220-1202 Exam Dumps - CompTIA A+ Core 2 (2026 Exam Update)

The correct answer is D. Chain of custody process, because chain of custody ensures that evidence collected during an incident response is tracked, preserved, and legally defensible. It documents who collected the evidence, when it was collected, how it was stored, and who accessed it throughout the investigation.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, chain of custody is essential when evidence may be used in disciplinary actions, audits, or legal proceedings. Any gap in documentation can render evidence inadmissible.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that chain of custody provides accountability and prevents claims of evidence tampering. Each transfer of evidence must be logged and verified.

The Mike Meyers / Mark Soper Lab Manual clarifies that while order of volatility determines the sequence of data collection, it does not track ownership or handling. Data integrity best practices ensure evidence is not altered, but they do not provide a record of custody.

Because the question focuses on handling and accountability, the required process is chain of custody, making D the correct answer.

If the phone works on Wi-Fi but not off Wi-Fi, the most likely issue is that cellular data is disabled (or restricted). This aligns directly with the CompTIA A+ objective language for mobile troubleshooting, which explicitly includes “wireless/cellular data network (enable/disable).” After travel, users often enable airplane mode or disable cellular data to avoid roaming charges, and sometimes forget to re-enable it.

Quentin Docter’s mobile connectivity discussion repeatedly distinguishes Wi-Fi access from cellular connectivity and treats cellular settings as a primary area to verify when Internet access is not available away from Wi-Fi. While data caps/limits could throttle service, they usually don’t make all non-Wi-Fi browsing and email impossible immediately. VPN issues might block some access, but the simplest “most likely” resolution based on the symptom is re-enabling cellular data. Reinstalling the SIM is possible, but again not the first, most likely fix given the scenario framing. Therefore, Enable cellular data (A) is correct.

The issue described—“domain cannot be found” despite the ability to ping the server and access the internet—indicates aDNS resolution problem, not a network connectivity issue. The workstation is currently usingpublic DNS servers (8.8.8.8 and 1.1.1.1)whichcannot resolve internal domain names, such as the ones used in Active Directory environments. To resolve this, the technician needs tochange the DNS settings to point to the internal DNS server, which in most domain setups is thedomain controller itself (likely 192.168.1.10 in this case).

Here’s the breakdown of the incorrect options:

B. Assign a static IP address: The IP is already assigned and functioning; the device can ping and reach the network and internet.

C. Configure a subnet mask: The subnet mask is appropriate for the network range (Class C /24).

D. Update the default gateway: The gateway is valid and allows internet access; this is not the issue.

CompTIA A+ 220-1102 Core 2 Objective Reference:

Objective 1.8 – Given a scenario, use features and tools of the operating system.

Under this objective, candidates must know how to troubleshoot OS-based network configurations, includingproper DNS settings in domain environments.

—

After containment and remediation, one of the final steps in incident response is user education. Since the root cause was a phishing attack, it is essential to educate users about identifying phishing attempts, safe browsing practices, and how to handle suspicious communications. This improves overall security posture and helps prevent future incidents.

A. Installing additional tools may be helpful but is a long-term step.

C. Flashing router firmware is not warranted unless the network hardware is known to be compromised.

D. Suggesting more advanced tools might be excessive given that the EDR successfully contained the incident.

The correct answer is B. Restarting the print spooler from services, because the problem is isolated to one user and the print job is stuck or failed in the local print queue. This strongly indicates a print spooler service issue on the user’s workstation.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, the print spooler manages print jobs sent from applications to printers. If the spooler service hangs or becomes unstable, print jobs may fail even though network connectivity and the printer itself are functioning correctly.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that restarting the print spooler is a standard troubleshooting step when jobs remain in a failed or paused state. This clears the queue and reloads the service without requiring a full system reboot.

The Mike Meyers / Mark Soper Lab Manual reinforces that reinstalling printers should be done only after service-level troubleshooting has failed. Printing from another computer is unnecessary because other users are already printing successfully, confirming the printer and network are operational.

Because the failure is local to the user and visible in the queue, restarting the print spooler service is the most logical and efficient next step, making B the correct answer.

In secure or isolated network segments, DHCP may be disabled to reduce the risk of unauthorized device connections or to maintain strict IP assignment control. In such cases, the help desk technician must manually configure IP settings (including IP address, subnet mask, gateway, and DNS servers). This ensures the workstation communicates properly within that segment.

A. DNS server restriction is unrelated to manual IP configuration.

B. Allow lists refer to traffic access, but manual IP assignment is due to lack of DHCP, not allow lists.

D. NAC servers control access but don ' t replace the need for IP addressing.

Windows Helloallows biometric and PIN-based login, which are easier and more user-friendly than passwords.

FromQuentin Docter – CompTIA A+ Complete Study Guide:

“Windows Hello supports biometric authentication and PINs, providing easier and secure access especially for users who have trouble remembering passwords.”

The correct answer is A. DLP (Data Loss Prevention), because DLP solutions are specifically designed to detect, monitor, and prevent unauthorized transmission of sensitive data outside an organization. Information exfiltration occurs when confidential data is improperly transferred, leaked, or stolen, either intentionally or accidentally.

According to the Quentin Docter – CompTIA A+ Complete Study Guide, DLP technologies enforce policies that restrict how data can be shared via email, cloud services, removable media, or network transfers. DLP systems can block, quarantine, or alert administrators when sensitive data patterns—such as credit card numbers or personal identifiers—are detected leaving the organization.

The Travis Everett & Andrew Hutz – All-in-One Exam Guide explains that DLP focuses on data protection, not user authentication or device management. While IAM controls access to resources and MDM manages mobile devices, neither directly prevents data from being exfiltrated once access is granted.

The Mike Meyers / Mark Soper Lab Manual reinforces that SAML is an authentication framework and does not monitor data movement.

Because the question specifically addresses information exfiltration, the security control designed to prevent it is Data Loss Prevention, making A the correct answer.