CompTIA A+ Core 2 Domain 1: Operating Systems

System File Checker run with /scannow scans the integrity of every protected system file and replaces incorrect versions with correct ones, fixing the reported corruption.

• ATrap of confusing file-system repair with system-file repair; chkdsk /f fixes volume metadata and logical errors, not corrupted protected Windows OS files.
• CTrap because CheckHealth only reports whether the component store was already flagged as corrupted; it performs no scan of protected files and makes no repairs.
• DNames a Group Policy refresh tool that reapplies policy settings; it has nothing to do with detecting or repairing corrupted protected operating system files.

The /r switch locates bad sectors and recovers readable information, and it includes /f functionality plus analysis of physical disk errors.

• ATrap because /v only displays the name of each file as the disk is checked; it provides verbose output but never analyzes or recovers physical bad sectors.
• BMisleads by fixing logical file-system errors only; /f locks and repairs metadata but does not scan the disk surface for physical bad sectors.
• DTrap of picking an NTFS speed option; /i performs a less vigorous index check to shorten runtime, intentionally skipping thorough physical surface analysis.

tracert determines the path to a destination by sending ICMP echo requests with incrementing TTL values, revealing each intermediate router hop and its latency.

• BTrap because ping only confirms reachability and round-trip time to the endpoint; it sends echo requests but does not enumerate the intermediate router hops.
• CMisleads by querying DNS infrastructure to resolve names to addresses; it diagnoses name resolution, not the routed path or per-hop latency to a host.
• DTrap of choosing a local tool; netstat lists active TCP connections and listening ports on this computer, not the routers traversed to a remote site.

netstat displays active TCP connections and the ports on which the computer is listening, exactly what is needed to inspect local sockets.

• ATrap because /all shows full TCP/IP adapter configuration such as IP, gateway, and DNS; it never lists active TCP connections or listening ports on the host.
• BMisleads by tracing the routed path to a remote destination; it reveals intermediate hops, not the local machine's open sockets or listening TCP ports.
• CNames a DNS diagnostic that queries name servers to resolve records; it provides no information about local TCP connections or which ports are listening.

diskpart selects the disk, runs clean to delete all partitions, then converts MBR to GPT, the documented command-line path for changing partition style.

• ATrap because chkdsk checks a volume's file system for logical and physical errors; it cannot select a disk, clean partitions, or change the partition style.
• CMisleads by preparing a volume with a file system; formatting writes FAT/NTFS to a partition but does not convert a disk's MBR or GPT partition scheme.
• DNames System File Checker, which scans protected operating system files for corruption; it has no role in disk selection, cleaning, or partition-style conversion.

GPT uses UEFI, manages disks larger than 2 TB, and supports far more than four partitions, making it the correct choice for the 4 TB drive.

• ATrap because MBR is the legacy BIOS scheme limited to disks of 2 TB or smaller and only four primary partitions, so it cannot address the full 4 TB drive.
• BMisleads by naming a file system rather than a partition style; exFAT formats a volume but does not define MBR-versus-GPT disk layout or UEFI boot support.
• DTrap of confusing a disk type with a partition style; dynamic disks enable spanned or mirrored volumes but do not by themselves provide the GPT 2 TB-plus capability over UEFI.

Microsoft requires the Windows partition to be formatted NTFS, which provides the security, journaling, and metadata features the operating system depends on.

• BStrong trap because FAT32 is required for the separate EFI System Partition, not for the Windows partition; the OS volume must instead use NTFS.
• CMisleads because exFAT targets removable flash media and lacks permissions and journaling; Microsoft does not allow it for the bootable Windows OS partition.
• DNames a Linux file system that Windows Setup cannot install onto; ext4 is unsupported as the Windows operating-system partition format.

FAT32 caps maximum file size at 4 GiB, so a 5 GB file exceeds the limit; reformatting to exFAT, the FAT32 successor, removes it.

• ATrap because fragmentation slows access but never blocks a copy; defragmenting would not bypass FAT32's hard per-file size ceiling causing this failure.
• BMisleads by invoking access control lists, but FAT32 does not implement NTFS permissions, so an ACL denial cannot be the reason the copy fails.
• CContradicts the scenario; with 40 GB free the volume clearly has room, so insufficient capacity is not why the 5 GB file is rejected.

exFAT supports very large files, is the recommended Windows-compatible format for volumes over 32 GB, and is read/write on both Windows and macOS.

• ATrap because FAT32 is broadly compatible but caps files at 4 GB, so it cannot hold the 8 GB clips even though both operating systems can read it.
• CMisleads because macOS mounts NTFS as read-only by default, so the videographer could not write the clips on a Mac without third-party drivers.
• DNames the Apple format that Windows cannot natively read or write, so an APFS drive would fail the cross-platform requirement on the Windows side.

NTFS keeps a transaction-based log and checkpoints, so after a failure it replays the log to automatically restore consistency, which FAT32 cannot do.

• BTrap because cluster size only affects allocation granularity and slack space; it does nothing to recover or restore file-system consistency after a crash.
• CMisleads by citing defragmentation, which reorganizes file layout for speed; it provides no crash-recovery guarantee and is not why NTFS stays consistent.
• DDescribes a FAT-family redundancy feature, not NTFS; duplicate FATs do not deliver the transactional crash recovery that keeps NTFS volumes consistent.

NTFS provides granular permissions through access control lists and supports the Encrypting File System, which cryptographically protects individual files on NTFS volumes.

• ATrap because FAT32 supports neither access control lists nor file-system encryption, so it cannot enforce per-user permissions or EFS on the stored files.
• BMisleads since exFAT targets removable media and lacks file ownership, ACLs, and EFS; it cannot deliver the granular permissions or encryption requested.
• DTrap conflating full-volume BitLocker with file-level controls; BitLocker encrypts whole volumes and still cannot give FAT32 the per-file ACLs and EFS NTFS offers.

ext4 is a native Linux file system that uses extents for large files and employs a journal to protect against metadata inconsistencies after a crash.

• ATrap because NTFS is the native Windows file system; while Linux can access it, it is not the standard native Linux choice for a root partition.
• BMisleads by naming Apple's file system built for macOS and iOS; it is not a native Linux file system and is not used for Linux root volumes.
• CFAT32 is cross-platform but lacks journaling, permissions, and extents, so it is unsuitable as a crash-resilient native Linux root file system.

APFS is the default file system on macOS 10.13 and later, optimized for flash/SSD storage and featuring strong native encryption, exactly as required.

• ATrap because HFS+ is the older Apple format that APFS replaced; it is not the default on current macOS and is not optimized for flash storage.
• BMisleads by naming a Linux file system; macOS does not use ext4 as a native or default format, so it is not selectable for a Mac startup disk.
• DNames the Windows file system, which macOS can only read by default; it is not an Apple format and cannot serve as the default macOS startup file system.

BitLocker Drive Encryption is available only on Pro, Enterprise, and Education editions, so upgrading Home to Pro provides the feature for that laptop.

• ATrap because Windows Home does not include the Local Group Policy Editor, and BitLocker Drive Encryption is simply not present on the Home edition to enable.
• CMisleads because firmware exposes TPM and Secure Boot settings, not BitLocker itself; the encryption feature is licensed by Windows edition, not enabled in BIOS.
• DTrap conflating a file system change with edition features; exFAT lacks security features and a BitLocker OS drive must be NTFS, so this cannot add BitLocker.

Flushes and resets the DNS client resolver cache, discarding the outdated locally cached record so the next lookup queries the configured DNS server.

• ATrap that confuses re-registration with cache clearing; /registerdns refreshes the host's own DNS name and address registration but never discards cached lookup entries.
• BNames the command that only prints the contents of the resolver cache for inspection; it displays stale records but does nothing to remove or reset them.
• DSends a DHCPRELEASE that drops the adapter's IP lease entirely; it disables TCP/IP addressing and does not touch cached DNS name-resolution data at all.

The /t switch makes ping keep sending echo Request messages to the destination until interrupted, giving the continuous reachability test the technician wants.

• ATrap of forgetting the switch; with no parameters this sends only four echo Request messages by default and then stops, so it cannot monitor a flaky link over time.
• CNames a path-discovery tool that maps each router hop to the destination once; it reports the route rather than continuously verifying that the gateway stays reachable.
• DIdentifies a DNS diagnostic utility that resolves names and addresses; it queries DNS infrastructure and never tests IP-level connectivity or packet loss to the gateway.

Displays information used to diagnose DNS infrastructure and can query a chosen server for specific record types like MX, exactly what the task requires.

• ATrap that returns only the workstation's local resolver cache; it shows previously cached answers, not a live record queried straight from a chosen DNS server.
• BLists active TCP connections and listening ports on the computer; it reports socket state and has no ability to query DNS records of any type.
• CTests IP-level reachability by ICMP echo and can resolve a single name, but it cannot request a specific record type such as MX from a named server.

The /force switch reapplies all policy settings rather than only changed ones, applying the new GPO immediately without waiting for the refresh cycle.

• BTrap that only reports the Resultant Set of Policy already applied to the user and computer; it summarizes results but never reapplies or refreshes any policy.
• CLimits the refresh to user policy and, without /force, applies only settings that changed; computer-scoped settings in the new GPO would be skipped entirely.
• DNames a deprecated legacy command from older Windows versions; modern clients use gpupdate, so this string does not force a current policy refresh.

The /r switch restarts the computer after shutdown and /t 60 sets a 60-second timeout, producing the timed reboot the update requires.

• ATrap that uses /s, which shuts the computer down and powers it off; the update needs a restart, so the machine would stay off instead of rebooting.
• BEnds the current user session only and does not accept a timed restart; signing out leaves the operating system running and never reboots the computer.
• DThe /boot switch only restarts the PC when a Group Policy extension demands it after a policy refresh; it is not a general command to schedule a reboot.

The /fs:NTFS option sets the file system and /q performs a quick format, deleting the file table without a sector scan, exactly as requested.

• ATrap that confuses repair with formatting; chkdsk /f fixes file-system errors on an existing volume but never lays down a new file system on the drive.
• CNames the in-place conversion utility that upgrades an existing FAT volume to NTFS while keeping data; it does not perform the fresh format the task describes.
• DThe clean operation only removes all partitioning and volume formatting from the selected disk, leaving unallocated space with no NTFS file system created.

chmod changes the file mode bits, and u+x adds execute permission for the owning user, allowing the script to run as intended.

• ATrap that changes the file's owner to root instead of altering its permission bits; reassigning ownership does not add the missing execute permission the user needs.
• BReassigns the file's group ownership to staff; like changing the owner, it adjusts who is associated with the file but never sets any execute mode bit.
• COnly produces a long listing that displays the current permission bits for inspection; it reports the mode but cannot modify or grant execute access.

sudo allows a permitted user to execute a command as the superuser or another user, granting the elevation needed for one command per the security policy.

• BTrap that switches the entire session to another user, by default root, opening a persistent root shell rather than elevating just the one command requested.
• CChanges file mode bits on files and directories; it manages permissions on objects and provides no way to run a command itself with elevated privileges.
• DUpdates a user account's password and prompts for credentials; it neither elevates privilege for another command nor executes anything as the superuser.

The install action performs the requested install of one or more named packages from the package management system, pulling in dependencies as needed.

• ATrap that only downloads package information from all configured sources to refresh the index; it updates metadata but installs no package such as vim.
• BSearches the list of available packages for a matching term and displays results; it helps locate a package but never downloads or installs anything.
• DInstalls available upgrades for packages already on the system and may remove some to upgrade the whole system; it does not add a new package like vim.

grep searches for the pattern in the file and prints each line that matches, returning exactly the lines containing the word error.

• ATrap that reports a snapshot of the active processes on the system; it lists running programs and cannot search the contents of a text log file.
• CSearches the directory tree for files whose names match a pattern; it locates files by name rather than searching the text inside a given log file.
• DConcatenates and prints the entire file to the screen with no filtering; the technician would still have to read every line to spot matches manually.

On a Mac a keychain keeps track of keys, certificates, and other sensitive information, serving as the secure store for passwords and credentials.

• ATrap that names the backup feature which copies files to an external disk; it protects data by versioned backups but does not store passwords or certificates.
• BIdentifies the system-wide search feature for quickly finding apps, files, and information; it locates items but never acts as a secure credential store.
• CNames the window-and-spaces manager that shows all open windows and desktops; it organizes the screen and has nothing to do with storing secrets.

