Examkin

All practice questions

3551 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 2521Question →

A technician is troubleshooting a Windows 11 desktop computer configured with UEFI firmware and a GPT partitioned system drive. Upon powering on, the workstation fails to boot into the operating system and presents a blue recovery screen displaying error code 0xc000000e, indicating that the boot selection failed because a required device is inaccessible or the Boot Configuration Data (BCD) entry is missing. The technician boots the system using Windows installation media and accesses the Windows Recovery Environment (WinRE) command prompt. Which of the following commands should the technician execute first to recreate the corrupted UEFI boot loader entries on the EFI System Partition?

Show answer & explanation

Answer: Execute bcdboot C:\Windows to regenerate the BCD store and copy core boot environment files to the EFI System Partition.

Answer

Execute bcdboot C:\Windows to regenerate the BCD store and copy core boot environment files to the EFI System Partition.
On modern UEFI systems utilizing GPT disks, boot configuration files and winload.efi reside on the hidden FAT32 EFI System Partition (ESP). The error code 0xc000000e occurs when the Boot Configuration Data (BCD) points to an invalid partition identifier or when boot entries are missing. Executing the command 'bcdboot C:\Windows' copies core system boot files directly from the Windows OS directory to the ESP and regenerates a valid BCD configuration store, enabling the system to boot properly.

Step-by-Step Solution

1
Identify system firmware and disk layout specifications.
The target system uses UEFI firmware and a GPT disk scheme, which relies on an EFI System Partition (ESP) containing winload.efi rather than a legacy MBR boot code area.
Boot recovery tools must match the underlying disk structure and firmware standard.
2
Analyze the error code symptom 0xc000000e.
Error code 0xc000000e signifies that the Windows Boot Manager cannot locate the required device object or BCD entry to initiate winload.efi.
Corrupted or missing BCD records on UEFI systems prevent successful operating system handoff during early startup.
3
Select the proper command-line tool for UEFI boot environment reconstruction.
Running bcdboot C:\Windows extracts boot environment files from the Windows image directory and writes new boot files to the EFI System Partition while rebuilding the BCD configuration.
bcdboot is the standard utility for initializing and repairing boot files on GPT/UEFI Windows systems.

Key Concept

UEFI/GPT Windows Boot Repair using BCDBoot
Question 2522Question →

A weather monitoring organization hosts an automated telemetry processing system in a public cloud platform. During unpredicted atmospheric anomalies, data transmissions from thousands of field sensors spike tenfold within seconds. The underlying cloud environment automatically expands virtual computing instances to process the incoming burst load and subsequently releases those resources back to the provider once traffic subsides to baseline levels, all without administrator interaction. Which cloud characteristic is directly demonstrated in this deployment?

Show answer & explanation

Answer: Rapid elasticity

Answer

Rapid elasticity
Rapid elasticity is the cloud computing characteristic that enables systems to automatically provision and release computing resources dynamically in response to real-time workload changes. In this scenario, the immediate expansion during data spikes and subsequent contracting when traffic normalizes demonstrates rapid elasticity.

Step-by-Step Solution

1
Analyze the operational requirements stated in the scenario
Identified that compute capacity automatically increases during unexpected peak loads and automatically decreases when demand drops without human intervention.
Determining whether resource adjustment is automated and dynamic isolates the core feature in question.
2
Compare the identified operational capability against essential cloud characteristics
Rapid elasticity is defined as the capability to seamlessly expand (scale out) and contract (scale in) infrastructure resources dynamically matching demand.
Differentiating automatic runtime scaling from manual self-service provisioning or background multi-tenant resource assignment ensures accurate classification.

Key Concept

Cloud Characteristics: Rapid Elasticity vs. On-Demand Self-Service vs. Resource Pooling
Question 2523Question →

A technician is preparing to replace a motherboard in a mid-tower workstation chassis. The upgrade requires maintaining physical compatibility with the existing computer case while supporting standard desktop power supply delivery and expansion requirements. Which TWO of the following motherboard specification details should the technician verify before purchasing the replacement board?

