22 Troubleshooting & Operational Procedures Practice Questions & Answers

1. 1. A technician theorizes that a workstation's intermittent network drops are caused by a failing network adapter. The technician installs a known-good adapter and the drops continue. Per the published troubleshooting best-practice methodology, what should the technician do next?

   • A.Verify full system functionality and implement preventive measures
   • B.Replace the motherboard, because the network adapter is integrated
   • C.Document the findings and close the ticket, since replacing the adapter did not help
   • D.Establish a new theory of probable cause, or escalate if no theory can be formed✓ Answer

   Testing a theory either confirms or disproves it. A disproved theory sends the technician back to the 'establish a theory of probable cause' step (or to escalation), because a plan of action may only be built on a confirmed cause. Verification comes after the fix, and documentation is always the final step, so neither can be done here.

   Source: CompTIA A+ troubleshooting methodology, published as a best-practice competency standard (test the theory / establish a new theory step)Report a problem with this question

2. 2. While repairing a customer's laptop at the customer's desk, a technician notices an open folder on the desktop containing personal photos and bank statements. What is the most appropriate action?

   • A.Copy the folder to a personal external drive so it is safe during the repair
   • B.Describe what was found to a coworker to get a second opinion about the customer
   • C.Open the files to confirm they were not damaged by the problem being repaired
   • D.Leave the files unopened, and do not view, copy, or discuss them; work only within the scope of the repair✓ Answer

   Professional conduct requires handling a customer's confidential and private materials with discretion: a technician accesses only what the authorized work requires, never copies private data to personal media, and never discusses what was seen. Opening or copying the files exceeds the scope of consent and can expose regulated data such as financial information.

   Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — professionalism and proper handling of customers' confidential and private materialsReport a problem with this question

3. 3. A desktop that is unplugged from the wall each night shows an incorrect date and time every morning, and its firmware settings have returned to defaults. Which is the most likely cause?

   • A.The drive's boot sector is corrupt
   • B.The power supply is failing under load
   • C.The RAM has failed and can no longer retain the clock value
   • D.The motherboard's CMOS (real-time clock) battery is depleted✓ Answer

   The coin-cell battery on the motherboard powers the real-time clock and the firmware's configuration memory whenever the system has no AC power. When that cell is depleted, the clock and the saved firmware settings reset every time the system loses power — the classic signature of a dead CMOS battery. RAM is volatile and never stores the clock.

   Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — motherboard/RAM/CPU/power symptom: inaccurate system date and timeReport a problem with this question

4. 4. A workstation runs normally while idle but shuts off abruptly a few minutes into a video-rendering job. The fans run loudly before it shuts down and the chassis interior is packed with dust. Which is the most likely cause?

   • A.A corrupt video driver is crashing the system
   • B.Thermal protection is shutting the system down because dust and inadequate cooling prevent heat from dissipating✓ Answer
   • C.Insufficient RAM is causing the operating system to halt
   • D.A depleted CMOS battery is cutting power

   A shutdown that occurs only under sustained load, preceded by fans spinning up, is a thermal event: the CPU or board reaches its trip point and cuts power to protect the silicon. Dust blankets heat sinks and blocks airflow. The fix order is clean the dust, verify every fan spins, reseat the heat sink, and reapply thermal paste. Low RAM or a bad driver produce errors or crashes, not a hard power-off, and the CMOS battery does not supply system power.

   Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — random shutdown and overheating symptomsReport a problem with this question

5. 5. A PC produces random crash screens at unpredictable times with different stop codes, and unrelated applications crash without a pattern. No new hardware or drivers were installed. What is the best next diagnostic step?

   • A.Reinstall the operating system immediately
   • B.Replace the CMOS battery
   • C.Run a memory diagnostic and test the modules one at a time✓ Answer
   • D.Defragment the system drive

   Every running process passes through RAM, so a failing memory module produces instability that is random rather than tied to one application, with varying stop codes. A memory diagnostic (and testing modules individually to isolate the bad stick) confirms the cause before any part is replaced. Reinstalling the OS is invasive and would not fix a hardware fault.

   Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — application crashes and system instability caused by faulty memoryReport a problem with this question

6. 6. A user reports that their magnetic hard drive has started making a rhythmic clicking noise and that files take a long time to open. There is no current backup of the data. What should the technician do first?

   • A.Immediately back up or image the drive to other media, then plan to replace it✓ Answer
   • B.Defragment the drive to reduce head movement
   • C.Run a full disk repair scan to correct the errors first
   • D.Update the storage controller driver and reboot several times

   Clicking or grinding from a spinning drive indicates mechanical failure of the heads or actuator, and such a drive degrades further with every additional read and write. Repair scans, defragmentation, and repeated reboots all add heavy I/O and can turn a partial loss into a total one, so preserving the data comes first; replacement follows.

   Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — storage drive symptoms: clicking/grinding noises and data lossReport a problem with this question

7. 7. A laptop's screen appears black, but when a bright flashlight is held close to it a faint image of the desktop is visible. An external monitor connected to the laptop displays normally. What is the most likely cause?

   • A.The display driver is corrupt and must be reinstalled
   • B.The graphics processor has failed
   • C.The LCD panel is cracked internally and must be replaced
   • D.The display backlight or its power circuit has failed while the LCD panel still renders the image✓ Answer

   An LCD does not emit its own light; the panel modulates light from a backlight behind it. If the image is present but only visible under external light, the panel, the video cable, and the GPU are all working and only the illumination source or its power circuit has failed. A dead GPU or corrupt driver would also break the external monitor, and a cracked panel would show physical distortion.

   Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — video and display symptoms: dim image and backlight failureReport a problem with this question

8. 8. Pages printed by a laser printer look correct, but the toner smears and rubs off onto the user's hands when the paper is handled. Which component is most likely at fault?

   • A.The toner cartridge, which is nearly empty
   • B.The print driver, which is the wrong one for the model
   • C.The fuser assembly, which bonds toner to the paper with heat and pressure✓ Answer
   • D.The imaging drum, which is dirty or scratched

   In the laser imaging process the fusing stage melts the toner powder into the paper fibers using heated rollers and pressure. If the image is placed correctly but never bonds, fusing did not occur, which points to a failed fuser. A dirty drum causes lines or speckles, low toner causes faded output, and a wrong driver causes garbled pages — none of those leave loose toner on the page.

   Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — printer symptoms and the laser imaging process (fusing stage)Report a problem with this question

9. 9. A workstation cannot reach any internal server or the internet. Its address is 169.254.72.14 with a mask of 255.255.0.0. Other computers on the same switch are working normally. What does this indicate?

   • A.The default gateway is blocking the workstation's outbound traffic
   • B.An administrator mistyped the subnet mask
   • C.The DNS server address configured on the client is wrong
   • D.The client could not reach a DHCP server, so it assigned itself an APIPA address✓ Answer

   An address in the 169.254.0.0/16 range is not handed out by any server; the host assigns it to itself after its DHCP discovery attempts go unanswered. Because APIPA has no gateway, the host can only talk to other APIPA hosts on the same segment. Since neighboring PCs work, troubleshooting should focus on that host's cable, switch port, and NIC, then on the DHCP scope.

   Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — limited connectivity and APIPA self-assigned addressingReport a problem with this question

10. 10. A user cannot open any website by name, but pinging a public web server by its IP address succeeds and file shares reached by IP address open normally. What does this isolate the problem to?

    • A.A name-resolution (DNS) failure, since IP-level connectivity clearly works✓ Answer
    • B.A physical cabling failure between the PC and the switch
    • C.An offline default gateway
    • D.A missing network adapter driver

    A successful ping by IP address proves the cable, adapter, addressing, and the path through the gateway are all functioning, so the fault cannot be physical or gateway related. The only step that fails is translating a hostname into an address, which is the name-resolution service; verify the configured DNS servers and test resolution with a name-lookup utility.

    Source: CompTIA A+ Core 1 exam objectives, Hardware and Network Troubleshooting domain — distinguishing name resolution failures from connectivity failuresReport a problem with this question

11. 11. After a desktop was moved to a new office, it powers on but displays a message that no bootable device or operating system was found. The firmware setup screen does not list the internal drive. What is the best next action?

    • A.Run a memory diagnostic
    • B.Reinstall the operating system from scratch right away
    • C.Check the firmware boot order and confirm the drive is detected, reseating its data and power cables✓ Answer
    • D.Replace the motherboard

    Firmware can only boot a device it can see, so a drive missing from the setup screen after physical transport points to a loosened data or power cable or a changed boot order — the cheapest and least invasive causes, which are checked first. Reinstalling the OS would destroy user data and would still fail if the drive is not detected.

    Source: CompTIA A+ Core 2 exam objectives, Software Troubleshooting domain — boot issues and 'no OS found' symptomsReport a problem with this question

12. 12. A domain-joined workstation's clock has drifted about 20 minutes ahead. The user can log in with a cached profile but cannot access any domain file shares and receives authentication errors. Other workstations are unaffected. What is the most likely explanation?