Mission Control shows all open windows arranged in a single layer and lets the user create additional desktops, called spaces, to organize those windows.

• BTrap that names the app for changing system preferences and configuration; it adjusts settings but does not display all open windows or create desktop spaces.
• CIdentifies the search feature that quickly finds apps, files, and answers; it surfaces items by query but does not arrange windows or create desktop spaces.
• DNames the storage tool used to erase, partition, and repair disks; it manages volumes and offers nothing for viewing windows or switching between spaces.

Time Machine automatically backs up files to external storage on hourly, daily, and weekly schedules and lets the user restore any of those files later.

• ATrap that names the search feature for quickly locating apps and files; it indexes content for fast retrieval but performs no backup or file restoration.
• BIdentifies the secure store for keys, certificates, and passwords; it safeguards credentials and offers nothing for scheduled backups of user documents.
• DNames the tool that erases, partitions, and repairs disks with First Aid; it maintains volumes but does not create scheduled, versioned backups of files.

Disk Utility checks for and fixes errors related to the formatting and directory structure of a storage device, which is exactly what First Aid performs.

• ATrap that rolls back files from a previous backup; it can recover lost data but does not examine or repair the underlying disk's directory structure errors.
• CNames the tool that shows running processes and resource usage like CPU and memory; it monitors live activity but cannot check or repair a disk.
• DIdentifies the utility that transfers accounts, apps, and files to a Mac from another computer; it moves data and never repairs disk directory errors.

Disk Management initializes a new disk so Windows can use it and then creates, formats, and assigns a drive letter to a new volume on that disk.

• ATrap that manages hardware devices and their drivers; it can confirm the disk's controller is recognized but cannot initialize a disk or create a volume.
• BNames the console that records Application, Security, and System event logs; it helps diagnose problems after the fact but does not partition or format drives.
• CIdentifies the tool for monitoring processes, performance, and startup apps; it shows resource usage and ending tasks, not initializing or formatting disks.

On a Private network the PC is discoverable to other devices and can be used for file and printer sharing, matching the trusted home scenario.

• BTrap recommended for untrusted locations; it hides the PC from other devices on the network, so file and printer sharing cannot be used in that profile.
• CNames the profile applied automatically when a PC is joined and authenticated to an Active Directory domain; a home PC is not domain-joined, so it does not apply.
• DIdentifies the toggle that disables all wireless communications such as Wi-Fi and Bluetooth; enabling it removes connectivity rather than configuring discovery.

HKEY_CURRENT_USER maps to the active user's branch in HKEY_USERS and defines that user's preferences, including environment variables, colors, printers, network connections, and application settings.

• AThis root key stores document type/class associations and COM/OLE registration shared by the whole system, not the colors, printers, and per-user application preferences tied to one signed-in account.
• CHKLM defines the physical state of the computer such as installed hardware and machine-wide software; editing here changes settings for all users rather than one specific signed-in profile.
• DHKEY_USERS contains the loaded profile hives for all users and the default profile; the cleaner, intended entry point for the current account's settings is its HKCU alias.

A delayed auto-start service is started after the other auto-start services plus a short delay, improving boot performance while still launching automatically without a sign-in.

• AA plain Automatic service is launched by the Service Control Manager during system boot alongside other auto-start services, which adds to startup load instead of deferring until after the boot completes.
• BA Manual (demand-start) service does not start on its own at all; it stays stopped until a process or the user explicitly starts it, so the agent would never auto-run.
• DA Disabled service cannot be started at all; any attempt returns ERROR_SERVICE_DISABLED until the start type is changed, so the backup agent would never run automatically.

Code 22 (CM_PROB_DISABLED) means the device was disabled in Device Manager, and the resolution is to enable it again from its right-click menu.

• AA corrupted or unloadable driver is reported by different codes such as Code 39; Code 22 specifically means the device was turned off, not that its driver files are damaged or missing.
• BResource conflicts where a device cannot find enough free resources are reported as Code 12, not Code 22, so reassigning interrupts would not resolve a disabled-device status.
• CA device with no installed driver is reported as Code 28; Code 22 indicates a working device that was administratively disabled rather than one lacking driver software entirely.