Select all that apply

Show answer & explanation

Answer: Standard ATX form factor dimensions (12×9.6 inches12 \times 9.6\text{ inches}) and mounting hole patterns compatible with the chassis standoffs; 24-pin main ATX power connector and 8-pin EPS12V auxiliary CPU power socket presence for power supply cable connectivity

Answer

The technician must verify standard ATX form factor dimensions (12×9.6 inches12 \times 9.6\text{ inches}) with compatible mounting hole patterns and confirm the motherboard features both a 24-pin main ATX power connector and an 8-pin EPS12V auxiliary CPU power socket.
The standard ATX form factor uses a 12×9.6 inches12 \times 9.6\text{ inches} board layout with fixed standoff mounting locations that fit mid-tower chassis. Additionally, a desktop system requires both the primary 24-pin ATX power header for board logic and an 8-pin EPS12V connector for dedicated processor power delivery.

Step-by-Step Solution

1
Evaluate chassis form factor and mounting requirements
Confirm standard ATX measurements (12×9.6 inches12 \times 9.6\text{ inches}) align with mid-tower case screw standoffs
Motherboards must physically fit inside the enclosure and align with predefined mounting standoffs to prevent short circuits.
2
Identify power connection standards required for full motherboard powering
Require a 24-pin main power connection and an 8-pin EPS12V CPU power connection
Modern desktop motherboards derive main system power via a 24-pin connector while utilizing an 8-pin EPS12V cable for processor voltage delivery.

Key Concept

Motherboard Form Factors and Power Connectors
Estimated Time:1m 30s
Question 2524Question →

An IT security administrator is auditing the endpoint security baseline for mobile devices and embedded systems across the organization. Match each security operational control on the left with its corresponding security implementation objective on the right.

Click a left item, then click its matching right item

Items

Storage Containerization
Remote Wipe
Geofencing
Firmware Hardening

Matches

Show answer & explanation

Answer

Storage Containerization matches isolating enterprise data on BYOD endpoints; Remote Wipe matches sending an over-the-air command to sanitize data on lost or stolen endpoints; Geofencing matches enforcing access policies based on physical GPS coordinates; Firmware Hardening matches disabling unneeded services and changing default credentials on IoT sensors.
Each security control targets a specific domain requirement: Storage Containerization segregates enterprise apps on personal endpoints; Remote Wipe remotely erases storage upon endpoint loss; Geofencing triggers location-based security policies; and Firmware Hardening reduces the attack surface on embedded IoT hardware.

Step-by-Step Solution

1
Identify the purpose of Storage Containerization.
Selected the option describing logical isolation of business assets from personal data on BYOD endpoints.
Containerization creates a distinct partition on personal mobile devices so corporate data can be secured independently.
2
Identify the purpose of Remote Wipe.
Selected the option describing an over-the-air data sanitization command for lost or stolen hardware.
Remote wipe protects data confidentiality when physical control of an endpoint is compromised.
3
Identify the purpose of Geofencing.
Selected the option describing policy enforcement based on physical location/GPS boundaries.
Geofencing establishes virtual geographic perimeters to dynamically grant or restrict system functions.
4
Identify the purpose of Firmware Hardening.
Selected the option describing service minimization and credential updates on IoT hardware.
Hardening embedded systems mitigates risks associated with unpatched software and factory default settings.

Key Concept

Mobile and Embedded Security Controls
Question 2525Question →

A technician is troubleshooting a Windows 10 computer that experiences a Stop error during startup immediately after a third-party device driver update. The technician needs to start Windows using a minimal set of core drivers and services to safely roll back the problematic driver. Which option in the Windows Recovery Environment (WinRE) Advanced Options menu should the technician select to reach Safe Mode?

Show answer & explanation

Answer: Startup Settings

Answer

Startup Settings
Selecting Startup Settings from the WinRE Advanced Options screen restarts the computer and presents a menu of boot configurations, allowing the technician to select Safe Mode to troubleshoot and remove the faulty driver.

