Expecting the full BitLocker management tools on Windows Home; Home only has Device Encryption where the hardware qualifies.

1 question tests this
The TPM releases BitLocker's key only for an unchanged boot

The Trusted Platform Module (TPM) is a hardware chip that seals BitLocker's volume key and releases it only when the measured startup path is unchanged. Change the firmware or boot loader, or move the disk to another machine, and the TPM withholds the key, forcing the recovery key. You can layer a startup PIN or USB key on top of the TPM for a pre-boot factor.

Trap Assuming a BitLocker disk moved into another PC will simply unlock; the TPM is bound to the original machine's boot, so it demands the recovery key.

3 questions test this
Store the 48-digit BitLocker recovery key off the device

BitLocker's recovery key is a 48-digit number that unlocks the volume when the TPM refuses, a PIN is forgotten, or hardware changes. Back it up somewhere off the encrypted drive: a Microsoft account, Active Directory, a printout, or a file on other media. A recovery key saved only on the encrypted disk cannot be reached when you need it.

Trap Saving the recovery key only onto the encrypted drive itself, leaving no way in once the volume locks.

8 questions test this
BitLocker To Go encrypts removable USB and external drives

BitLocker To Go applies BitLocker's volume encryption to removable media such as USB flash drives and external disks, unlocked by a password or a smart card. It is the answer for encrypting portable media, whereas standard BitLocker targets fixed system and data volumes.

1 question tests this
EFS encrypts individual files for one user, not the whole disk

The Encrypting File System (EFS) encrypts selected files and folders on NTFS, keyed to a single user's certificate, and decrypts them transparently while that user is signed in. It protects a file from other users of the same running machine, which BitLocker does not, but leaves the rest of the disk in the clear. Lose the user's certificate and the encrypted files become unrecoverable.

Trap Choosing BitLocker to encrypt just a few files for one user; BitLocker works on whole volumes, while EFS is the per-file tool.

15 questions test this
An admin password reset can orphan another user's EFS files

Resetting a user's Windows password from an administrator account, rather than the user changing it themselves, can leave that user's EFS-encrypted files unrecoverable, because the file-encryption certificate is tied to the original credentials. Use a proper password change or a configured data-recovery agent when EFS is in play.

Trap Force-resetting a password from another admin account for a user with EFS-encrypted data, then finding the encrypted files can no longer be opened.

3 questions test this
Do daily work as a standard user, not an administrator

Least privilege means each account gets only the access its job needs, so routine work should run under a standard account. Malware or a mistake in a standard session inherits only standard-user power and cannot silently reconfigure the system, install services, or touch other users. Administrator accounts are reserved for installs and configuration changes.

Trap Running day-to-day as a local administrator for convenience; any malware in that session immediately has full administrative control.

7 questions test this
A UAC prompt is the elevation gate, not a malfunction

User Account Control (UAC) interrupts before any change that needs administrator rights and asks for approval on a secure desktop. A standard user must supply an administrator's credentials, while an administrator just consents, and even admins run with a standard token until elevated. The prompt is the system working as designed.

Trap Disabling UAC to stop the prompts; that removes the elevation gate malware would otherwise have to clear.

9 questions test this
NTFS grants Read, Modify, or Full Control per user or group

NTFS permissions are assigned to a user or group and build up in scope: Read, then Read & Execute and List Folder Contents, then Write, then Modify, then Full Control. Full Control adds the ability to change permissions and take ownership, which the lower levels do not. NTFS permissions apply to both local and network access.

1 question tests this
Child files and folders inherit the parent's NTFS permissions

By default a subfolder or file inherits the NTFS permissions of its parent folder, so a permission set once high in the tree flows down without being reassigned. You can break inheritance on a child to manage it independently, which converts the inherited entries to explicit ones or removes them. This is why auditing one top-level folder tells you most of what its contents allow.

13 questions test this
An explicit Deny overrides an Allow in NTFS

When NTFS permissions conflict, an explicit Deny beats an Allow, and an explicit permission on the object beats one it inherited. The Allows a user picks up from several groups are cumulative, so Read plus Modify adds up to Modify, but one explicit Deny still overrides them all. So a user who is allowed access through one group but explicitly denied through another is denied. Deny entries are strong, which is why least-privilege designs prefer granting narrow Allows over stacking Denies.

Trap Assuming a user's group Allow wins when another of their groups carries an explicit Deny; the Deny takes precedence.

7 questions test this
Combine NTFS and share permissions by the most restrictive

Share permissions apply only when a folder is reached over the network, while NTFS permissions apply to every access, local or remote. When both are set, a network user's effective permission is the most restrictive of the two combined. A local user never crosses the share layer, so NTFS alone governs them.

Trap Granting Full Control on the share and overlooking a Read-only NTFS permission underneath; the remote user still gets only Read.

Account lockout, not a longer password, stops online guessing

An account-lockout policy locks an account after a set number of failed sign-in attempts, which halts automated online password guessing that a longer password alone does not stop. The password policy still sets minimum length, complexity, history, and maximum age, but lockout is what defeats repeated live attempts.

Trap Answering 'require a longer password' to stop repeated failed logins; only lockout actually halts the automated guessing.

MFA needs factors from two different categories

Multifactor authentication combines two or more factors from different categories: something you know (password, PIN), something you have (token, security key, authenticator app), and something you are (biometric). The categories matter, not the count, so two secrets of the same kind do not qualify. A leaked password alone cannot get in when a second category is required.

Trap Counting a password plus a PIN as MFA; both are 'something you know', so it stays single-factor.

9 questions test this
Biometrics are the 'something you are' factor

Biometrics such as a fingerprint, facial recognition, or an iris scan are the 'something you are' factor, and Windows Hello uses them to sign in without a typed password. A biometric is hard to steal remotely but cannot be reissued if it is ever compromised, so it usually serves as one factor among several rather than the sole credential.

Hardware tokens are physical; software tokens are an app

Both token types are the 'something you have' factor. A hardware token is a physical device: a key-fob showing a rotating one-time code, a smart card, or a FIDO2 security key on USB. A software token is an authenticator app on a phone that generates a time-based one-time code without dedicated hardware.

SSO logs in once for many systems, so pair it with MFA

Single sign-on (SSO) authenticates a user once and then grants access to many systems without a fresh login at each, which is why one domain sign-in can open shares, mail, and apps. That convenience concentrates risk, because one captured SSO credential unlocks everything behind it, so SSO is meant to sit on top of MFA rather than replace it.

Trap Treating SSO as a security improvement on its own; without MFA, a single stolen credential reaches every linked system.

WPA3's SAE handshake blocks offline passphrase cracking

WPA3-Personal replaces WPA2's pre-shared-key four-way handshake with SAE (Simultaneous Authentication of Equals), so an attacker who captures the exchange cannot take it away and brute-force the passphrase offline, the attack that threatens WPA2 networks with weak passwords. SAE also provides forward secrecy, so cracking one session does not expose earlier traffic.

Trap Assuming a captured WPA3 handshake can be cracked offline the way a WPA2 handshake can; SAE is built to prevent that offline dictionary attack.

4 questions test this
Choose AES/CCMP encryption, never TKIP

WPA2 introduced AES-based CCMP, the strong wireless cipher still in use, while TKIP was the interim WPA cipher and is now deprecated and weak. When a router offers both, select AES rather than TKIP or a mixed TKIP+AES mode. WPA3 likewise mandates AES-based encryption.

Trap Selecting WPA2 with TKIP (or a TKIP+AES mix) when AES-only is available; TKIP is the deprecated, weak option.

2 questions test this
WEP is broken and is never the right choice

WEP (Wired Equivalent Privacy) uses the RC4 cipher with a weak initialization vector and can be cracked in minutes from captured traffic, so it is never an acceptable wireless setting. If a legacy device only supports WEP, isolate it on a separate network rather than dropping the whole network's security to WEP.

Trap Selecting WEP because an old device lists it as an option; WEP is trivially crackable, so segregate the legacy device instead.

Disable WPS because its eight-digit PIN is brute-forceable

Wi-Fi Protected Setup (WPS) lets a device join by pressing a button or entering an eight-digit PIN, and the PIN method is the flaw: the router validates it in two separate halves, shrinking the search space enough to brute-force it in hours. Turn WPS off regardless of which WPA version protects the network.

Trap Leaving WPS enabled because the network already uses WPA2 or WPA3; the WPS PIN is a separate weakness independent of the WPA version.

Use WPA Enterprise (802.1X/RADIUS) for per-user revocable logins

Personal mode shares one pre-shared key (PSK) across everyone on the network, so revoking one person means changing the passphrase for all. Enterprise mode uses 802.1X: the device authenticates through the access point to a RADIUS server that verifies each user individually, giving every user a revocable credential. Choose Enterprise when logins must be per-user and revocable.

Trap Using a shared pre-shared key when each employee needs an individually revocable Wi-Fi login; that requires Enterprise mode with RADIUS.

6 questions test this
Add a user to a built-in local group to grant one right without admin

Windows built-in local groups grant a specific privilege without full administrator rights, which is the least-privilege choice: add a user to Backup Operators to let them back up and restore files, or to Remote Desktop Users to let them sign in over Remote Desktop. Membership is managed in Local Users and Groups (lusrmgr.msc).

Trap Putting the user in the Administrators group when a narrower built-in group already carries the one right they need.

5 questions test this
An EFS Data Recovery Agent decrypts files when the user's key is gone

A Data Recovery Agent (DRA) is an account whose certificate is designated, usually through Group Policy, to decrypt any user's EFS-encrypted files. It is how an administrator recovers encrypted data after an employee leaves or their profile and private key are lost. Without a preconfigured DRA, EFS files whose owning key is unavailable are unrecoverable.

Trap Reaching for an administrator password reset, which cannot decrypt another user's EFS files and can orphan them.

9 questions test this
A burst of Event ID 4625 in the Security log is a brute-force attack

Windows records each failed sign-in as Security event ID 4625, so hundreds of 4625 entries in a short window, especially from one source address or against one account, signal an automated brute-force or password-guessing attack. A successful logon is the separate event ID 4624. Account lockout is the control that halts the guessing.

Trap Treating event ID 4624 (a successful logon) as the failure to hunt for.

8 questions test this
Windows Defender Firewall blocks unsolicited inbound by default and allows outbound

By default Windows Defender Firewall blocks any inbound connection that does not match an allow rule while permitting outbound traffic, so keeping inbound blocked across all profiles is what limits malware from spreading laterally between machines. Blocking outbound instead is a deliberate hardening step to cut off command-and-control traffic, not the default behavior.

Trap Assuming the firewall blocks outbound traffic by default, when only unmatched inbound is blocked.

7 questions test this
The firewall's Domain profile applies only when a domain controller is reachable

Windows Defender Firewall keeps separate rule sets for the Domain, Private, and Public profiles and switches between them automatically through Network Location Awareness. The Domain profile is applied only when the PC can authenticate to its domain controller; on untrusted networks such as coffee-shop Wi-Fi the Public profile with its most restrictive defaults applies, and a domain PC that cannot reach a controller also falls back to Public.

Trap Expecting a domain-joined laptop to keep the Domain profile on public Wi-Fi, when it can no longer reach a domain controller.

6 questions test this
Set password and lockout policy in Local Security Policy, but domain GPO overrides it

On a standalone Windows workstation, password and account-lockout rules are configured in Local Security Policy (secpol.msc) under Account Policies, in the Password Policy and Account Lockout Policy sections. Once the machine is domain-joined, a domain Group Policy Object overrides those local settings, which is why local password rules appear greyed out or stop taking effect after the join.

Trap Editing local secpol.msc on a domain-joined PC and expecting it to win over the domain policy.

5 questions test this
Match the lost-device action to whether the data must survive

Choose the mobile-device response by the scenario: a remote wipe erases all data on a device that is lost for good, a remote lock secures a device you expect to recover without destroying its data, and an enforced screen-lock PIN plus auto-erase after several failed passcode attempts protects an unattended or stolen device from passcode guessing. When someone shoulder-surfs a PIN, setting a new PIN restores that one credential.

Trap Reaching for a remote wipe on a device that is only temporarily misplaced, when a remote lock preserves the data.

5 questions test this
'Passwords must meet complexity requirements' sets categories, length, and no username

When the Group Policy setting 'Passwords must meet complexity requirements' is enabled, a password must contain characters from at least three of four categories (uppercase, lowercase, digits, and symbols), be at least six characters long, and not contain the user's account name or full display name. It enforces these rules together, separate from the standalone minimum password length setting.

Trap Assuming complexity alone sets a long minimum, when minimum password length is its own separate policy.

4 questions test this

References

  1. CompTIA A+ Core 2 (220-1202) Certification Exam Objectives (V15, Document Version 3.0)
  2. BitLocker overview
  3. Trusted Platform Module (TPM) technology overview
  4. BitLocker countermeasures
  5. BitLocker recovery overview
  6. Encrypting File System (EFS) file encryption
  7. How User Account Control (UAC) works
  8. Access control lists (ACLs)
  9. ACE inheritance
  10. Account Lockout Policy
  11. Windows Hello for Business overview
  12. OATH tokens (software and hardware) authentication method
  13. Wi-Fi Alliance security (WPA2 / WPA3) Whitepaper
  14. RFC 7664: Dragonfly Key Exchange (SAE) Whitepaper
  15. Extensible Authentication Protocol (EAP) and network access
  16. RFC 2865: Remote Authentication Dial In User Service (RADIUS) Whitepaper