The Security log records logon and audit events such as account logon attempts and privilege use, making it the correct place to review successful and failed sign-ins.

• BThe Application log captures events written by installed software, such as program crashes and informational messages, and is not where Windows records authentication or logon auditing data.
• CThe System log records operating-system component events like driver failures and service start/stop messages; it is useful for hardware troubleshooting but does not hold logon audit records.
• DThe Setup log tracks installation, update, and feature-deployment activity rather than user authentication, so it would not contain the successful and failed logon events being investigated.

Programs and Features (under Control Panel > Programs) lists installed desktop programs and is the documented fallback for removing apps that cannot be uninstalled from the Settings app.

• ADevice Manager manages hardware and their drivers, letting you update, disable, or roll back devices; it has no capability to uninstall an installed desktop application such as accounting software.
• CAdministrative Tools is a Control Panel folder that launches management consoles like Services and Event Viewer; it does not provide a list of installed programs to uninstall a desktop application.
• DDefault Programs controls which apps open which file types and protocols; it changes file associations only and offers no option to actually uninstall or remove an installed program.

When a standard user attempts a task needing an administrator token, UAC requires valid administrator credentials, which is exactly the least-privilege behavior the admin wants for daily use.

• AAn Administrator account has complete (Full Control) access and only needs to confirm a consent prompt, so it does not force entry of separate administrator credentials before making system-wide changes.
• BThe Guest account is disabled by default and provides only very limited, anonymous-style access; it is a security risk and is unsuitable as an employee's everyday working account.
• DA Domain Administrator is the most powerful domain-wide account with extensive rights across every machine; assigning it for everyday use is the opposite of the least-privilege model requested here.

In This PC > Map network drive you pick the drive letter and folder path, and selecting Reconnect at sign-in makes Windows restore the mapping at every logon.

• BPinning to Quick access only creates a shortcut in the navigation pane; it does not assign a persistent drive letter that reconnects automatically each time the user signs in.
• CA net use mapping made without the /persistent:yes switch is temporary and is dropped at sign-out or reboot, so the drive would not return automatically at the next logon.
• DNetwork discovery only lets the PC see and be seen by other devices on the network; it does not assign a drive letter or create a reconnecting mapping to a specific share.

Keep my files reinstalls Windows while preserving personal files and removes installed apps and settings, exactly matching the goal of a fresh OS without losing data.

• ARemove everything reinstalls Windows but deletes all personal files along with apps and settings, which violates the requirement to preserve the user's documents and photos.
• BA clean install from USB formats the partition and removes everything including personal files unless they are backed up first, so it does not preserve documents the way Keep my files does.
• CSystem Restore only rolls back system files and settings to a snapshot; it does not reinstall Windows or reliably remove all the problematic apps the user wants cleared out.

FileVault encrypts the startup disk so data cannot be accessed without the login password, and it lets you choose a recovery key (or iCloud) to unlock the disk if the password is forgotten.

• AGatekeeper verifies that downloaded apps come from identified developers and are notarized; it controls which software is allowed to run and does nothing to encrypt the contents of the startup disk.
• CTime Machine creates scheduled backups of the Mac to another disk; it protects against data loss but does not encrypt the internal startup volume against unauthorized physical access.
• DKeychain Access stores passwords, keys, and certificates for apps and websites; it secures individual credentials rather than performing full-volume encryption of the Mac's startup disk.

Gatekeeper checks downloaded software for an identified developer and notarization; for a trusted app the user can override it in Privacy & Security by clicking Open Anyway.

• AFileVault only encrypts the startup volume and has no role in vetting downloaded applications; disabling it would weaken disk security and would not clear an unidentified-developer launch warning.
• BTime Machine is a backup-and-restore utility and plays no part in code-signing or app trust decisions, so it cannot explain or bypass the unidentified-developer security warning.
• DMission Control only arranges open windows, desktops, and full-screen apps; moving the app to another Space does nothing to satisfy or override Gatekeeper's code-signing check.

Pressing Option (Alt), Command, and Esc together opens the Force Quit Applications window, where the user selects the unresponsive app and clicks Force Quit.

• BCommand-Q is the normal Quit command that asks an app to close gracefully; a frozen app cannot process it, so this shortcut will not terminate an unresponsive application.
• CControl-Alt-Delete is a Windows key combination that has no defined function in macOS, so it will not open any force-quit dialog on a Mac.
• DCommand-W only closes the frontmost window of an app while leaving the application running; it neither force-quits the process nor opens the Force Quit Applications window.

The Finder, shown by the blue smiling-face icon in the Dock, is used to view, access, and organize almost everything on the Mac, including files, folders, and connected devices.

• ALaunchpad is a grid that displays and launches installed applications; it is not used to browse folders, organize documents, or access connected drives the way the file manager is.
• BSpotlight is the system search feature for quickly finding files, apps, and information; it locates items but is not the persistent window for organizing and managing files and folders.
• CMission Control gives an overview of open windows, desktop Spaces, and full-screen apps for switching between them; it does not provide file browsing or folder organization.

man is the system's manual pager; given a command name it finds and displays that command's full manual page, including its description and complete list of options.

• Awhatis prints only the short one-line description from the manual page's NAME section; it summarizes what cp is but does not display the full manual with all options.
• Capropos searches the short descriptions and names of manual pages for a keyword and lists matching pages; it helps discover commands but does not open cp's full manual page.
• Dwhich only reports the filesystem path of the cp executable found in the PATH; it tells you where the binary lives but shows none of its documentation or options.

ip is the iproute2 utility; ip address (abbreviated ip a) shows the addresses assigned to all network interfaces, replacing the deprecated ifconfig on current distributions.

• Bip route displays the kernel routing table, showing how traffic is forwarded to destinations and gateways; it does not list the IP addresses configured on the host's interfaces.
• CThis subcommand changes an interface's administrative state to up; it brings a link online but does not display the IPv4 or IPv6 addresses assigned to the interfaces.
• Dping only tests reachability by sending ICMP echo requests to a target; it confirms connectivity but does not report which IP addresses are bound to the local interfaces.

The -r (recursive) option tells rm to remove the listed directory together with all of its contents, deleting the entire tree in one command.

• ABy default rm does not remove directories; running it on a folder name without the recursive option fails to delete the directory and its nested contents in one command.
• Brmdir removes only empty directories; if the project folder still contains any files or subfolders, rmdir will refuse to delete it, so it cannot clear a populated tree.
• DMoving a directory onto /dev/null does not work as a delete; mv cannot overwrite the special device with a folder, so this neither removes nor safely discards the tree.

The -r (or -R) option makes cp copy directories recursively, duplicating the source folder along with all of its nested files and subfolders to the destination.

• AWithout the recursive option cp does not descend into directories, so copying a folder this way fails to reproduce its nested files and subfolders at the destination.
• Cmv moves or renames the source, removing it from its original location rather than copying it; the original directory would no longer exist where the user expects a backup copy.
• Dscp is intended for copying over the network using SSH and still needs recursion for directories; it is the wrong tool for a simple local folder copy on the same host.

ps reports a snapshot of the current processes, displaying details such as the process ID, so its static output can be piped into grep to locate a specific program.

• Atop provides a continuously refreshing, interactive real-time view rather than a single static snapshot, which makes its output awkward to pipe cleanly into grep for a one-time search.
• Bkill sends a signal to terminate a process identified by its PID; it acts on an existing process but does not list or report the set of currently running processes.
• Cjobs only lists background and suspended tasks started within the current shell session; it does not show all active system processes or their PIDs across the machine.

top provides a dynamic real-time view of a running system, continuously updating a list of processes managed by the kernel along with their CPU and memory usage.

• Bps reports only a one-time snapshot of processes at the moment it runs; it does not refresh on its own, so it cannot show resource usage changing live during the slowdown.
• Cuptime shows how long the system has run and the 1, 5, and 15-minute load averages; it gives a quick health summary but not a live per-process CPU and memory breakdown.
• Dfree reports total, used, and available memory and swap; it summarizes memory but does not list individual processes or continuously track which one is consuming the CPU.

This repairs the running (online) Windows image, pulling known-good replacement files from Windows Update to fix the component store, so a follow-up sfc /scannow can then succeed.