Step-by-Step Solution

1
Identify the troubleshooting requirement
The system requires booting into Safe Mode to prevent loading the faulty driver that causes the Stop error.
Safe Mode loads only essential Windows drivers and services, bypassing third-party drivers.
2
Select the appropriate WinRE tool
Choose Startup Settings under the WinRE Advanced options.
Startup Settings reboots the system to present boot option menus, including Safe Mode and Disable Driver Signature Enforcement.

Key Concept

Windows Recovery Environment (WinRE) Startup Settings
Estimated Time:45s
Question 2526Question →

A cloud administrator is preparing to migrate an enterprise on-premises file server to a cloud-based storage infrastructure. To ensure minimal disruption to business operations and adhere to organizational policy, the administrator must follow formal change management procedures. In what sequence should the administrator execute the following steps of the change management workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with defining the purpose and scope, followed by conducting a risk assessment, creating implementation and rollback plans, obtaining CAB approval, and finally executing the change with post-implementation testing and documentation.
Standard CompTIA A+ change management workflow requires establishing scope/purpose first, evaluating risk second, building implementation/rollback plans third, securing CAB authorization fourth, and completing execution, post-testing, and documentation fifth.

Step-by-Step Solution

1
Define purpose and scope of the proposed change.
Establishes clear boundaries and technical requirements for the migration.
A documented scope is necessary to understand what is being changed and why.
2
Conduct a risk analysis.
Identifies risk levels, potential disruptions, and affected business units.
Evaluating risk helps determine the necessary safety precautions and rollback requirements.
3
Formulate implementation procedures and a rollback plan.
Produces the technical instructions and backout steps if deployment fails.
Change management guidelines require a complete rollback plan before seeking management approval.
4
Request authorization from the Change Advisory Board (CAB).
Obtains formal business and technical approval to proceed.
The CAB must review all risk analyses and backout strategies to approve the scheduled maintenance window.
5
Execute the change, test functionality, and update documentation.
Completes the migration, verifies normal operation, and updates system records.
Deployment occurs only after approval; post-testing ensures operational stability and complete configuration management tracking.

Key Concept

CompTIA Change Management Lifecycle
Question 2527Question →

A network administrator is deploying a high-security enterprise wireless network. To comply with corporate security policy, the authentication method must enforce mutual authentication by requiring and validating digital certificates on both the central RADIUS server and each connecting client device. Which of the following Extensible Authentication Protocol (EAP) framework types should the administrator configure?

Show answer & explanation

Answer: EAP-TLS

Answer

EAP-TLS (Extensible Authentication Protocol-Transport Layer Security)
EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) is an 802.1X authentication protocol that mandates digital certificates on both the RADIUS authentication server and the endpoint client device, fulfilling the requirement for mutual certificate-based authentication.

Step-by-Step Solution

1
Identify the authentication requirements stated in the scenario.
The enterprise policy demands mutual authentication using digital certificates on both the RADIUS server and the client device.
Different EAP protocols specify distinct certificate requirements for server and client endpoints.
2
Evaluate EAP standards against certificate requirements.
EAP-TLS is the standard EAP implementation that mandates X.509 digital certificates on both the server and client sides.
Protocols like PEAP and EAP-TTLS only mandate a server certificate and rely on passwords or inner tunnels for client authentication.

Key Concept

EAP-TLS requires client and server digital certificates for mutual authentication in 802.1X wireless enterprise networks.
Estimated Time:1m 0s
Question 2528Question →

A desktop technician observes multiple unexpected pop-up windows and heavy CPU utilization on a user's computer. After identifying the presence of malware, which of the following actions should the technician take prior to initiating the anti-malware scanning process? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Disconnect the computer from the local network; Disable System Restore in Windows

Answer

The technician should disconnect the computer from the local network to isolate it and disable System Restore in Windows before running anti-malware scans.
According to the CompTIA 7-step malware removal procedure, after identifying malware (Step 1), the technician must isolate the infected system (Step 2) and disable System Restore (Step 3) before updating anti-malware tools and scanning (Step 4). Disconnecting the network cable isolates the host, while disabling System Restore prevents infected files from being saved into system snapshots.