    • A.The workstation's DNS suffix is misconfigured
    • B.The network adapter has failed
    • C.The workstation's clock skew exceeds what domain ticket-based authentication tolerates, so its tickets are rejected✓ Answer
    • D.The user's password has expired

    Domain authentication uses time-stamped tickets and rejects any request whose clock differs from the domain controller by more than a small tolerance (about five minutes by default) as a replay-attack defense. Resynchronize the workstation with the domain time source; persistent drift after a reboot also suggests a failing CMOS battery. A failed adapter would break all network access, not just authentication.

    Source: CompTIA A+ Core 2 exam objectives, Software Troubleshooting domain — time drift on domain-joined systems and ticket-based authentication clock skewReport a problem with this question

13. 13. A user reports that their browser opens a different search page than the one configured, that typed addresses are redirected to unfamiliar sites, and that pop-up ads appear even on trusted pages. Which conclusion and action fit best?

    • A.A browser hijacker or malicious extension is present; remove the extension, reset browser settings, and scan the system✓ Answer
    • B.The certificate store is corrupt; reinstall the operating system
    • C.The monitor's refresh rate is misconfigured; adjust the display settings
    • D.The user needs a faster internet connection; contact the provider

    Changed search provider, redirection of typed addresses, and injected pop-ups are the signature of a browser hijacker, usually delivered as a malicious add-on or bundled installer that rewrites browser settings. Removing the extension and resetting the browser addresses the mechanism directly; reinstalling the whole OS is disproportionate and none of the other choices could redirect traffic.

    Source: CompTIA A+ Core 2 exam objectives, Software Troubleshooting domain — PC security symptoms: browser redirection and pop-upsReport a problem with this question

14. 14. In the documented malware removal procedure for an infected Windows system, at what point is System Restore handled?

    • A.It is disabled as the very first action, before the system is quarantined
    • B.It is never touched, because restore points must be preserved as evidence
    • C.It is disabled after the system is quarantined and before remediation, then re-enabled with a fresh restore point after cleaning✓ Answer
    • D.It is only disabled once remediation has already finished

    The ordered procedure is: verify the symptoms, quarantine the system, disable System Restore, remediate (update the anti-malware definitions, then scan and remove, using safe mode or a preinstallation environment), reimage if needed, schedule scans and updates, re-enable System Restore and create a clean restore point, and finally educate the end user. Restore points are disabled before cleaning because they can contain the infection and would reintroduce it; educating the user is always last.

    Source: CompTIA A+ Core 2 exam objectives, Security domain — ordered best practice procedure for malware removal in a SOHO environmentReport a problem with this question

15. 15. A single app on a user's smartphone freezes and closes every time it is opened. All other apps and the phone itself work normally. What should the technician try first?

    • A.Root or jailbreak the device to gain deeper access
    • B.Perform a factory reset of the device
    • C.Force-stop the app, then clear its cache or data and reinstall it if the problem persists✓ Answer
    • D.Replace the phone's battery

    Mobile troubleshooting follows a least-invasive-first ladder: force-stop, clear cache or data, reinstall the app, restart the device, update the OS, and only as a last resort factory reset. Because every other app works, the fault is scoped to that app's data, not the OS or hardware. A factory reset destroys user data unnecessarily, and rooting or jailbreaking removes the OS security sandbox and is never a troubleshooting step.

    Source: CompTIA A+ Core 2 exam objectives, Software Troubleshooting domain — mobile OS and application issues (application crashes)Report a problem with this question

16. 16. In which situation should a technician NOT wear an antistatic wrist strap?

    • A.When working in a room with low humidity
    • B.When installing memory modules in a desktop
    • C.When working inside a power supply or a CRT monitor✓ Answer
    • D.When handling an expansion card taken out of an antistatic bag

    A wrist strap works by deliberately creating a low-resistance path between the technician and ground so charges equalize. Power supplies and CRTs store high voltage in capacitors even when unplugged, and that same path would carry potentially lethal current through the technician. Personal safety always outranks component protection, and these units are not field-serviceable — they are replaced. Low humidity increases static risk, so a strap is more important there, not less.

    Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — common safety procedures: ESD straps, electrical safety and equipment groundingReport a problem with this question

17. 17. Smoke and flames appear inside an energized network rack. After people are evacuated and the area is reported per policy, which extinguisher is appropriate for the fire itself?

    • A.A Class C extinguisher (or a multipurpose ABC or CO2 unit) rated for energized electrical equipment✓ Answer
    • B.A Class A water extinguisher
    • C.A Class D dry powder extinguisher for combustible metals
    • D.A Class B foam extinguisher

    Class C rated agents are non-conductive, which is what makes them safe on energized equipment; water and foam conduct electricity and would expose the operator to shock while spreading the hazard. De-energize the circuit when it can be done safely, and remember that evacuating people and alerting others always takes priority over saving equipment.

    Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — personal safety and fire safetyReport a problem with this question

18. 18. A technician finds that a tablet's lithium-ion battery has swollen and is deforming the case. What is the correct handling and disposal action?

    • A.Store it in a sealed bag inside a warm server rack until the next pickup
    • B.Power the device down, stop charging and using it, isolate the battery, and route it to an approved recycler as directed by the safety data sheet and local regulations✓ Answer
    • C.Place it in the regular office trash once the device is powered off
    • D.Puncture the battery to relieve the internal pressure before disposal

    A swollen cell is venting gas and is mechanically unstable; puncturing, crushing, heating, or continuing to charge it can cause it to ignite. The safety data sheet is the authoritative document for handling, storage, and disposal of such materials, and batteries — like toner — are regulated waste that must go to approved recycling rather than the trash.

    Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — environmental controls: safety data sheet documentation and proper battery disposalReport a problem with this question

19. 19. A small office experiences frequent brownouts that cause its servers to reboot mid-transaction. Which device addresses this problem?

    • A.A power distribution unit that provides more outlets
    • B.An uninterruptible power supply (UPS) with battery backup✓ Answer
    • C.A heavier-gauge extension cord to each rack
    • D.A surge suppressor on each server's power cord

    A brownout is a sustained drop in supply voltage. Only a UPS holds stored energy in a battery and can carry the load through a sag or an outage long enough for a graceful shutdown, and it also conditions the incoming voltage. A surge suppressor only clamps overvoltage spikes and does nothing during undervoltage; a PDU and a thicker cord merely distribute power.

    Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — power surges, brownouts and blackouts: UPS versus surge suppressorReport a problem with this question

20. 20. A technician submits a change request to upgrade the firmware on a production core switch. Which element must the documented change plan include before the change board can approve it?

    • A.A documented rollback plan describing how to return the switch to its previous working state✓ Answer
    • B.An announcement of the new features for end users
    • C.A commitment to document the change only if something goes wrong
    • D.The technician's own sign-off, since they are the one performing the work

    A rollback (back-out) plan is mandatory because it converts a failed change from an outage into a recoverable event; it sits alongside the purpose and scope of the change, a risk analysis, the affected systems, sandbox testing, and a scheduled maintenance window. Approval comes from the change board, not from the person making the change, and documentation is required regardless of outcome.

    Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — change management: rollback plan, risk analysis, scope and change board approvalReport a problem with this question

21. 21. Ransomware encrypted a company's file server and also encrypted the network-attached storage device that held every backup, because it was permanently mapped and online. Which backup practice would have preserved a recoverable copy?

    • A.Enabling compression on the backup volume to store more versions
    • B.Running incremental backups more frequently to the same storage device
    • C.Relying on the file server's operating system restore points
    • D.Keeping three copies of the data on two different media with one copy offsite and offline, rotated generationally and periodically test-restored✓ Answer

    Any backup target reachable from the infected network can be encrypted along with the source, which is exactly what happened here. The three-copies / two-media / one-offsite rule guarantees at least one copy outside the blast radius, generational rotation keeps older clean versions available in case the infection went unnoticed for days, and periodic test restores prove the copy is actually usable.

    Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — workstation backup and recovery: 3-2-1 rule, offsite rotation, grandfather-father-son and backup testingReport a problem with this question

22. 22. While repairing a company-owned laptop, a technician discovers files that appear to be illegal content prohibited by the acceptable use policy. What should the technician do first?

    • A.Delete the files to protect the company and finish the repair
    • B.Confront the user and ask for an explanation before doing anything else
    • C.Copy the files to a USB drive and email them to the security team
    • D.Stop work, leave the device and its data intact, report to management or the designated authority, and document the chain of custody✓ Answer

    First response is to identify the issue, preserve the evidence exactly as found, report through the proper channel, and document everything. Deleting, copying, or emailing the data alters or duplicates evidence and breaks the chain of custody — the record of every person who handled the evidence and when — which can make it inadmissible. A technician must not investigate beyond their authority or confront the user.

    Source: CompTIA A+ Core 2 exam objectives, Operational Procedures domain — prohibited content and activity: first response, evidence preservation and chain of custodyReport a problem with this question

Practice questions written to the published CompTIA A+ Core 1 and Core 2 exam objectives and to standard IT support practice. CompTIA and A+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. The exam objectives are revised periodically — confirm the current objectives and exam requirements with CompTIA before testing. About the CompTIA A+ certification →