2.7 Given a scenario, apply workstation security options and hardening techniques.
2.11 Given a scenario, configure relevant security settings in a browser.
Wording from the official CompTIA A+ 220-1202 exam objectives (document version 4.0). Every sub-bullet in both objectives has a section below.
How do you encrypt data at rest on a Windows workstation?
Use BitLocker, or Device Encryption on hardware that supports it. BitLocker encrypts entire volumes to protect data on a lost, stolen or badly decommissioned device, even if the drive is moved to another machine, and it gives the most protection when paired with a TPM (Microsoft Learn: BitLocker overview).
| Feature | What it covers | Where it’s available |
|---|---|---|
| BitLocker | Full-volume encryption; works with the TPM to detect offline tampering | Windows Pro, Enterprise and Education editions (Microsoft Support; the Learn overview lists Pro Education/SE too) |
| Device Encryption | Turns BitLocker on automatically for the OS drive and fixed drives; it doesn’t encrypt external/USB drives (Learn) | A wider range of devices, “including those running Windows Home” (Microsoft Support). Before Windows 11 version 24H2 it also required Modern Standby or HSTI support (Learn). |
On a Windows 11 PC with Device Encryption, the switch is under Settings > Privacy & security > Device encryption, and the recovery key is attached to the Microsoft account or work or school account used to set up the PC; with a local account, Device Encryption doesn’t turn on automatically (Microsoft Support).
What password settings does CompTIA list, and what does Microsoft recommend?
CompTIA names five password considerations: length, character types, uniqueness, complexity and expiration. In Windows each one maps to a Group Policy password setting, and Microsoft’s current guidance favors long, unique passwords over forced changes.
| Consideration | Windows setting | What Microsoft says |
|---|---|---|
| Length | Minimum password length (1–14 characters; 0 means no password required) | The policy page’s best practice is at least 8 (Learn); the Microsoft 365 guidance says maintain a 14-character minimum (Learn). |
| Character types / Complexity | Password must meet complexity requirements | When enabled, a password must use characters from three of five categories: uppercase, lowercase, digits 0–9, non-alphanumeric characters, and other Unicode letters that aren’t uppercase or lowercase. It’s enforced when a password is created or changed (Learn). |
| Uniqueness | Enforce password history (0–24 remembered passwords) | Best practice is 24, to limit reuse (Learn). Users shouldn’t reuse a work password on any other site (Learn). |
| Expiration | Maximum password age (client default 42 days) | The policy page gives 30–90 days as a best practice, but the same page says Microsoft’s security baseline leaves expiration out because it’s less effective than modern mitigations such as MFA, notes research indicating forced expiration has a negative effect, and says organizations without those mitigations should keep the policy (Learn). Microsoft 365 guidance recommends passwords never expire for cloud-only accounts (Learn). |
Microsoft also warns that rules for special characters and frequent changes push people toward predictable passwords (Microsoft 365 password guidance). For MFA, which reduces the damage a stolen password can do, see multi-factor authentication explained.
What does a BIOS/UEFI password protect?
A firmware password stops someone from changing BIOS/UEFI settings, such as the boot device, without knowing it. On Microsoft Surface, for example, the UEFI Security page sets a password that must be entered to boot into UEFI; it must be at least six characters and is case-sensitive (Microsoft Learn: Surface UEFI). Microsoft can’t retrieve or reset a forgotten Surface UEFI password (Microsoft Support). Other manufacturers’ firmware has its own password options and rules, so check the device maker’s documentation. Background on firmware itself is in BIOS vs UEFI explained.
Which end-user habits keep a workstation secure?
Lock or sign out whenever you step away, protect portable hardware, keep personal data and passwords out of reach, and use a password manager.
- Use screensaver locks. In the screen saver settings, turn on “On resume, display logon screen” and set the Wait minutes (Microsoft Support).
- Log off when not in use. Press Windows key + L to lock while keeping apps open; signing out closes apps and keeps others out of your files and settings (Microsoft Support).
- Secure/protect critical hardware (e.g., laptops). Encrypt the drive (BitLocker or Device Encryption, above), and turn on Find My Device beforehand so a lost or stolen PC can be located and locked; it needs an administrator account and a personal Microsoft account (Microsoft Support). Physical controls such as cable locks are covered in physical security controls.
- Secure personally identifiable information (PII) and passwords. Don’t leave PII or written-down passwords on desks or in unencrypted files, and don’t reuse an organization password for nonwork purposes (Microsoft Learn).
- Use password managers. Chrome, Edge and Firefox all include one (see the browser section below).
Which account management settings lock down a Windows PC?
Give people standard accounts, limit when and how long accounts work, lock accounts after repeated failures, and lock idle sessions. These are local or domain policy settings or net user options.
| CompTIA item | How to do it in Windows |
|---|---|
| Restrict user permissions | Use standard user accounts day to day and keep administrators few (Microsoft Support). With User Account Control, an administrator gets a standard token plus an admin token, standard users see a credential prompt and admins see a consent prompt on the secure desktop (Learn: How UAC works). More on access models in identity and access management. |
| Restrict log-in times | net user username /times:monday-friday,8am-5pm. Times are in one-hour increments; all means always and a blank value means never (Learn: net user). |
| Disable guest account | Set Accounts: Guest account status to Disabled. The Guest account lets unauthenticated network users sign in with no password (Learn). |
| Use failed attempts lockout | Account lockout threshold (1–999 failed attempts; 0 never locks; Windows security baselines suggest 10 as a starting point) (Learn) and Account lockout duration (about 15 minutes advised; 0 means an admin must unlock) (Learn). A threshold can be abused to lock users out deliberately, a denial-of-service trade-off. |
| Use timeout/screen lock | Interactive logon: Machine inactivity limit locks the session after up to 599,940 seconds of inactivity; 0 disables it (Learn). Dynamic Lock locks the PC when a paired phone’s Bluetooth signal drops (Microsoft Support). |
| Apply account expiration dates | net user username /expires:date; the account expires at the beginning of that date (Learn: net user). Useful for contractors and temporary staff. |
Why change the default administrator’s account and password?
Every Windows installation has a built-in account named “Administrator,” so attackers already know a likely user name. The Accounts: Rename administrator account policy gives it a different name, which Microsoft says makes guessing “slightly more difficult.” The benefit is limited: the account has a well-known SID, and some tools can authenticate by SID instead of name (Learn). On Windows client PCs the built-in Administrator is disabled by default (Accounts: Administrator account status); keep it disabled, or disable it if it has been turned on (Learn). Any default or shared admin password should be changed to a strong, unique one.
How do you disable AutoRun?
Turn it off with Group Policy or the registry. The Turn off Autoplay policy disables AutoPlay on CD-ROM and removable drives or on all drives; if it isn’t configured, AutoPlay stays on. A separate policy sets the default behavior for AutoRun commands, and another disallows AutoPlay for MTP devices such as cameras and phones (Learn: AutoPlay policy CSP). In the registry, the NoDriveAutoRun and NoDriveTypeAutoRun values disable AutoRun persistently (Learn: Enabling and Disabling AutoRun).
How should you handle unused services?
Disable services you don’t need, but only following documented guidance. Microsoft’s guidance for Windows Server 2016 sorts system services into categories, including “Should Disable”; it recommends leaving services it hasn’t evaluated at their default configuration and advises against policies that disable non-default services, such as IIS, that weren’t part of the original installation (Microsoft Learn). Each service’s startup type controls when and how Windows starts it.
How do you download and install a browser safely?
Get the installer from the vendor’s own site and, when the publisher posts a hash, compare it before running the file.
- Trusted sources: download from the browser maker; Mozilla’s install guide, for example, sends users to the official Firefox download page (Mozilla Support).
- Hashing: PowerShell’s
Get-FileHashcomputes a file’s hash (SHA256 by default); identical hashes mean identical contents. Microsoft says MD5 and SHA1 are no longer considered secure for files that need protection from tampering (Learn: Get-FileHash).certutil -hashfile InFile [HashAlgorithm]also generates a file hash (Learn: certutil).
- Hashing: PowerShell’s
- Untrusted sources: Chrome blocks or warns about dangerous, suspicious and insecure downloads, and warns that attackers may ask you to ignore those warnings (Chrome Help). Edge’s Microsoft Defender SmartScreen protects against phishing sites and malicious downloads (Microsoft Support). Chrome’s Safe Browsing Standard protection is on by default (Chrome Help).
How do browsers stay patched?
All three major browsers update themselves; you finish an update by restarting the browser.
| Browser | How updates work | Manual check |
|---|---|---|
| Chrome | Updates normally happen in the background; click Relaunch to apply one (Chrome Help) | More > Help > About Google Chrome |
| Edge | Updates automatically when you restart the browser (Microsoft Support) | Settings and more > Help and feedback > About Microsoft Edge |
| Firefox | Updates automatically by default; click Restart to update Firefox (Mozilla Support) | Manual update from the Firefox menu |
How do you decide which extensions and plug-ins to trust?
Install extensions only from the browser’s official store, review the permissions they ask for, and remove anything you didn’t knowingly install.
- Trusted sources: Chrome extensions come from the Chrome Web Store, and Google says to approve only extensions you trust (Chrome Web Store Help). Edge can use Chrome extensions; review the permission prompt before choosing Add extension (Microsoft Support). Firefox add-ons come from addons.mozilla.org, most must be signed by Mozilla, and Recommended extensions get a technical security review (Mozilla Support, Recommended Extensions).
- Untrusted sources: Firefox blocks installation of unsigned add-ons; signing protects against malicious add-ons that could hijack the browser, steal information or insert ads (Mozilla Support). Extensions that aren’t Recommended haven’t had Mozilla’s Recommended review, which Mozilla says doesn’t make them unsafe but means you install them at your own risk (Recommended Extensions). Installing a Windows or Mac application can also add a Chrome extension (Chrome Web Store Help). Edge asks before allowing extensions from other stores (Microsoft Support).
- Plug-ins: Firefox no longer supports NPAPI plug-ins and ended Flash support at the end of 2020 (Mozilla Support); Adobe ended Flash Player support on December 31, 2020 (Microsoft Learn). Malicious or unwanted add-ons are one of the attack paths covered in application security.
What do browser password managers do?
They save and fill passwords, suggest strong ones and warn when a saved password appears in a breach.
- Chrome: Google Password Manager saves passwords and flags any exposed in a data breach or that are weak; manage them at passwords.google.com (Chrome Help).
- Edge: Password Monitor checks saved passwords against a database of known leaked passwords when you’re signed in (Microsoft Support).
- Firefox: offers to save logins, can suggest strong passwords, and a Primary Password protects saved logins (Mozilla Support).
How do you check that a site has a secure connection and a valid certificate?
Look at the icon to the left of the address. Chrome authenticates HTTPS connections with website certificates that encrypt the link between the site and the browser, and labels a site “Not secure” when the connection isn’t private (Chrome Help). Edge reports whether a site has a valid certificate issued by a trusted authority, or warns that the certificate is invalid (Microsoft Support). In Firefox a padlock means the connection is encrypted, and a padlock with a warning triangle means don’t send sensitive information (Mozilla Support). Chrome’s “Always use secure connections” setting upgrades URLs to HTTPS (Chrome Help).
Which browser settings does CompTIA list, and where are they?
Pop-up blocker, clearing browsing data and cache, private browsing, sign-in and sync, ad blocking, proxy and secure DNS. Each browser has its own name and location for them.
| Setting | Chrome | Edge | Firefox |
|---|---|---|---|
| Pop-up blocker | Blocks pop-ups by default; Privacy and security > Site Settings > Pop-ups and redirects (Help) | On by default; Pop-ups and redirects > Blocked. It doesn’t block ads (Support) | On by default; “Block pop-up windows” checkbox (Support) |
| Clearing browsing data | Choose a time range and data types (Help) | Privacy, search, and services > Clear browsing data (Support) | Choose what to clear; can clear history when Firefox closes (Support) |
| Clearing cache | “Cached images and files” removes stored text and images from visited pages (Help) | “Cached images and files” in Clear browsing data (Support) | “Temporary cached files and pages”; can auto-clear on close (Support) |
| Private-browsing mode | Incognito limits what’s saved to the device; your network, employer or ISP may still see activity (Help) | InPrivate doesn’t save history, temporary files or cookies once you’re done (Support) | Private Browsing doesn’t save history or cookies and doesn’t make you anonymous (Support) |
| Sign-in/browser data synchronization | Optional sign-in brings bookmarks, passwords and more to all devices (Help) | Syncs favorites, passwords, history, extensions and settings; sign out to stop (Support) | Sign in to a Mozilla account and choose which items to sync (Support) |
| Ad blockers | Built-in filtering removes ads from sites that violate the Better Ads Standards (Help) | Tracking prevention blocks trackers and makes ads less personalized; Microsoft doesn’t describe it as an ad blocker (Support) | Enhanced Tracking Protection blocks trackers; tracking content hidden in ads is blocked in private windows by default, or everywhere in Strict mode (Support) |
| Proxy | The cited Chrome and Edge help doesn’t cover proxy settings. Windows’ own proxy settings are in Settings > Network & internet > Proxy (automatic or manual) (Microsoft Support) | Network Settings: system proxy, manual proxy or a .pac file (Support) | |
| Secure DNS | “Use secure DNS” encrypts lookups; on by default in automatic mode (Help) | Secure DNS encrypts DNS queries (Support) | DNS over HTTPS sends lookups over an encrypted HTTPS connection (Support) |
Built-in ad filtering isn’t the same as a full ad blocker: Chrome removes only ads on sites that violate the Better Ads Standards, and Edge and Firefox describe their built-in protections as tracker blocking. Third-party ad blockers are browser extensions, so the extension rules above apply to them.
How do you enable or disable plug-ins, extensions and features?
Each browser has an extensions page with an on/off toggle and a remove option, and a site-permissions page for features such as location, camera, microphone and JavaScript.
- Extensions: Chrome: More > Extensions > Manage extensions, then turn an extension on or off or remove it (Chrome Web Store Help). Edge: use the toggle next to an extension, or Remove from Microsoft Edge (Microsoft Support). Firefox: disabling turns an extension off without removing it (Mozilla Support).
- Plug-ins: before Flash was removed, Chromium-based Edge disabled it by default and let users re-enable it per site (Microsoft Learn). Firefox no longer runs NPAPI plug-ins (see above).
- Features: Chrome lets you allow or block permissions such as JavaScript, camera and microphone for a specific site (Chrome Help); Edge uses Site permissions with Ask, Allow or Block (Microsoft Support); Firefox controls notifications, location, camera and more in its Privacy & Security panel (Mozilla Support).
Practice scenarios
These are original practice scenarios written for this page, not real exam questions.
1. A sales laptop is lost at an airport. What would have protected its data? Drive encryption (BitLocker or Device Encryption) keeps the drive unreadable in another machine, and Find My Device, if it was turned on, can locate and lock it.
2. A temporary contractor should only sign in on weekdays during business hours and lose access when the contract ends. Use net user with /times: for the hours and /expires: for the end date.
3. A user’s browser keeps opening a shopping site, and an extension they don’t remember installing is listed. Disable or remove the extension, review site permissions, and in future install extensions only from the official store after checking their permissions. For an infected PC, follow the SOHO malware removal steps.
Related A+ Articles
Studying for CompTIA A+?
See the books, practice exams, and free resources that actually work.