Step-by-Step Solution

1
Identify malware symptoms on the system.
Malware presence is identified based on pop-ups and high CPU usage.
Establishes that the system requires remediation under the 7-step removal process.
2
Isolate the infected system by disconnecting network cables and turning off Wi-Fi.
Network communication is completely severed.
Prevents lateral movement of malware to other network resources and stops command-and-control communication.
3
Disable System Restore in Windows.
System restore point creation is suspended and previous infected restore points are removed.
Prevents malicious code from being preserved in Windows restore points during scanning and remediation.

Key Concept

CompTIA 7-Step Malware Removal Procedure (System Isolation and Restore Management)
Question 2529Question →

A user reports that whenever Microsoft Edge is opened, the home page automatically redirects to an unfamiliar search engine, and unauthorized advertisement tabs open periodically. A desktop technician verifies that system host files and local network configurations are normal. Which of the following actions should the technician take to resolve this browser security issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Remove unauthorized or unrecognized browser extensions.; Reset the web browser to its default startup and search engine configurations.

Answer

The technician should remove unauthorized browser extensions and reset the browser to its default startup and search engine configurations.
Removing unauthorized browser extensions and resetting the browser settings targets the active mechanisms used by browser hijackers. Rogue extensions often force redirects and generate pop-ups, while resetting preferences returns the search engine and startup pages to a known safe state.

Step-by-Step Solution

1
Audit browser add-ons
Identify and remove malicious or unapproved extensions.
Extensions often possess permissions to alter browser search settings and launch background pop-up windows.
2
Restore default browser preferences
Reset search engine defaults, home page URLs, and startup tab configurations.
Browser hijackers persist by overwriting default search providers and startup behaviors.

Key Concept

Browser Hijacker Remediation
Question 2530Question →

A desktop computer shuts down unexpectedly after running heavy processor workload applications for several minutes. A technician suspects the CPU is overheating due to degraded thermal compound. In what order should the technician perform the following steps to properly service the CPU thermal interface and verify the resolution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Disconnect power and remove heatsink -> Clean off old thermal compound -> Apply small dot of new thermal paste -> Reinstall heatsink, connect fan, and verify temperatures in BIOS/UEFI.
The correct diagnostic and repair sequence begins with safely isolating power and removing the heatsink. Next, old compound is cleaned off with isopropyl alcohol so fresh thermal paste can be applied to a clean metal surface. Finally, the heatsink is remounted securely, the fan power cable is reconnected, and temperature levels are monitored in the BIOS/UEFI setup utility.

Step-by-Step Solution

1
Disconnect workstation power and remove the CPU cooling heatsink assembly.
The CPU heat spreader surface and heatsink contact plate are exposed.
Ensures physical safety and permits direct access to the thermal interface.
2
Clean dried thermal compound using high-percentage isopropyl alcohol and a lint-free cloth.
Both contact surfaces are clean and free of old debris.
Old, dried thermal paste acts as an insulator rather than a conductor, preventing effective heat dissipation.
3
Dispense a small, pea-sized dot of fresh thermal paste onto the center of the CPU heat spreader.
Thermal paste is positioned to spread evenly under pressure.
Provides optimal thermal conductivity without overflowing onto motherboard components.
4
Reattach the heatsink evenly, plug in the CPU_FAN header, power on the system, and check CPU temperature hardware monitors in BIOS/UEFI.
The cooling fan receives power and processor operating temperatures are confirmed within normal ranges.
Validates that the cooling system is fully functional and thermal throttling/overheating is resolved.

Key Concept

CPU Cooling Maintenance and Thermal Interface Servicing
Estimated Time:1m 0s
Question 2531Question →

A technician is assisting a macOS user who wants to view all currently open application windows simultaneously and create separate virtual desktop workspaces to organize ongoing tasks. Which native macOS feature should the technician instruct the user to use?

Show answer & explanation

Answer: Mission Control

Answer

Mission Control is the native macOS tool that displays all open windows and allows the creation of virtual desktops (Spaces).
Mission Control allows users to view all open windows, desktop spaces, and full-screen applications in a single view, enabling quick organization and creation of virtual desktops (Spaces).

Step-by-Step Solution

1
Identify the user's operational requirements
The user needs to view all currently open windows simultaneously and organize tasks across virtual desktops.
Understanding the required OS workflow helps isolate the built-in feature designed for window and workspace management.
2
Evaluate native macOS utilities against the functional requirement
Mission Control offers full window overview and manages desktop Spaces.
Mission Control is specifically architected to provide bird's-eye views of open windows and support multi-desktop navigation.

Key Concept

macOS System Utilities & Navigation Features
Question 2532Question →

A remote worker reports that their workstation has developed unusual file associations and unauthorized system settings modifications. A technician confirms a malware infection and immediately disconnects the device from the network to isolate it. According to the CompTIA standard malware removal procedures, which action should the technician perform NEXT?

Show answer & explanation

Answer: Disable System Restore in the operating system

Answer

Disable System Restore in the operating system
Disabling System Restore is Step 3 of the CompTIA 7-step malware removal procedure. Once an infected system is isolated (Step 2), System Restore must be turned off to clear existing restore points and prevent infected files from being backed up during cleanup.

Step-by-Step Solution

1
Identify the current step in the CompTIA 7-step malware removal procedure
The technician has completed Step 1 (Identify symptoms) and Step 2 (Isolate infected system).
The scenario states that the malware was verified and the laptop was disconnected from all network interfaces.
2
Determine the next sequential step in the process
Step 3 is to disable System Restore in Windows.
System Restore must be disabled before remediation to prevent malware scripts from creating or embedding within saved restore points.

Key Concept

CompTIA 7-Step Malware Removal Procedure Order
Estimated Time:1m 0s
Question 2533Question →

A tier-2 helpdesk technician is auditing cross-platform system maintenance scripts used across Windows and Linux endpoints. The technician needs to verify the syntax rules for variable declaration and environment variable usage in these scripts. Which of the following statements correctly describe variable handling in PowerShell (.ps1) and Bash shell (.sh) scripts? (Select TWO).

Select all that apply

Show answer & explanation

Answer: PowerShell scripts require a dollar sign prefix ()whendefininguservariablesandaccessingenvironmentvariables.;Bashshellscriptsassignvaluestovariableswithoutaleadingsymbol,butrequireadollarsign() when defining user variables and accessing environment variables.; Bash shell scripts assign values to variables without a leading symbol, but require a dollar sign () prefix to reference their contents.

Answer

PowerShell scripts use a dollar sign prefix ()fordefiningvariablesandaccessingenvironmentvariables,andBashshellscriptsassignvariablevalueswithoutaleadingsymbolwhilerequiringadollarsign() for defining variables and accessing environment variables, and Bash shell scripts assign variable values without a leading symbol while requiring a dollar sign () to evaluate or reference them.
PowerShell requires a dollar sign ()prefixforvariableinstantiationandenvironmentvariableaccess(suchas) prefix for variable instantiation and environment variable access (such as env:Path). In contrast, Bash shell scripts assign values to variables without a prefix (e.g., VAR=value) and require the dollar sign ()onlywhenreferencingthevariable′svalue(e.g.,echo) only when referencing the variable's value (e.g., echo VAR).

Step-by-Step Solution

1
Analyze PowerShell (.ps1) variable syntax rules
Confirm that PowerShell uses the dollar sign ()symbolforvariableinstantiationand) symbol for variable instantiation and env: for environment variable access.
PowerShell consistent syntax relies on the dollar sign ($) for variable scope and access.
2
Analyze Bash shell (.sh) variable syntax rules
Confirm that Bash assigns variables using key=value without a dollar sign ()ontheleftside,butrequiresadollarsign() on the left side, but requires a dollar sign () to read the value.
Adding a dollar sign ($) during Bash variable assignment causes a syntax error.
3
Evaluate distractor statements regarding batch (.bat) syntax
Identify that enclosing variables with percent signs (%VAR%) belongs to Windows Batch scripting, not PowerShell.
PowerShell does not use percent signs for environment variable expansion.