• AThis locates bad sectors and recovers readable information while checking file-system metadata, but it does nothing to rebuild a damaged Windows component store that sfc depends on for clean replacement files.
• BThis scans the integrity of protected system files and only reports problems without performing any repairs, so it cannot rebuild the corrupt component store that already stopped sfc from completing its repairs.
• DThis scans and attempts to repair only the single named file using the same store sfc already reported as damaged, so it cannot restore the broken component store that blocks the wider repair.

Robocopy copies directory trees with /S and /E for subdirectories, /Z for restartable mode that picks up where an interrupted copy left off, and /MT for multi-threaded copies.

• BThe basic copy command transfers individual files within a single directory and cannot recurse through nested subfolders or resume an interrupted network transfer from the point where it failed.
• CDiskpart manages disks, partitions, and volumes such as creating, formatting, or extending them, and it has no capability to copy files or folders between two locations at all.
• DXcopy can copy subdirectories with /S and /E and resume in restartable mode with /Z, but it lacks multi-threading, making it less robust than the purpose-built tool for large interrupted transfers.

Tasklist displays all processes running on the local or a remote computer with their PIDs, and formats such as /fo csv can be redirected to a text file for review.

• AThis ends one or more running processes selected by process ID or image name, so it stops processes rather than enumerating and displaying the running-process list the technician needs to capture.
• BThis displays the Resulting Set of Policy, showing which Group Policy settings apply to a user or computer, which is unrelated to listing the processes currently running on the machine.
• CThis scans and verifies the integrity of protected operating-system files and repairs corrupted versions, so it cannot enumerate the running processes or report their process identifiers to a file.

Optimize Drives runs the defragmenter, which locates and consolidates fragmented files on the volume to improve performance, the recommended treatment for a fragmented magnetic hard disk.

• AThis frees storage by deleting temporary files, system caches, and leftover update files, but it does not rearrange fragmented file data into contiguous regions on a magnetic hard drive.
• CThis creates, formats, resizes, and assigns letters to partitions and volumes, organizing the storage layout, but it provides no function to consolidate scattered file fragments on the disk.
• DThis checks the file system and its metadata for logical and physical errors and can repair bad sectors, but it does not defragment or reorder file data into contiguous placement.

Activity Monitor shows live CPU, memory, and energy use per process and lets you locate a troublesome process and force quit it when the system is sluggish or unresponsive.

• AThis verifies, repairs, erases, partitions, and formats disks and volumes to manage storage health, but it does not display live per-process CPU and memory consumption on the Mac.
• BThis displays system log messages and diagnostic reports useful for troubleshooting, but it does not show live per-process CPU and memory usage or let you force a runaway process to quit.
• CThis stores and manages passwords, keys, and certificates for the user's accounts and websites, which is entirely unrelated to monitoring real-time processor and memory usage by processes.

Spotlight opens with Command-Space and searches apps, files, and more as you type, letting you press Return to open the top match such as an app or document.

• BThis presents a bird's-eye view of all open windows, full-screen apps, and desktop Spaces so you can arrange them, but it is not a type-to-search launcher for apps or files.
• CThis automatically backs up apps, photos, documents, and system files to an external disk so they can be restored later, which has nothing to do with searching to launch an app.
• DThis is the file-manager home base for browsing folders and organizing files, and although it can search within windows, it is not the keyboard-shortcut, type-to-launch feature described here.

Chown changes the user and/or group ownership of each given file; supplying an owner such as bob makes that user the owner of report.csv.

• AThis changes the read, write, and execute permission bits granted to the owner, group, and others on a file, but it cannot reassign which user account actually owns that file.
• BThis changes only the group ownership associated with a file while leaving the user owner unchanged, so it cannot make the user bob the owner of report.csv.
• DThis updates the password and related authentication attributes of a user account, so it plays no role in changing which user owns a file stored on the file system.

Df reports file-system disk space usage for each mounted file system, and the -h option prints sizes in human-readable powers of 1024 such as G and M.

• AThis reports the disk space consumed by individual files and directories beneath a path, useful for finding large folders, but it does not summarize each mounted file system's total free space.
• CThis shows a live, continuously updating view of running processes with their CPU and memory consumption, but it does not report the capacity or available space of any mounted file system.
• DThis lists the files in a directory with their sizes, permissions, and timestamps, yet it cannot summarize the total and available capacity of a mounted file system.