Examkin

All practice questions

423 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 221Question →

An enterprise mobility administrator receives a high-severity alert indicating that a user's corporate smartphone has installed an unauthorized configuration profile, enabling a third-party server to intercept managed app traffic. Arrange the incident response and remediation steps in the correct chronological order from first action to final resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps for responding to an unauthorized mobile profile compromise is: first isolate the device from all networks, remove the untrusted profile and revoke certificates, perform a full OS wipe/reset, re-enroll the device into the MDM system, and finally document the incident and conduct post-incident training.
Mobile security incident response demands immediate network containment as the primary action to prevent exfiltration. Removing the unauthorized profile directly eliminates the threat vector. Performing a full wipe guarantees that no persistent artifacts remain. Re-enrolling via official MDM restores secure functionality, and post-incident documentation completes the administrative standard operating procedure.

Step-by-Step Solution

1
Isolate the mobile device from external communication channels.
Network access is cut off, halting active data interception or exfiltration.
Containment is always the first operational priority during an active mobile security incident.
2
Locate and delete the unauthorized profile and associated digital certificates.
The malicious routing configurations and trust relationships are eliminated from the mobile OS.
Targeted remediation removes the vector that allowed unauthorized access.
3
Execute a complete wipe/factory reset of the mobile device.
The device storage is fully erased, reverting to a clean factory state.
Mobile operating system security compromises may leave behind hidden persistence mechanisms.
4
Re-enroll the wiped device into corporate MDM.
Compliant enterprise policies, encryption standards, and trusted profiles are redeployed.
Restores the device to a secure, enterprise-approved operational state.
5
Log incident findings and review MDM onboarding rules.
Comprehensive documentation is completed, and preventive controls are tightened.
Ensures compliance and reduces the risk of similar unauthorized access events.

Key Concept

Mobile Device Incident Response and Malicious Profile Remediation
Question 222Question →

A Service Desk technician receives a report of a critical system failure affecting a remote executive's workstation. The incident requires diagnostic troubleshooting, escalation to Tier 3 engineering, asset tracking updates, user verification, and final documentation. Arrange the following ticketing workflow steps in the correct chronological order from earliest to latest.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows standard IT service management workflow: 1) Initial ticket logging and prioritization, 2) Comprehensive work note documentation prior to escalation, 3) Remediation and end-user verification testing, 4) Root cause, resolution logging, and CMDB asset updates, and 5) Formal ticket closure and final user notification.
The standard ITIL and CompTIA ticketing lifecycle follows a strict sequence: Incident Identification & Logging -> Categorization & Prioritization -> Diagnosis & Work History Documentation -> Escalation (if necessary) -> Resolution & User Verification -> Root Cause & Asset Log Updating -> Ticket Closure. Placing the steps in any other order violates proper operational procedures.

Step-by-Step Solution

1
Identify the creation and categorization phase.
Ticket creation, impact/urgency rating, and contact logging established.
Every ticketing workflow begins with establishing the ticket record and SLA parameters.
2
Determine the escalation pre-requisite step.
Documenting work notes prior to transferring to Tier 3 engineering.
Escalation rules strictly require logging prior steps to prevent wasted effort by higher-tier technicians.
3
Identify the remediation and confirmation phase.
Implementing the technical fix and confirming functionality with the user.
Verification with the end-user ensures the problem is genuinely solved in their actual working environment.
4
Identify the documentation and asset management phase.
Recording root cause, specific resolution steps, and CMDB/asset tag changes.
Administrative recording and asset updates capture knowledge for future incidents and maintain accurate inventory databases.
5
Identify the final lifecycle phase.
Changing status to Closed and issuing the final notification.
Closing the ticket terminates the SLA tracking and completes the lifecycle.

Key Concept

Ticketing System Lifecycle and Operational Workflow
Question 223Question →

A system administrator is troubleshooting a Windows 11 workstation that fails to boot normally after a forced power interruption during a cumulative system update. The machine automatically enters the Windows Recovery Environment (WinRE). Diagnostics indicate both system file corruption and a damaged local Windows Component Store (WinSxS). An external USB flash drive containing clean Windows installation media is attached to the system as drive E:E:. Place the following technician actions in the correct logical sequence to repair the operating system integrity offline.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution sequence begins with opening the WinRE Command Prompt, determining the offline system partition drive letter, repairing the local component store using DISM with an external source payload, executing offline SFC to replace corrupted protected system files, and finally restarting the machine to verify stability.
The correct repair workflow requires establishing a shell environment, verifying drive mappings, using DISM to restore the component store from a known-good source, running offline SFC against the repaired store to restore corrupt system files, and restarting to verify operating system health.