Key Concept

Variable Declaration and Syntax Rules in Scripting Languages
Estimated Time:1m 30s
Question 2534Question →

A desktop support technician is writing a Windows Batch script (`.bat`) to automate system profile configuration during user logon. The script must reference the currently logged-in user's account name dynamically from the system environment. Which of the following syntaxes correctly formats an environment variable within a Windows Batch script?

Show answer & explanation

Answer: %USERNAME%

Answer

Enclosing the variable name between percent signs (%USERNAME%) is the correct construct for environment variables in Windows Batch scripts.
In Windows Batch (`.bat`) scripting, environment variables are referenced by surrounding the variable name with percent signs, such as %USERNAME%. When the batch file executes, the Command Prompt interpreter replaces the expression with the actual environment variable value.

Step-by-Step Solution

1
Identify the target scripting language and objective from the scenario.
The target language is Windows Batch (`.bat`) and the goal is to reference a system environment variable.
Different scripting environments utilize specific syntax rules for variable declaration and retrieval.
2
Evaluate the syntax rule for environment variables in Windows Command Prompt / Batch.
Windows Batch environment variables are delimited using percent signs surrounding the variable name (e.g., %VARIABLE_NAME%).
The command processor recognizes percent signs as delimiters to replace the variable placeholder with its runtime value.

Key Concept

Windows Batch Environment Variable Syntax
Estimated Time:1m 0s
Question 2535Question →

A network technician deploys a new wireless access point configured to operate exclusively in WPA3-Personal mode. While modern company laptops connect successfully, several older Wi-Fi 4 (802.11n) handheld inventory scanners are unable to associate with the wireless network. The technician must allow these legacy handheld scanners to connect without forcing the modern laptops to downgrade their security protocol. Which of the following configuration changes should the technician make on the access point?

Show answer & explanation

Answer: Enable WPA2/WPA3 transition mode on the wireless access point.

Answer

Enabling WPA2/WPA3 transition mode allows legacy WPA2 devices to connect using PSK while allowing supported modern devices to connect via WPA3 (SAE).
Enabling WPA2/WPA3 transition mode provides backward compatibility. It allows legacy clients that only support WPA2-PSK (AES) to connect to the SSID while allowing newer clients to authenticate using WPA3-Personal (SAE) with mandatory Protected Management Frames.

Step-by-Step Solution

1
Analyze the connectivity issue.
Modern devices connect via WPA3-Personal, but legacy Wi-Fi 4 devices fail because they lack WPA3/SAE hardware or firmware support.
WPA3-Only mode strictly requires client support for SAE and mandatory Protected Management Frames (PMF).
2
Evaluate compatibility options that maintain security for modern clients.
WPA2/WPA3 Mixed or Transition Mode enables dual-SSID broadcasting capabilities under a single SSID, supporting WPA3-SAE for capable clients and falling back to WPA2-PSK for legacy devices.
This satisfies the requirement to support legacy scanners without forcing modern devices down to WPA2-only.

Key Concept

WPA3 Mixed/Transition Mode vs WPA3-Only Mode and Backward Compatibility
Question 2536Question →

A systems administrator at a financial services firm is troubleshooting a workstation infected with a spyware Trojan. The administrator has already identified the malware symptoms and successfully isolated the system from the local network. Which TWO of the following steps should the administrator perform next before initiating scans and removing the infection? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable Windows System Restore; Update anti-malware signature definition files

Answer

The administrator should disable Windows System Restore and update anti-malware signature definition files.
Following quarantine, the technician must disable System Restore to ensure that infected system files are not backed up or preserved in system restore points. Immediately after, updating anti-malware signatures ensures that the security engine possesses the newest threat definitions before running full remediation scans.

Step-by-Step Solution

1
Review current progress within the CompTIA 7-step malware remediation framework
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
Evaluating current status identifies which sequential actions must be taken prior to remediation.
2
Determine the mandatory actions prior to active system scanning and cleaning
Step 3 requires disabling System Restore, and Step 4a requires updating anti-malware software/signatures.
Disabling restore points prevents infected files from being saved in system restore archives, while updated signatures ensure accurate threat detection.

Key Concept

CompTIA 7-Step Malware Remediation Process
Question 2537Question →

A Windows workstation running an enterprise database client frequently becomes unresponsive ('Not Responding') during high-volume queries. A CompTIA A+ technician must isolate the process hang in real-time, preserve system diagnostics prior to process termination, and correlate the event with historical system stability data. Place the administrative troubleshooting steps in the correct chronological order from initial real-time isolation to historical root-cause analysis.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with using Analyze Wait Chain in Task Manager to isolate thread dependencies, followed by creating a memory dump file while the process is still active. Next, the technician terminates the blocking process to recover system responsiveness. Finally, the technician inspects Event Viewer (Event ID 1002) for module error details and reviews Reliability Monitor (perfmon /rel) to correlate the hang with historical software changes.
The proper sequence follows standard Windows performance troubleshooting methodology: real-time diagnosis (Analyze Wait Chain), diagnostic state preservation (Create Memory Dump), symptom remediation (Ending the Blocking Process), log-level examination (Event Viewer Event ID 1002), and long-term trend correlation (Reliability Monitor). Creating a memory dump must always occur before terminating the process, as process termination purges the target memory space.

Step-by-Step Solution

1
Use Task Manager's Analyze Wait Chain feature on the hung application process.
Identifies whether the application is waiting on another process ID (PID) or thread to release a shared system resource.
Troubleshooting must start with real-time thread inspection to determine the immediate cause of the freeze.
2
Select 'Create memory dump file' from the process context menu in Task Manager.
Generates a .dmp file capturing the active volatile memory footprint of the hung application.
Process dump files must be created prior to terminating the process, as ending the process purges its active memory space.
3
Terminate the identified blocking PID or force-close the hung process.
Releases the resource lock and restores user responsiveness on the workstation.
Clearing the deadlock is necessary to recover workstation usability after diagnostic memory state has been saved.
4
Check Event Viewer under Windows Logs > Application for Event ID 1002.
Reveals logged specifics regarding the hung process, faulting module, and crash timestamps.
Post-remediation log analysis captures binary-level details recorded by the OS during the application hang.
5
Open Reliability Monitor using perfmon /rel.
Displays a chronological graph of application failures, hardware faults, and recent software installations.
Macro-level historical evaluation determines whether the hang is part of a broader pattern triggered by recent patches or updates.

Key Concept

Windows Application Crash & Hang Isolation Workflow
Estimated Time:2m 30s
Question 2538Question →

A technician is troubleshooting a UEFI-based Windows 11 computer that fails to boot, displaying a boot configuration error. After booting into the Windows Recovery Environment (WinRE) Command Prompt, the technician decides to manually recreate the corrupted EFI System Partition (ESP) structure and Boot Configuration Data (BCD). In what correct sequence should the technician execute the following repair steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for repairing the EFI boot environment in WinRE is: 1) Run diskpart to locate the hidden EFI System Partition volume number; 2) Assign a temporary drive letter to the EFI System Partition and exit diskpart; 3) Navigate to the EFI boot directory and execute attrib -h -r -s BCD to remove system attributes from the BCD file; 4) Rename the existing BCD file to BCD.old to preserve a backup; 5) Execute bcdboot C:\Windows /s Z: /f ALL to recreate the boot environment files.
To repair a corrupted UEFI boot setup, the hidden EFI System Partition must first be located and assigned a volume drive letter using diskpart. Once accessible, file protections on the existing BCD must be cleared with attrib so it can be renamed as a backup. Finally, bcdboot is executed targeting the assigned drive letter to write clean boot files and rebuild the BCD.

Step-by-Step Solution

1
Open Diskpart utility to inspect disk partitions and volumes.
The hidden FAT32 system partition (ESP) volume index is identified.
You cannot access or target the ESP drive until its volume number is found.
2
Select the ESP volume and assign a drive letter (e.g., Z:), then exit Diskpart.
The ESP volume becomes accessible via the Z: drive path.
Command-line tools like attrib and ren require an accessible drive letter path.
3
Change directory to Z:\EFI\Microsoft\Boot\ and run attrib -h -r -s BCD.
The file attributes locking the BCD store are cleared.
System files cannot be modified or renamed while marked as read-only, hidden, or system files.
4
Rename the BCD file using ren BCD BCD.old.
The corrupted BCD file is renamed and no longer active.
Renaming the file prevents collision errors when generating fresh BCD files.
5
Run bcdboot C:\Windows /s Z: /f ALL.
Fresh EFI system files and a new BCD store are written to the ESP partition.
bcdboot copies system boot files from the Windows directory to the target boot partition.

Key Concept

UEFI EFI System Partition (ESP) and BCD manual repair procedure using WinRE Command Line Tools
Estimated Time:2m 0s
Question 2539Question →

An IT support technician is hardening security on a company workstation running Windows 11 Pro. To mitigate the risk of ransomware, the technician needs to configure a setting that prevents untrusted applications from modifying files stored in standard user folders such as Documents, Pictures, and Desktop. Which feature within the Windows Security app should the technician enable to fulfill this requirement?

Show answer & explanation

Answer: Controlled folder access

Answer

Controlled folder access is the Windows Security feature designed to block unauthorized or untrusted applications from modifying files in protected user directories.
Controlled folder access is a feature within Windows Security under Virus & threat protection designed to protect key folders (Documents, Pictures, Desktop, etc.) from unauthorized modifications by untrusted software, effectively mitigating ransomware threats.

Step-by-Step Solution

1
Identify the primary administrative security requirement.
The requirement is to prevent unauthorized applications (such as ransomware) from modifying or encrypting files in user data folders.
Ransomware targets user directories to encrypt personal files and demand payment for recovery.
2
Evaluate Windows Security app features against the security requirement.
Controlled folder access in Windows Security explicitly protects specified user directories by allowing only whitelisted or trusted applications to make file changes.
It acts as a directory-level shield against unauthorized modifications.

Key Concept

Windows Security Ransomware Protection Settings
Estimated Time:1m 0s
Question 2540Question →

A security administrator is deploying mobile tablets to field service technicians who collect sensitive customer account details. The organization allows technicians to use these corporate-enrolled tablets for personal tasks during off-hours. To comply with data privacy regulations, corporate data must be completely encrypted and isolated from personal applications, and administrators must be able to remove company records if a device is lost without destroying personal photos or files. Which of the following mobile security controls should the administrator implement to meet both requirements?

Show answer & explanation

Answer: Containerization with selective wipe functionality

Answer

Containerization with selective wipe functionality is the correct control because it logically separates corporate applications and confidential records from personal data on mobile devices, allowing administrators to remove enterprise storage without affecting personal user content.
Containerization establishes a secure, encrypted logical partition for enterprise applications and corporate customer data on mobile devices. Paired with selective wipe management through Mobile Device Management (MDM) or Mobile Application Management (MAM) solutions, IT administrators can remotely sanitize corporate records upon device loss while leaving personal photos, apps, and files intact.

Step-by-Step Solution

1
Analyze the technical requirements of the scenario.
Identified two primary requirements: isolation of corporate data from personal applications, and the ability to wipe corporate files without erasing personal user data.
Security controls on mobile devices must balance enterprise protection with user privacy in mixed-use scenarios.
2
Evaluate storage separation technologies.
Containerization (storage segmentation) creates a secure, encrypted sandbox for corporate apps and data on the mobile OS.
Logical boundary enforcement prevents unapproved personal applications from accessing sensitive company records.
3
Match the remote management capability to the required wipe policy.
Selective wipe targets only the enterprise container, fulfilling the remote removal requirement while preserving personal photos and personal application data.
Full device wipes destroy all storage partitions indiscriminately, failing the privacy requirement.

Key Concept

Mobile Device Containerization and Selective Wipe
PreviousPage 127 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin