RANGER GAMEZ

CompTIA A+ Core 2 (220-1202) · chapter 11 of 17

Security Week, Friday: Harden, wipe and lock the store

In this chapter Objectives 2.7, 2.9, 2.10

  1. Workstation hardening
  2. Data destruction and disposal
  3. Securing SOHO networks
  4. Practice questions
  5. Chapter recap

Objective 2.7

Workstation hardening

Data-at-rest encryption and passwords

Data-at-rest encryption (BitLocker, FileVault) protects a lost or stolen laptop. Password considerations:

  • Length: the biggest factor; long passphrases beat short complex ones
  • Character types and complexity: mix upper, lower, numbers and symbols
  • Uniqueness: never reuse a password between sites or accounts
  • Expiration: forced periodic changes; current guidance prefers changing after a suspected compromise, but know the setting exists

Exam tip Exam answer for 'strongest password policy' usually leans on length + complexity + no reuse + lockout.

BIOS/UEFI passwords

A BIOS/UEFI password stops people from changing firmware settings (boot order, Secure Boot) or booting from USB to bypass Windows. A supervisor/admin password protects settings; a user/power-on password is needed to start the PC at all.

Exam tip Stop someone booting a live USB to copy files: set a UEFI admin password and disable USB boot.

End-user best practices

Habits to teach every user:

  • Use screensaver locks and lock the PC when walking away (Win+L)
  • Log off when not in use, especially on shared PCs
  • Secure/protect critical hardware: cable locks for laptops, never leave them in cars
  • Secure PII and passwords: no sticky notes, no spreadsheets of passwords
  • Use password managers for unique, strong passwords

Account management

Settings an admin applies, often by Group Policy:

  • Restrict user permissions: standard accounts, least privilege
  • Restrict log-in times: the warehouse temp account only works during shifts
  • Disable guest account
  • Use failed attempts lockout: lock the account after, say, 5 bad passwords
  • Use timeout/screen lock: lock automatically after a few idle minutes
  • Apply account expiration dates: contractors' accounts end on their last day

More hardening steps

Shrink the attack surface:

  • Change default administrator's user account/password: rename or disable the built-in Administrator and set a strong unique password
  • Disable AutoRun (and AutoPlay) so a USB stick can't launch programs when plugged in
  • Disable unused services: every running service is something to attack (e.g. turn off Remote Registry if not needed)

Exam tip USB drives found in the parking lot + AutoRun on = instant infection. Disable AutoRun and never plug in found drives.

Check yourself 1A contractor's work ends June 30. Which setting makes sure her account stops working without anyone remembering to disable it?

  1. Account expiration date
  2. Failed attempts lockout
  3. Restricted log-in times
  4. Screen lock timeout
Show the answer

Answer: A. Account expiration date

An account expiration date disables the account automatically on the set day.

Objective 2.9

Data destruction and disposal

Physical destruction

When the drive will never be reused:

  • Drilling: holes through the platters; quick but pieces of data may remain between holes
  • Shredding: industrial shredder cuts drives into small pieces; works for HDDs and SSDs
  • Degaussing: a strong magnet erases magnetic media (HDDs, tapes); the HDD is unusable afterward; does NOT work on SSDs or flash
  • Incineration: burning, usually by a certified vendor

Exam tip SSD + degausser = trap. SSDs store data in flash chips, not magnetically. Shred or crypto-erase them.

Recycling or repurposing

When the drive will be reused or donated, remove the data first:

  • Erasing/wiping: software overwrites every block (or uses the drive's secure-erase command). This is the right way to reuse a drive
  • Low-level formatting: true low-level format is done at the factory; vendor 'low-level' tools zero-fill the drive
  • Standard formatting: builds a new filesystem; a quick format leaves the old data recoverable

Exam tip 'I formatted it' isn't 'it's wiped'. Data recovery tools can read a quick-formatted drive.

Outsourcing and regulations

Large jobs often go to a third-party vendor. Get a certificate of destruction (or of recycling) listing drive serial numbers, date and method. That's your proof for auditors. Regulatory and environmental requirements: laws may say how long to keep data and how to destroy it, and e-waste must go to certified recyclers, not landfill.

Exam tip No certificate of destruction = no proof. Auditors want the document, not your word.

Check yourself 2Kibble & Co. will donate 20 laptops with SSDs to a school. What should you do with the drives?

  1. Degauss each SSD before donating
  2. Quick format each SSD with NTFS
  3. Drill through each SSD, then donate the laptops
  4. Run a secure erase/wipe on each SSD
Show the answer

Answer: D. Run a secure erase/wipe on each SSD

Repurposing needs a wipe that removes all data but leaves the drive usable, such as the SSD's secure-erase command.

Objective 2.10

Securing SOHO networks

Router settings

Small office/home office (SOHO) routers need hardening too:

  • Change default passwords on the admin login (and the default admin username if possible)
  • Firmware updates: patch the router's own software
  • IP filtering: allow or block traffic by IP address
  • Content filtering: block categories of websites
  • Physical placement/secure locations: lock it away so nobody can press reset
  • Universal Plug and Play (UPnP): lets devices open ports automatically; disable it unless needed
  • Screened subnet: an isolated segment for public-facing devices (formerly DMZ)
  • Configure secure management access: HTTPS only, no admin from the internet

Wireless and firewall settings

Wireless specific:

  • Changing the SSID from the default so it doesn't reveal the router model
  • Disabling SSID broadcast: hides the name from casual lists; not real security, it's still discoverable
  • Encryption settings: WPA3, or WPA2 with AES
  • Configuring guest access: a separate guest network isolated from business devices
  • Firewall: disabling unused ports, and port forwarding/mapping only for services that really need inbound access

Exam tip Port forwarding sends an outside port to one inside device. Forward only what you must, to a fixed (static/reserved) IP.

Practice questions

Answer in your head, then open the answer. Ranger's Help Desk has 444 questions like these for A+ Core 2, with mock exams.

Question 1A company's password policy requires eight characters. Which change would most improve resistance to brute-force attacks?

  1. Allow users to reuse their last password
  2. Require a password change every 30 days
  3. Show the password hint on the Windows sign-in screen
  4. Raise the minimum length to 14 or more characters
Show the answer

Answer: D. Raise the minimum length to 14 or more characters

Length increases the number of possible combinations far more than other rules, making brute force impractical.

Question 2A technician wants to stop anyone from changing the boot order to start a laptop from a USB drive. Which control should be set?

  1. Disable the Guest account
  2. A BIOS/UEFI password
  3. A screensaver lock
  4. A Windows Hello PIN
Show the answer

Answer: B. A BIOS/UEFI password

A BIOS/UEFI administrator (supervisor) password prevents unauthorized changes to firmware settings such as boot order.

Question 3Employees often leave their desks with their PCs unlocked. Which end-user best practice and setting helps most?

  1. Disable AutoRun
  2. Lock screens when away and set auto-lock
  3. Use a longer, more complex password
  4. Log off only at the end of each working day
Show the answer

Answer: B. Lock screens when away and set auto-lock

Pressing Windows+L when stepping away, plus an inactivity timeout with a screen lock, protects unattended sessions.

Question 4A user reuses one password for every site because they cannot remember many different ones. What should the technician recommend?

  1. Use a password manager for unique passwords
  2. Write the passwords on a note kept in a desk drawer
  3. Store the passwords in an unencrypted spreadsheet
  4. Add the site name to the end of the same password
Show the answer

Answer: A. Use a password manager for unique passwords

Password managers generate and store strong, unique passwords, so a breach at one site does not expose the others.

Question 5Temporary staff should be able to sign in to domain PCs only between 8 a.m. and 6 p.m. on weekdays. Which account management control should be configured?

  1. Restrict log-in times
  2. Timeout/screen lock
  3. Failed-attempt lockout
  4. Account expiration date
Show the answer

Answer: A. Restrict log-in times

Logon hour restrictions (for example, Logon Hours in Active Directory) prevent sign-in outside allowed times.

Practice it in Ranger's Help DeskThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.