Home › Certifications › CompTIA A+ › Core 2 — Software Troubleshooting
62 multiple-choice questions and 17 flashcards on Core 2 — Software Troubleshooting, about 11% of the CompTIA A+ bank. Every one carries a written rationale.
Core 2 — Software Troubleshooting is one of 9 chapters in CoStudy's CompTIA A+ bank, and it holds 62 of the bank's 540 multiple-choice questions — roughly 11% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
Which action LEAST belongs in the malware removal process as CompTIA defines it?
Answer: D — Notifying the software vendor that their product was exploited
D) Correct — vendor notification may be a sound business practice but is not one of the defined steps. A) Symptom investigation and verification is the first step. B) Scheduling scans and updates follows remediation. C) Re-enabling System Restore and taking a restore point is the sixth step.
A user reports that a co-worker received email from their account. The technician verified the symptoms and pulled the network cable. Which step is now due?
Answer: C — Disable System Restore before any cleanup work begins
C) Correct — with symptoms verified and the host quarantined, disabling System Restore is the defined third step. A) Credential resets are sound security hygiene but are not a step in the ordered removal process. B) Scanning is remediation, which comes after System Restore is turned off. D) Education is the last step of the process.
A user reports their computer is running ransomware demanding payment. What is the FIRST step?
Answer: D — Disconnect the host and alert incident response
D is right because ransomware commonly encrypts reachable shares and spreads laterally, so containment has to happen before anything else. A funds the attacker and offers no guarantee of a working key. B follows attacker instructions and may trigger further payload actions. C leaves the machine connected and actively writing to shares. E keeps the infected host live on the network, which is exactly the condition isolation is meant to end.
A managed phone repeatedly fails to connect to corporate email while personal accounts work. Which check is the MOST likely to identify the cause?
Answer: D — Whether the device still satisfies the MDM compliance policy
D) Correct — conditional access tied to MDM compliance blocks corporate resources specifically while leaving personal accounts untouched. A) Airplane mode would break all connectivity, including personal mail. B) Low storage affects message download, not authentication to the corporate service. C) A shorter lock timeout is more secure and would not cause a block.
A user reports full-screen warnings that their system is infected and instructing them to call a phone number. The warnings appear only while browsing. What is the MOST likely explanation?
Answer: A — A browser-based scam page or malicious extension is generating them
A) Correct — browser-confined scareware pages and rogue extensions are the classic source of fake infection warnings with a call-back number. B) Legitimate endpoint agents do not ask users to phone a number. C) A notification reset changes which alerts appear, not the appearance of scam content. D) Firmware prompts appear before the OS loads, not inside a browser session.
A PC running slow has 100% disk usage in Task Manager. The MOST common culprits:
Answer: A — Windows Search indexing, SysMain, or a failing drive
Sustained 100% disk usage usually traces to SysMain, the search indexer, Windows Update, an antimalware scan, cloud sync, or a drive failing with SMART errors. Network and display problems do not drive disk load, and RAM exhaustion causes paging without necessarily pinning the disk.
A workstation takes several minutes to reach a usable desktop, and disk activity is pinned at 100 percent the entire time. Which check is the MOST productive starting point?
Answer: D — Review Task Manager's Startup tab and disable unneeded entries
D) Correct — heavy disk activity confined to logon is usually caused by the volume of startup programs, which the Startup tab quantifies with impact ratings. A) Capacity does not determine load time and the drive may be fine. B) A larger paging file typically increases disk I/O rather than reducing it. C) chkdsk is worth running if errors are logged, but startup load is the more common explanation.
Which Windows tool is the CORRECT way to revert problematic system changes (e.g., a bad driver install)?
Answer: B — System Restore, to a point before the change
System Restore rolls system files, registry and drivers back to a restore point taken before the change. Disk Cleanup frees space, Disk Management handles partitions, and sfc repairs protected files but does not undo a driver install.
A user's PC shows 'Boot device not found' after a Windows update. The MOST appropriate first step:
Answer: D — Run Startup Repair in WinRE and check boot order
A boot failure right after an update usually means a damaged bootloader or a changed boot order, so run Startup Repair from WinRE, verify the boot order in firmware, and confirm the boot mode matches the disk's partitioning. Reinstalling or replacing the drive are last resorts.
A desktop blue screens intermittently. The stop codes vary and the crashes began right after a memory upgrade. Which action is the BEST first troubleshooting step?
Answer: B — Run Windows Memory Diagnostic and reseat the new modules
B) Correct — varying stop codes correlated with a hardware change point at the new memory, so testing and reseating it targets the likely cause. A) Reinstalling is drastic and ignores the obvious change that preceded the symptom. C) Video drivers cause blue screens, but they were not the change made here. D) Capturing the code is useful, yet the codes are already known to vary.
4 cards from the 17 in this chapter.
How do you uninstall a problematic Windows update?
Settings → Update & Security → Update history → Uninstall updates. Or via WinRE Advanced Options → 'Uninstall Updates'.
How do you boot Windows in Safe Mode?
Hold Shift while clicking Restart → Troubleshoot → Advanced → Startup Settings → Restart → 4 (Safe Mode). Or msconfig → Boot tab → Safe boot.
What is a corrupt user profile and how do you fix it?
User-specific files/registry damaged. Boot Safe Mode, log in as another admin, copy data from old profile to a new one, delete corrupt profile (System Properties → Profiles).
What does 'no boot device available' mean?
BIOS/UEFI cannot find a valid bootable disk. Check SATA/NVMe connection, drive presence in BIOS, boot order, and partition/MBR integrity.
These are a sample. The full Core 2 — Software Troubleshooting chapter runs 79 items with per-chapter progress tracking, on the web and in the iOS app.