Step-by-Step Solution

1
Launch the WinRE Command Prompt.
An elevated recovery command-line environment is available for running repair utilities.
Offline diagnostic and repair commands require access to the recovery shell.
2
Identify the assigned drive letter for the offline OS installation.
The exact volume identifier for the Windows directory is confirmed.
WinRE dynamically assigns drive letters that frequently differ from the live operating system's drive mapping.
3
Run DISM with offline parameters (`/image:`, `/cleanup-image`, `/restorehealth`, `/source:`) pointing to the external media.
The damaged WinSxS component store is restored to a healthy state.
SFC relies on the WinSxS store to source replacement files. If the component store is corrupted, DISM must repair it first.
4
Run `sfc /scannow` using `/offbootdir=` and `/offwindir=` parameters.
Corrupted Windows system files are scanned and replaced using the healthy component store.
Offline SFC scans system file hashes against the healthy WinSxS repository and replaces corrupted binaries.
5
Restart the workstation into the standard Windows operating system.
The machine completes a normal boot sequence without entering crash loops or WinRE automatically.
Validates that system integrity has been fully restored and operating system boot failure is resolved.

Key Concept

Offline Windows system file repair workflow requiring DISM component store remediation prior to System File Checker execution.
Estimated Time:2m 30s
Question 224Question →

A desktop technician needs to repair suspected system file corruption on a Windows workstation where the local Windows component store itself might be damaged. What is the correct sequence of repair steps the technician should perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The technician must first open an elevated Command Prompt, execute DISM to repair the component store, run SFC to repair corrupted system files, and restart the workstation to finalize updates.
The correct repair sequence begins with launching an elevated command shell. Next, DISM is executed to fix the Windows Component Store payload. Once DISM finishes successfully, SFC is run to replace damaged OS binaries using the clean store. Finally, restarting the system applies changes to locked files.

Step-by-Step Solution

1
Launch Command Prompt with elevated privileges.
System grants administrative rights required for disk and image repairs.
Command-line repair utilities require elevated rights to access system directories.
2
Run DISM with the restore health parameter.
The Windows Component Store payload files are checked and repaired.
SFC relies on the component store as its source for clean replacement files.
3
Run SFC scannow.
Corrupted protected system files are repaired using the healthy store.
Scanning after DISM ensures SFC has valid clean files available.
4
Reboot the system.
In-use protected system files are updated during startup.
Locks on actively loaded system binaries are released during reboot.

Key Concept

Sequential repair of Windows system files using DISM prior to SFC
Estimated Time:1m 0s
Question 225Question →

A desktop technician is servicing a Windows workstation that exhibits severe system corruption after an improper shutdown. The System File Checker utility (`sfc /scannow`) fails immediately, stating that the Windows Component Store is corrupted. What is the correct sequence of command-line operations the technician should perform to repair the Component Store and successfully fix the corrupted system files using an online repair source?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The technician should first verify corruption status (`dism /checkhealth`), perform a thorough health scan (`dism /scanhealth`), repair the Component Store payload (`dism /restorehealth`), and finally execute the System File Checker scan (`sfc /scannow`).
The correct troubleshooting sequence requires inspecting and repairing the underlying servicing store before attempting to fix system binaries. `dism /checkhealth` quickly verifies existing flags, `dism /scanhealth` performs a full scan of the Component Store, `dism /restorehealth` fixes the corrupted payload store via Windows Update, and `sfc /scannow` uses the repaired store to replace corrupted protected system files.

Step-by-Step Solution

1
Check the health status of the Windows image using DISM CheckHealth.
Determines if corruption was previously flagged in the registry.
Running `dism /online /cleanup-image /checkhealth` is a quick diagnostic step that does not make repairs or perform lengthy scans.
2
Perform a deep integrity scan of the Windows Component Store using DISM ScanHealth.
Scans the component store for corruption.
Executing `dism /online /cleanup-image /scanhealth` checks the Component Store thoroughly to confirm whether repairs are necessary.
3
Repair the corrupted Windows Component Store using DISM RestoreHealth.
Replaces corrupted payload files in the Component Store using Windows Update.
Executing `dism /online /cleanup-image /restorehealth` fixes the local store. SFC relies on this store to repair system files.
4
Scan and repair protected system files using System File Checker.
Verifies protected Windows binaries and replaces corrupted files using the repaired Component Store.
Running `sfc /scannow` as the final step successfully replaces damaged core system files now that the backing source is healthy.

Key Concept

DISM and SFC Repair Workflow Sequencing
Question 226Question →

A systems administrator is designing a PowerShell (.ps1) script to parse automated log backups, identify errors, and append summaries to an administrative report. Place the logical scripting steps and constructs in the correct order of execution from top to bottom.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical order is: 1. Declare and initialize script environment variables (LogPath,LogPath, ReportFile) to set file system paths. 2. Initialize a 'foreach' loop construct to iterate through the collection of log files retrieved from LogPath.3.Evaluatean′if′conditionalbranchtocheckifthecurrentlogfilecontainsentriesmatchingan′ERROR′string.4.ExecuteanoutputredirectioncommandtoappendmatchingerrorlinesintoLogPath. 3. Evaluate an 'if' conditional branch to check if the current log file contains entries matching an 'ERROR' string. 4. Execute an output redirection command to append matching error lines into ReportFile. 5. Terminate the loop construct and output a completion message to the standard console output.
In administrative scripting languages (such as PowerShell, Bash, or VBScript), execution flows sequentially from top to bottom. Variable declaration establishes environment configuration before data processing. Iteration constructs ('foreach' loops) cycle through data structures, while conditional constructs ('if' statements) evaluate criteria inside the loop. Actionable output (redirection to report files) occurs upon meeting conditional criteria, and overall script termination occurs after all iterations complete.

Step-by-Step Solution

1
Identify prerequisite script requirements.
Path variables LogPathandLogPath and ReportFile are declared.
Script execution requires path environment variables to be in scope before invoking file processing constructs.
2
Set up collection iteration.
The 'foreach' loop structure is declared.
Iteration constructs must wrap per-item logical processing.
3
Apply selection logic within the loop.
The 'if' conditional branch filters log content.
Conditional logic must run inside the loop body against each iterated file.
4
Perform the target action for matching items.
Matching log content is written to the report file.
Data manipulation/redirection occurs only when the conditional criteria are met.
5
Finalize execution flow.
The loop closes and terminal output is written.
Summary output and construct termination must follow the completion of all iterations.

Key Concept

Sequential execution and logical flow of basic scripting constructs (variable initialization, loop iteration, conditional branching, and I/O redirection).
Question 227Question →

A mobile device technician is troubleshooting a corporate badge authentication application on an Android smartphone that continuously freezes when attempting to read NFC tags. Arrange the following troubleshooting steps in the correct order, from least invasive to most invasive.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of troubleshooting steps from least invasive to most invasive is: Force stop the application, clear the application cache, uninstall and reinstall the application, and perform a complete factory reset.
Mobile OS application troubleshooting must follow the least-invasive to most-invasive progression. Force stopping the app is immediate and non-destructive. Clearing the app cache removes temporary junk files without erasing user settings. Uninstalling and reinstalling replaces app binaries and resets app settings, requiring re-login. A full factory reset wipes the entire smartphone and represents the absolute last resort.

Step-by-Step Solution

1
Terminate the stuck application process
Force stopping the application halts unresponsive processes immediately without altering stored user data.
CompTIA troubleshooting methodology dictates attempting non-destructive application restarts before altering data files.
2
Purge temporary cached data
Clearing cache removes corrupted temporary files while keeping user accounts and app configurations intact.
If a basic application restart fails, clearing temporary cache resolves data corruption with minimal user disruption.
3
Replace application files via reinstallation
Uninstalling and reinstalling overwrites corrupted program code and local app settings.
Reinstallation fixes software-level file corruption within the app before considering device-wide operating system resets.
4
Reset the device operating system to factory defaults
All user data, settings, and third-party applications are permanently erased from the smartphone.
A system factory reset is the most invasive troubleshooting step and should only be performed after all app-level options are exhausted.

Key Concept

Least-invasive troubleshooting methodology for mobile applications
Question 228Question →

A support technician is dispatched to an employee's desk to perform an on-site hardware maintenance procedure on a workstation. Place the technician's professional customer interaction steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence begins with greeting the customer and verifying a suitable work time, followed by actively listening to their issue, explaining the repair scope and obtaining permission, performing the service professionally, and finally confirming solution success with the user while documenting the ticket.
The correct order follows standard CompTIA operational procedures for desk-side support: initial greeting and schedule confirmation must occur first, followed by active listening to gather symptoms, communicating the repair plan to gain explicit consent, executing the repair with respect to privacy and environment, and concluding with user verification and ticket documentation.

Step-by-Step Solution

1
Initiate the interaction
Technician introduces self, states visit purpose, and confirms timing with user.
Establishes rapport and avoids unexpected disruption to the user's workload.
2
Gather problem details
Technician listens actively without interruption.
Allows the user to explain symptoms fully and avoids miscommunication.
3
Set expectations and seek consent
Technician provides non-technical overview of repair steps and estimated downtime, obtaining user consent.
Maintains transparency and prevents unauthorized downtime on active systems.
4
Execute maintenance
Technician completes hardware repair while respecting workspace confidentiality and cleanliness.
Protects customer privacy and physical assets during service execution.
5
Verify and close ticket
User tests the workstation, technician answers questions, and the work log is completed.
Ensures complete resolution satisfaction and proper institutional record-keeping.

Key Concept

Professional On-Site Communication and User Interaction Lifecycle
Estimated Time:1m 30s
Question 229Question →

In what sequence should an IT technician carry out standard customer interaction steps during a support engagement, from initial contact to ticket closure? Place the steps in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with greeting and active listening, followed by clarifying the problem, setting clear expectations and timeframes, executing the technical resolution with progress updates, and concluding with customer verification and ticket documentation.
The standard CompTIA customer communication lifecycle follows a structured sequence: 1) Greet the customer and practice active listening without interrupting; 2) Ask clarifying questions and restate the issue in non-technical terms to ensure mutual understanding; 3) Set proper customer expectations by explaining planned steps and providing time estimates; 4) Perform the work while providing periodic updates; and 5) Verify issue resolution directly with the customer before documenting details in the ticketing system and closing the case.

Step-by-Step Solution

1
Greet the customer and actively listen
Establishes professional rapport and gathers initial information without interrupting.
Listening first prevents miscommunication and ensures the customer feels heard.
2
Ask clarifying questions and restate the problem
Confirms understanding in plain language.
Restating the problem verifies that the technician accurately understands the user's issue before proceeding.
3
Set clear expectations and timeframes
Aligns customer expectations with actual technical procedures and scope.
Users need to know estimated completion times and expected downtime before work begins.
4
Execute the technical solution
Resolves the underlying technical issue while keeping the customer informed of any unexpected delays.
Performing work after establishing expectations minimizes user disruption and confusion.
5
Verify satisfaction and document resolution
Ensures the customer agrees the problem is fixed and creates an audit trail in the ticketing system.
A ticket should only be closed after user verification and complete documentation.

Key Concept

Best practices for professional user communication and support interaction lifecycle.
Question 230Question →

Place the standard stages of an IT service desk incident ticket lifecycle in the correct order, from the initial reporting of an issue to the final ticket status update.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the ticketing workflow lifecycle is: Ticket Intake and Creation, Triage and Categorization, Troubleshooting and Work Log Update, User Resolution Verification, and Ticket Closure and Knowledge Capture.
In standard IT service management (ITIL/CompTIA best practices), an incident begins with Ticket Intake and Creation to record user details. It moves to Triage and Categorization for routing and priority assessment, followed by Troubleshooting and Work Log Update during active resolution. Once resolved technically, User Resolution Verification confirms satisfaction, and lastly, Ticket Closure and Knowledge Capture formally finishes the lifecycle.

Step-by-Step Solution

1
Identify the initial entry point of a ticket.
Ticket Intake and Creation must occur first to capture contact details and the initial symptom description.
Work cannot begin until the incident is formally captured in the ticketing system.
2
Determine how the ticket is prioritized and routed.
Triage and Categorization follows initial creation.
Categorizing and prioritizing ensures high-severity issues are addressed promptly by the right team.
3
Identify the active resolution phase.
Troubleshooting and Work Log Update takes place next.
Technicians investigate the issue and record their progress in the ticket work log.
4
Determine the quality assurance check before administrative completion.
User Resolution Verification must occur before closing.
Standard IT service management practices require confirming with the user that their problem is resolved.
5
Identify the final phase.
Ticket Closure and Knowledge Capture is the last step.
Final documentation and marking the ticket status as Closed completes the workflow.

Key Concept

Standard Incident Management Ticket Lifecycle Workflow
Question 231Question →

An IT department follows standard IT service management (ITSM) guidelines for handling support incidents. Place the following stages of the incident ticket workflow in the correct sequential order from initial occurrence to final administrative completion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the incident ticket workflow is: 1) Ticket Logging and Categorization, 2) Initial Investigation and Triage, 3) Ticket Escalation, 4) Resolution and User Verification, and 5) Documentation and Ticket Closure.
The standard ITSM incident management workflow begins with ticket logging and categorization upon user contact, followed by initial investigation and triage by Tier 1 technicians. If unresolved, the ticket is escalated to Tier 2 with detailed notes. Once solved, the technician implements the resolution and verifies functionality with the user, ending with final documentation and official ticket closure.

Step-by-Step Solution

1
Identify the initial ticket entry requirement
Ticket Logging and Categorization is the first step.
An incident must be formally documented, prioritized, and categorized in the ITSM platform upon initial user report.
2
Identify the preliminary troubleshooting stage
Initial Investigation and Triage follows ticket creation.
Tier 1 technicians investigate symptoms and record preliminary work notes to evaluate the problem.
3
Identify the escalation workflow step
Ticket Escalation occurs after Tier 1 diagnostics are recorded.
When an issue requires specialized knowledge, it is transferred to Tier 2 with complete diagnostic history attached.
4
Identify post-repair requirements
Resolution and User Verification takes place after applying the technical solution.
Technicians must verify with the end user that the issue is fixed prior to finalizing the ticket.
5
Identify final ticket administrative completion
Documentation and Ticket Closure is the final stage.
Recording final resolution details, updating knowledge bases, and closing the ticket record completes the workflow.

Key Concept

ITSM Incident Management and Ticket Lifecycle
Question 232Question →

A field service technician is troubleshooting an enterprise Android tablet used by delivery drivers. A key line-of-business navigation application frequently freezes and becomes unresponsive during route updates. Arrange the troubleshooting steps in the correct sequence from least invasive to most invasive.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from least invasive to most invasive is: Force stop the unresponsive navigation application, perform a soft reset of the mobile tablet, clear the application cache and local app data, uninstall and reinstall the navigation application, and perform a full factory reset on the mobile tablet.
CompTIA troubleshooting best practices dictate progressing from the least invasive action to the most invasive action. Force stopping the stuck application process is least disruptive as it does not restart the system or alter stored data. Performing a soft reset is second because it reboots the OS and clears RAM without modifying files. Clearing app cache/data is third because it deletes local app state and configurations. Reinstalling the app is fourth because it replaces all core app files. Finally, factory resetting the device is the most invasive step because it wipes all user data and settings across the entire operating system.

Step-by-Step Solution

1
Terminate the frozen application process.
Force stopping the application stops the hung thread without affecting system memory or persistent settings.
Always begin troubleshooting by isolating the specific process before taking disruptive measures.
2
Reboot the mobile operating system.
Performing a soft reset reboots the OS and flushes volatile RAM without deleting files.
If process termination fails, rebooting clears OS-level memory leaks or frozen system services.
3
Reset local application storage state.
Clearing the app cache and data removes corrupt temporary data files that persist across process restarts.
This modifies saved application state and stored settings, making it more invasive than rebooting.
4
Replace damaged application binaries.
Uninstalling and reinstalling downloads a fresh installation package.
This replaces core binary files, requiring full app setup and credential re-entry.
5
Execute system-wide factory restoration.
Performing a factory reset erases all user data, applications, and configurations.
Factory resets restore the device to out-of-box defaults and should strictly serve as a last resort.

Key Concept

Least-invasive troubleshooting methodology for mobile OS application performance and freezing issues
Question 233Question →

An IT support technician is assigned to investigate a recurring network authentication failure that eventually requires specialized team escalation and asset replacement. In what order should the technician perform the following steps within the ticket management lifecycle from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Log contact details and assign priority, 2) Perform Tier 1 diagnostics and record work notes, 3) Reassign ticket to specialized queue with findings, 4) Apply resolution and confirm functionality with end user, and 5) Record root-cause notes, update asset records, and close ticket.
The correct order follows standard IT Service Management lifecycle practices: ticket entry and priority assignment, Tier 1 triage with internal work log updates, escalation to specialized teams with technical findings, solution implementation with end-user verification, and final root-cause documentation alongside CMDB asset record updates prior to closure.

Step-by-Step Solution

1
Ticket Creation and Categorization
Initial incident entry created with user details and priority.
Every workflow begins with registering the ticket and capturing impact and user details.
2
Tier 1 Investigation & Work Note Documentation
Diagnostic steps executed and entered into internal work notes.
Detailed work notes prevent duplicate effort by higher tier technicians if escalation becomes necessary.
3
Ticket Escalation
Ticket transferred to specialized group with attached logs.
Escalation occurs after Tier 1 diagnostics are exhausted and properly documented.
4
Resolution & User Verification
Fix applied and operational status verified with the reporting user.
CompTIA guidelines dictate that resolution must always be verified with the user before ticket closure.
5
Asset Tracking Update & Closure
CMDB updated with new hardware records and ticket marked Closed.
Final documentation, asset management inventory updates, and ticket closure complete the lifecycle.

Key Concept

Incident Ticketing Lifecycle and Work Notes Documentation Workflow
Question 234Question →

A desktop support technician is assigned an escalated ticket to resolve a critical application crash on a department manager's workstation during business hours. Place the technician's professional customer communication and interaction steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence begins with greeting the user and confirming ticket context, followed by uninterrupted active listening. Next, the technician explains the action plan in plain language and sets downtime expectations. The technician then executes the repair while maintaining privacy and workspace boundaries. Finally, the technician verifies functionality with the user, documents the resolution in the ticket, and provides follow-up contact details.
Professional customer service workflows follow a strict logical progression: establishing initial contact and rapport, actively listening to understand the issue fully without interruption, communicating the plan of action and setting downtime expectations, performing the repair work while upholding privacy and property standards, and completing user-side verification and ticketing documentation.

Step-by-Step Solution

1
Initial Greeting & Identification
Establishes professional rapport and confirms ticket scope.
Technicians must introduce themselves and clarify the problem context before touching hardware or making assumptions.
2
Active Listening & Information Gathering
Gathers complete symptom description while de-escalating customer anxiety.
Interpreting user concerns without interruption prevents missing critical details and demonstrates respect.
3
Communicating Plan & Downtime Expectations
Obtains informed customer consent and minimizes unexpected business interruption.
CompTIA standards mandate setting clear expectations in non-technical terms before starting administrative repairs.
4
Executing Repair with Confidentiality Protocols
Resolves the technical fault while securing user PII and respecting physical space.
Remediating the system safely occurs after consent and plan alignment are established.
5
User Verification, Ticket Documentation & Follow-Up
Confirms problem resolution, logs knowledge base details, and establishes post-repair support.
A ticket should never be closed until the customer confirms satisfaction and detailed records are entered.

Key Concept

CompTIA Customer Communication & Incident Lifecycle Workflow
Question 235Question →

A security administrator discovers that a corporate mobile device was connected to an unauthorized rogue Wi-Fi access point and subsequently installed a malicious configuration profile. Place the following remediation steps in the correct chronological order to contain the incident and restore the device to a secure state.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with network isolation of the compromised mobile device, followed by removing the malicious configuration profile and root certificates, revoking and updating compromised account credentials while scanning for malware, and finally re-enrolling the device into enterprise Mobile Device Management (MDM).
In CompTIA security troubleshooting procedures, containment (disconnecting network interfaces) must take place before remediation (deleting rogue profiles/certificates and resetting passwords). Once the device is remediated and verified clean, recovery (MDM re-enrollment and policy deployment) restores secure operational status.

Step-by-Step Solution

1
Isolate the compromised mobile device from all active networks.
Prevents active data exfiltration, rogue server traffic, and lateral movement.
Containment is always the top priority when responding to unauthorized mobile access or rogue network connections.
2
Delete the unauthorized profile and malicious CA certificates.
Stops the rogue profile from managing device settings or decrypting traffic via untrusted certificates.
Eliminates the persistent vector created during the security incident.
3
Reset user authentication tokens/passwords and scan the OS.
Ensures compromise of credentials during the MITM or rogue AP session cannot be leveraged elsewhere.
Remediates potential secondary compromise of account credentials and confirms no residual malicious payload remains.
4
Re-enroll the device into enterprise MDM.
Restores legitimate corporate access and re-applies enterprise compliance baselines.
Brings the device back into compliance under centralized administrative control.

Key Concept

Mobile Device Incident Response and Security Remediation Workflow
Question 236Question →

An enterprise systems administrator must perform a critical migration of an organizational database to a high-availability cloud architecture. To comply with standard CompTIA change management protocols, place the following administrative steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order for the change management lifecycle is: 1) Identify and document purpose and scope, 2) Perform risk analysis, 3) Develop implementation plan, rollback strategy, and testing protocol, 4) Submit package to the Change Advisory Board (CAB) for approval, 5) Send end-user notifications, and 6) Execute post-implementation verification testing and complete documentation.
The formal ITIL/CompTIA change management workflow requires that scope definition occurs first, followed by risk analysis, technical planning (including rollback and pre-testing), CAB review and approval, end-user communication, and finally post-implementation verification testing accompanied by ticket closure documentation.

Step-by-Step Solution

1
Define purpose and scope
Establishes clear boundaries and target systems affected by the change.
Operational scope must be clearly articulated first to understand potential downstream dependencies.
2
Conduct risk assessment
Identifies potential failure points, downtime risks, and business impacts.
Understanding risks directly dictates the safety measures and rollback procedures needed.
3
Formulate deployment plan, rollback plan, and sandbox testing
Produces step-by-step instructions for installation, recovery, and pre-deployment verification.
Complete implementation and fallback instructions must be fully prepared prior to seeking administrative board approval.
4
Obtain Change Advisory Board (CAB) authorization
Secures formal management authorization to proceed with the planned modification.
The CAB evaluates the risk assessment, timing, and rollback strategy to authorize the change request.
5
Issue end-user and stakeholder notifications
Alerts affected users to scheduled service interruptions.
Notifications must occur prior to maintenance, but only after formal approval guarantees the schedule.
6
Perform post-implementation testing and complete final documentation
Verifies full functionality post-change and logs the outcome in the ticketing system.
Post-implementation testing confirms system stability and completes compliance recordkeeping.

Key Concept

CompTIA A+ Core 2 Change Management Process Lifecycle
Question 237Question →

An IT technician discovers a workstation infected with ransomware on the corporate network. Arrange the initial incident response actions in the correct chronological order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of incident response steps is: First, identify the security incident and confirm the threat; Second, report the incident to the designated supervisor or incident response team; Third, isolate the compromised system from the network; Fourth, preserve system evidence and document the chain of custody.
Under standard CompTIA first responder procedures, the chronological order of operations is identification, reporting to proper authorities, isolating the system to contain the threat, and preserving evidence along with chain of custody documentation.

Step-by-Step Solution

1
Identify the incident
Confirmed ransomware infection on the workstation.
Incident identification must occur first to understand the scope and nature of the issue.
2
Report the incident
Escalated details to the security and management team.
Reporting immediately ensures organizational response protocols and communication channels are activated.
3
Isolate the system
The machine is quarantined from the network.
Isolating the system contains the threat and prevents the ransomware from spreading to shared files or other machines.
4
Preserve evidence and document chain of custody
Volatile memory and logs are secured with handler details recorded.
Preserving evidence maintains data integrity and ensures forensic evidence remains admissible and verifiable.

Key Concept

First Responder Incident Response Sequence
Question 238Question →

A desktop technician is troubleshooting a Windows workstation displaying missing file errors and system instability. The technician suspects corruption within both the Windows component store and protected operating system files. In what order should the technician perform the following repair steps to ensure system integrity is fully restored?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of repair steps is: Open an elevated Command Prompt, execute DISM to repair the component store, execute SFC to repair system files, and restart the computer to complete pending replacements.
To repair corrupted operating system files effectively, administrative elevation must be established first. Executing DISM `/restorehealth` restores the health of the Windows component store image. Once the store is repaired, running `sfc /scannow` allows the System File Checker to successfully extract clean file copies from the component store and repair corrupted OS files. Finally, restarting the workstation applies file updates for core binaries that were locked in active memory during the scan.

Step-by-Step Solution

1
Open Command Prompt with administrative privileges.
Obtains necessary administrative permissions to run system-level diagnostic and repair tools.
Both DISM and SFC require elevated privilege levels to modify protected system directories.
2
Run `dism /online /cleanup-image /restorehealth`.
Scans and repairs the Windows image component store cache.
The System File Checker uses the component store as its source repository. If the component store itself is corrupt, SFC will fail to repair files until DISM fixes the store.
3
Run `sfc /scannow`.
Scans protected system files and replaces corrupted ones using the restored component store.
Once the component store is healthy, SFC can pull clean replacement files to replace damaged system binaries.
4
Reboot the operating system.
Applies changes to system files that could not be modified while actively loaded in memory.
Core operating system files in active use are queued for replacement during the next system startup.

Key Concept

Sequential repair of Windows component store using DISM prior to executing System File Checker (SFC)
Estimated Time:1m 30s
Question 239Question →

An enterprise IT technician arrives at a scene where a running server is suspected of being compromised during an active data exfiltration incident. Arrange the technician's digital evidence preservation steps in the correct sequence according to standard forensic order of volatility and incident response procedures.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the order of volatility: capture system RAM first, record active network and process states second, create a bit-stream image of non-volatile storage drives third, and complete the chain of custody log fourth.
Digital evidence preservation strictly follows the order of volatility to prevent evidence degradation. The sequence starts with capturing system RAM (highest volatility), followed by recording active processes and network connections, then imaging non-volatile hard drives using a hardware write-blocker, and concluding with completing the chain of custody form to ensure legal defensibility.

Step-by-Step Solution

1
Preserve the most volatile evidence first.
System RAM and live memory contents are captured to write-protected external storage.
RAM contents are easily altered or destroyed by power loss or routine system operations.
2
Collect active system state information.
Network connections, open ports, and active process tables are logged.
These states change rapidly as network traffic flows and processes terminate.
3
Perform bit-stream imaging of persistent storage.
Secondary storage drives are imaged using a hardware write-blocker.
Non-volatile storage retains data permanently without power and can be safely imaged after volatile data is secured.
4
Finalize legal evidence tracking documentation.
The chain of custody log is filled out with timestamps, identifiers, and handler signatures.
Detailed documentation maintains evidence integrity and admissibility in legal proceedings.

Key Concept

Order of Volatility and Incident Response Evidence Preservation
Question 240Question →

A technician suspects that a mobile device has connected to a rogue wireless network and transmitted sensitive data. Place the standard incident response steps in the correct order to mitigate the security threat.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence to mitigate a rogue Wi-Fi connection incident is: First, enable Airplane Mode to isolate the device; second, remove the rogue network profile; third, update compromised user account credentials; and finally, disable Airplane Mode to reconnect to a safe, secure network.
The correct troubleshooting sequence follows standard incident response procedures: isolate the compromised device immediately (Airplane Mode), remove the malicious configuration (forget rogue network profile), protect user identity (reset account credentials), and safely restore connectivity to a trusted network.

Step-by-Step Solution

1
Isolate the mobile device
Enabling Airplane Mode immediately terminates active Wi-Fi connections, halting data leakage.
Containment is the first priority when responding to network security compromises.
2
Remediate auto-connect settings
Forgetting the rogue network profile ensures the device will not attempt auto-reassociation.
Prevents immediate re-infection or unintended connection upon disabling Airplane Mode.
3
Secure account credentials
Resetting passwords revokes access for any unauthorized party who may have captured authentication tokens.
Rogue access points often capture cleartext or hash-based user credentials.
4
Restore safe operations
Rejoining a legitimate enterprise network confirms secure service restoration.
Allows the user to resume normal operations safely.

Key Concept

Mobile Device Security Incident Containment and Remediation
Estimated Time:1m 0s
PreviousPage 12 / 22Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin