Examkin

All practice questions

423 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 241Question →

An IT operations manager is preparing to transition an enterprise on-premises VoIP PBX infrastructure to a hosted cloud communications solution. To comply with standard CompTIA A+ change management procedures, arrange the following operational phases in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for the change management lifecycle is: 1) Define purpose/scope and conduct risk analysis, 2) Formulate the plan for change and documented rollback plan, 3) Submit the change request to the Change Advisory Board (CAB) for authorization, 4) Issue end-user notifications detailing the maintenance window, and 5) Perform the migration and complete post-implementation testing.
The standard CompTIA change management workflow mandates that an IT professional first define the scope and conduct a risk analysis. Next, detailed implementation and rollback plans must be authored. Only after these plans are finalized is the proposal submitted to the Change Advisory Board (CAB) for approval. Once authorized, end users are notified of the maintenance window. Finally, the migration is executed and post-implementation testing verifies system stability.

Step-by-Step Solution

1
Identify the initial assessment phase
Defining the purpose, scope, and potential risk analysis forms the foundational baseline of any formal change request.
Without establishing scope and risk, technical plans cannot be appropriately constructed.
2
Identify the plan development phase
Creating the plan for change and the mandatory rollback plan.
CAB approval requires complete technical and recovery plans prior to submission.
3
Identify the governance and approval phase
Submitting the complete proposal to the Change Advisory Board (CAB).
Changes cannot be scheduled or communicated as approved until stakeholders and the CAB authorize the proposal.
4
Identify the pre-implementation communication phase
Notifying affected end users and business units about the scheduled maintenance window.
End users must be given advance warning of planned service disruptions.
5
Identify the execution and verification phase
Deploying the VoIP migration and executing post-implementation testing to confirm success.
The final step validates system functionality before closing the change ticket.

Key Concept

CompTIA A+ Change Management Lifecycle
Estimated Time:2m 0s
Question 242Question →

A technician is writing a basic administrative script to automate system log compression when disk space is low. In what sequential order should the logical components of this conditional script be structured?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical sequence is: 1) Initialize environmental variables to define the log directory path and threshold limit, 2) Evaluate the conditional statement checking if available disk space is below the defined threshold, 3) Execute the compression command on the target log files inside the conditional block, and 4) Close the conditional construct and output a completion status message.
The correct order follows standard script execution logic: setting environment parameters first, testing the condition, executing the conditional action block, and cleanly closing the construct with status output.

Step-by-Step Solution

1
Identify variable declaration requirements.
Path and threshold variables are defined at the top of the script.
Scripts process data sequentially from top to bottom; variables must exist before being referenced.
2
Place the conditional evaluation block.
Disk space condition check is evaluated.
Control constructs rely on evaluating a boolean condition prior to executing contained code.
3
Nest the execution payload.
Log compression executes if the evaluated condition is true.
The core action belongs within the body of the conditional block.
4
Finalize construct and exit.
The block is terminated and a message is emitted.
Proper syntax requires terminating conditional structures (such as fi in Bash or closing braces in PowerShell) to finish execution cleanly.

Key Concept

Basic Scripting Control Constructs and Execution Order
Question 243Question →

An incident responder is dispatched to preserve digital evidence from a powered-on server suspected of exfiltrating sensitive corporate files to an unauthorized remote address. To ensure forensic integrity and prevent critical evidence from being overwritten, the responder must acquire evidence following standard order of volatility guidelines. In what sequence should the responder capture the following data components, starting from the most volatile data to the least volatile data?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU cache and registers, followed by System RAM and process state, then temporary swap/page files, non-volatile disk storage, and finally archived backup media and physical logs.
In computer forensics, the Order of Volatility dictates collecting evidence based on how quickly data can be lost. CPU cache and registers fluctuate at processor speeds (nanoseconds) and must be captured first. Main memory (RAM) and network state hold live session data lost at shutdown. Swap/page files hold secondary memory data on disk. Fixed magnetic or solid-state drive storage retains data persistently, and offline archival media/logs remain intact indefinitely without power.

Step-by-Step Solution

1
Identify the order of volatility framework (RFC 3227 standards used in forensic acquisition).
Recognize that data disappearing fastest under power state changes or process cycles must be captured first.
Capturing data in reverse order would destroy highly ephemeral data like CPU state and RAM contents.
2
Place CPU registers and cache at the top of the sequence.
CPU cache and registers are established as position 1.
Registers change constantly at CPU clock speed cycles (nanoseconds).
3
Order main system memory (RAM), ARP/routing tables, and running process structures next.
System RAM and network connection tables are established as position 2.
RAM contents are lost immediately upon system shutdown or reboot.
4
Sequence virtual memory/page files and temporary storage above persistent block storage.
Swap/page files and temporary disk caches are established as position 3.
Virtual memory relies on local drive space but is dynamically modified by the OS during active operations.
5
Place non-volatile hard drive partitions and offline archives at the end of the acquisition process.
Disk images are position 4, and offline backup media/paper logs are position 5.
Persistent magnetic/flash media and offline backups retain state without power, making them the least volatile assets.

Key Concept

Order of Volatility in Forensic Data Acquisition
Question 244Question →

An IT support technician is dispatched on-site to troubleshoot a workstation issue for a user who experienced an unexpected application crash. What is the correct sequence of professional communication and customer interaction steps the technician should execute from start to finish?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with greeting the user and actively listening, followed by asking clarifying questions and setting expectations, obtaining consent and respecting privacy during service, and concluding with verifying the resolution, documenting the ticket, and following up.
The proper sequence follows the established customer communication lifecycle: establishing rapport via greeting and active listening, asking clarifying questions to set expectations, acquiring permission and ensuring privacy during troubleshooting, and closing with solution verification, documentation, and follow-up.

Step-by-Step Solution

1
Greet the user and listen actively.
Establishes professional rapport and captures the user's description of the problem.
CompTIA standards state that technicians should introduce themselves, maintain a professional tone, and avoid interrupting the user during the initial explanation.
2
Clarify details and set expectations.
Gathers precise technical context while preparing the customer for the troubleshooting workflow.
Asking open-ended clarifying questions and expressing empathy builds trust and establishes realistic completion timelines.
3
Request consent and respect customer privacy.
Protects sensitive data and physical property before executing changes.
Technicians must request consent before rebooting or altering system settings and avoid viewing confidential physical or digital property.
4
Verify functionality, document, and follow up.
Ensures problem resolution and completes ticket administrative requirements.
Demonstrating the working fix to the user, logging complete ticket notes, and scheduling a follow-up ensure long-term satisfaction.

Key Concept

Professional Customer Interaction Workflow
Question 245Question →

An IT technician is preparing to update software on corporate workstations following organizational policy. In what order should the technician execute the stages of the standard change management process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper chronological sequence of the change management lifecycle is: 1) Define the purpose and scope of the proposed change, 2) Perform a risk analysis and draft a comprehensive rollback plan, 3) Submit the change request to the Change Advisory Board (CAB) for authorization, 4) Notify affected end users of the scheduled maintenance window, and 5) Implement the change and execute post-implementation testing.
The standard CompTIA change management workflow dictates defining purpose and scope first, followed by performing risk analysis and preparing a rollback plan. Next, formal authorization must be granted by the Change Advisory Board (CAB). Once authorized, end users are notified, and lastly, the change is implemented and verified through post-implementation testing.

Step-by-Step Solution

1
Identify parameters of the change
The purpose and scope are clearly defined.
Understanding what is being changed and why is necessary before evaluating potential impacts.
2
Evaluate impact and plan for recovery
Risks are documented and a rollback strategy is created.
Board review requires knowing potential risks and having a strategy to revert if deployment fails.
3
Seek governance approval
The Change Advisory Board (CAB) reviews and approves the request.
Changes to production systems require authorization to ensure alignment with business needs and security.
4
Inform stakeholders
Users are alerted to potential service disruption and timeframes.
Timely notifications allow business units to prepare for planned outages.
5
Deploy and validate
The change is applied and confirmed functional via testing.
Post-implementation testing verifies that the change achieved its goal without breaking services.

Key Concept

Standard Change Management Lifecycle
Question 246Question →

A support technician is processing a service desk request from an employee who cannot access a corporate application following a recent security update. Place the steps of the ticketing system workflow in the correct sequential order from initial receipt to ticket completion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the ticketing workflow is: 1) Log the incident with user and asset details, 2) Categorize the ticket and assign priority level, 3) Perform diagnostic testing to identify the root cause, 4) Apply the fix and record resolution notes, and 5) Confirm functionality with the user and close the ticket.
The standard CompTIA/ITIL incident ticketing lifecycle follows five sequential phases: Logging -> Categorization/Prioritization -> Investigation/Diagnosis -> Resolution/Documentation -> Verification/Closure. Initial logging records baseline details, triage assigns urgency and category, investigation pinpoint the root cause, technical resolution fixes the issue alongside documentation, and user verification ensures satisfaction prior to ticket closure.

Step-by-Step Solution

1
Record initial incident information
Ticket is created with user and system baseline data.
Establishes a tracking record in the ticketing system.
2
Triage by categorizing and prioritizing
Ticket is classified with impact/urgency rating and routed appropriately.
Determines handling priority and SLA compliance timelines.
3
Investigate and diagnose the root cause
Technician isolates the exact cause of the failure through testing.
Required before attempting targeted technical resolution.
4
Implement solution and document resolution notes
The issue is fixed and technical remediation steps are documented for future reference.
Ensures knowledge management updates and technical completion.
5
Verify with user and close ticket
User confirms resolution and ticket state moves to closed.
Prevents premature ticket closure without end-user satisfaction verification.

Key Concept

Ticketing System Lifecycle and Incident Management Workflow
Question 247Question →

A technician is preparing a workstation to replace an internal expansion card while adhering to proper electrostatic discharge (ESD) safety controls. Place the operational steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with disconnecting all power and cabling from the computer, followed by positioning and grounding the anti-static mat, then putting on and attaching the anti-static wrist strap to the grounded mat, and finally opening the computer case to replace the card.
Establishing proper ESD safety procedures requires isolating power sources first, preparing and grounding the anti-static work mat second, securing personal ESD wrist grounding third, and performing internal hardware manipulation last.

Step-by-Step Solution

1
Disconnect external power sources and cables
Electrical safety is ensured by eliminating shock potential before manipulating hardware.
Shutting off and unplugging power is the baseline safety requirement before introducing anti-static tools or opening the chassis.
2
Set up and ground the anti-static mat
An ESD-safe surface area is established for laying down components.
The mat must be bonded to earth ground so static charges bleed off safely before components touch it.
3
Equip and connect the anti-static wrist strap
The technician's body potential is equalized with the ESD mat ground.
Personal grounding prevents static accumulation on the technician's body from transferring to ESD-sensitive components.
4
Open chassis and handle internal components
Internal hardware can be safely serviced without ESD risk.
Component manipulation must only occur after ESD protection controls are fully active.

Key Concept

Proper sequencing of ESD protection controls during hardware maintenance
Estimated Time:1m 0s
Question 248Question →

A corporate IT technician discovers an active network intrusion on an administrative workstation where unauthorized data exfiltration is currently taking place. In what sequence should the technician perform the incident response, evidence preservation, and chain of custody procedures from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with reporting the incident, followed by isolating the host from the network, capturing volatile RAM memory, imaging the hard drive with a hardware write blocker, and finally completing the chain of custody log prior to securing physical evidence.
The correct sequence follows standard CompTIA incident response guidelines and forensic best practices. First, the technician reports the breach to initiate official escalation. Next, the network connection is severed to contain exfiltration without altering live state. Volatile memory (RAM) is captured next in accordance with the order of volatility. The system is then powered down to image non-volatile storage using a write blocker. Finally, the evidence is logged on a chain of custody form and stored securely.

Step-by-Step Solution

1
Report the security breach and document initial observations according to escalation protocols.
Establishes formal incident management tracking and authorizes containment actions.
Proper reporting ensures security management is aware of the threat before technical steps begin.
2
Isolate the compromised system by disconnecting network connectivity.
Halts active exfiltration without altering memory contents or shutting down system processes.
Containment is the immediate technical priority to prevent further unauthorized data transfer.
3
Acquire volatile memory (RAM) and active system state.
Preserves transient forensic evidence that will be wiped if the system reboots or powers off.
Adheres to the order of volatility (RAM is more volatile than fixed mass storage).
4
Power off the machine and create a forensic image of non-volatile storage using a write blocker.
Generates a bit-stream copy of the drive for analysis without altering original evidence.
Non-volatile media is captured after RAM, and write blocking ensures evidence integrity.
5
Fill out the chain of custody log and store the drive in a tamper-evident container.
Establishes verifiable tracking of evidence custody, timestamps, and handling integrity.
Unbroken documentation is legally required to prove evidence has not been tampered with.

Key Concept

Incident Response Workflow, Order of Volatility, and Chain of Custody Maintenance
Estimated Time:3m 0s
Question 249Question →

A system administrator is writing an automated administrative script to safely archive old system diagnostic logs from client workstations to prevent storage exhaustion. To ensure script safety and avoid runtime execution exceptions, place the following script construction steps into their proper logical execution sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical execution sequence is: First, declare and initialize script variables; second, evaluate a conditional branch to verify the target directory exists; third, instantiate a loop construct to iterate through the retrieved files; and fourth, perform a conditional comparison inside the loop body to execute the archive command.
In basic administrative scripting across Shell, PowerShell, or Python, programs follow a strict control flow sequence. Variables defining directory paths and numerical thresholds must be initialized first. Next, a conditional branch tests the environment to ensure target locations exist. Once verified, a loop construct iterates through the files, and specific file processing actions are executed inside the loop body based on sub-conditions.

Step-by-Step Solution

1
Initialize parameters and environment variables
Script storage locations and integer age limits are defined in memory.
Scripting constructs require variables to be populated before they are evaluated in conditional statements or loops.
2
Perform environment state checking via conditional branching
The target folder's presence is verified before proceeding.
Attempting to query or read a non-existent file path causes unhandled runtime failures in scripting environments.
3
Begin container iteration using a loop construct
The script accesses the array of log file objects one by one.
Iteration constructs allow repeating operational logic over collections of system objects.
4
Execute conditional comparison and file action inside loop body
Only log files exceeding the integer threshold are archived.
Actionable script commands must be scoped within the iteration body to evaluate each item individually.

Key Concept

Logical sequence of scripting constructs (variables, conditional branches, loops, and execution bodies)
Question 250Question →

A home healthcare nurse reports that a vital patient chart application on an iOS tablet regularly freezes and becomes unresponsive while recording patient data during visits. A mobile technician needs to resolve the performance issue using standard least-invasive-first troubleshooting procedure. In what sequence should the technician perform these actions, arranged from least invasive to most invasive?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The technician should troubleshoot mobile app issues from least invasive to most invasive: first force close the application, next soft reset the device, then offload or update/reinstall the application, and finally perform a factory reset of the device as a last resort.
CompTIA CompTIA A+ software troubleshooting methodology requires technicians to mitigate issues using the least invasive action first. Terminating the application process is non-destructive and instantaneous. If the issue persists, restarting the device clears memory. If application files are corrupted, reinstalling or updating the app resolves the problem. A factory reset wipes all data and settings, making it the final, most invasive troubleshooting step.

Step-by-Step Solution

1
Force quit the unresponsive application.
Clears transient memory state for the specific app with zero risk to data or system settings.
Always start with the minimal action focused specifically on the failing application process.
2
Reboot (soft reset) the mobile device.
Clears system RAM and resets OS services without deleting data.
If terminating the app process does not work, the underlying operating system resources must be refreshed.
3
Offload/reinstall or update the application.
Fixes broken code or corrupted installation files for the application.
Reinstalling targets application software integrity specifically before taking system-wide destructive measures.
4
Factory reset the device.
Restores the operating system to factory defaults and removes all local data and custom configurations.
Wiping the device is extremely disruptive and time-consuming, so it must only be used after all application-level and non-destructive steps fail.

Key Concept

Mobile OS Troubleshooting Methodology (Least Invasive First)
Question 251Question →

An IT technician accidentally spills a liquid cleaning solvent onto the floor in an equipment repair depot. Arrange the following steps in the correct order, from first to last, to safely manage and remediate the chemical spill according to safety standards and environmental controls.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for managing a chemical cleaning solvent spill is: First, consult the Safety Data Sheet (SDS) for hazard information and PPE requirements; second, don the appropriate PPE; third, apply absorbent material from the outer edges inward to contain the spill; fourth, collect and seal the contaminated material in a labeled hazardous waste container; fifth, dispose of the hazardous waste following environmental regulations.
The correct procedural order ensures safety at every stage: initial hazard assessment (consulting the SDS) must precede physical interaction; putting on PPE ensures technician safety prior to contact; diking the perimeter prevents spreading; sealing the material isolates vapors; and regulatory disposal fulfills environmental compliance mandates.

Step-by-Step Solution

1
Consult the chemical Safety Data Sheet (SDS).
Identify specific health risks, handling hazards, and required Personal Protective Equipment (PPE).
Approaching a chemical spill without knowing its toxicity or proper precautions exposes the technician to chemical burns, toxic fumes, or fire hazards.
2
Equip the specified PPE.
Ensure physical protection for eyes, skin, and respiratory system before approaching the chemical.
PPE must be worn before physical remediation begins to prevent accidental exposure.
3
Contain and absorb the spill from the perimeter inward.
Prevent the liquid from spreading across the floor or reaching environmental drains.
Diking the outer edge first minimizes the affected area before absorbing the central spill volume.
4
Collect and seal the contaminated absorbent media into a designated hazardous waste container.
Isolate the chemical hazard for safe transport.
Absorbed solvents still off-gas harmful vapors and present contact hazards until properly sealed.
5
Dispose of the waste container per SDS and local environmental regulations.
Complete environmentally compliant disposal.
Hazardous chemicals cannot be discarded in standard refuse bins or municipal water systems.

Key Concept

Chemical Spill Management and SDS Compliance
Question 252Question →

A technician receives an alert that a corporate-managed mobile device has been infected with a malicious application exhibiting unauthorized remote access and data exfiltration behavior. Place the following mobile incident response and remediation actions in the correct sequential order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps to remediate the compromised mobile device is: 1) Enable Airplane mode to isolate the mobile device from all networks, 2) Revoke administrative rights for the suspicious application and uninstall it, 3) Perform a full system scan using an enterprise-approved mobile security tool, 4) Revoke active session tokens and reset account passwords from an uncompromised workstation, and 5) Disable Airplane mode, re-establish network connectivity, and install the latest OS security updates.
CompTIA standard mobile security incident response dictates that containment (isolating the device from Wi-Fi/cellular networks) must occur first to stop data exfiltration. Next, eradication occurs by revoking privileges and removing the malicious app, followed by a full security scan to ensure no hidden payloads remain. Account credentials are then secured from an outside workstation, and finally, the device is reconnected and patched.

Step-by-Step Solution

1
Isolate the mobile device from all network connections
Cellular, Wi-Fi, and Bluetooth channels are cut off, halting data exfiltration.
Containment is the essential first phase of incident response to prevent further compromise.
2
Uninstall the malicious application and revoke its permissions
The core threat vector and unauthorized device administrative access are removed.
Eradicating the malicious software prevents ongoing unauthorized changes to system settings.
3
Execute a full antimalware scan on the mobile OS
Residual malicious files or secondary Trojan payloads are detected and quarantined.
Scanning verifies that the device environment is clean before credentials or network access are restored.
4
Reset compromised user credentials from a clean system
Stolen credentials or hijacked OAuth session tokens are invalidated.
Changing passwords on a separate, uncompromised system ensures new credentials are not captured by remaining keyloggers.
5
Reconnect to the network and apply missing OS security patches
The mobile device is fully patched, verified compliant, and restored to service.
Updating the OS addresses underlying security flaws to prevent re-infection.

Key Concept

Mobile Device Security Incident Containment and Remediation Workflow
Question 253Question →

A technician is servicing a Windows workstation that exhibits system instability and missing file errors. Diagnostic logs indicate that both protected operating system files and the local Windows component store (WinSxS) are corrupted. How should the technician sequence the remediation steps to resolve the corruption completely?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct repair sequence is: 1) Open an elevated Command Prompt, 2) Run DISM /scanhealth to verify component store corruption, 3) Run DISM /restorehealth to repair the component store image, 4) Execute SFC /scannow to repair protected operating system files, and 5) Restart the workstation.
Resolving system file corruption when the underlying component store (WinSxS) is damaged requires repairing the payload source prior to repairing the OS files. The process begins by opening an elevated Command Prompt. Next, DISM /scanhealth verifies component store damage, followed by DISM /restorehealth to rebuild the store. Once the store is healthy, SFC /scannow repairs damaged system files. Finally, restarting the system completes the replacement of files locked during operation.

Step-by-Step Solution

1
Open an elevated Command Prompt window.
Grants necessary administrative rights.
Administrative rights are required to interact with system repair tools and modify system files.
2
Execute DISM /online /cleanup-image /scanhealth.
Confirms corruption status of the local component store (WinSxS).
Verifying store health ensures appropriate diagnostic assessment prior to payload recovery.
3
Execute DISM /online /cleanup-image /restorehealth.
Repairs and restores the local Windows image payload.
SFC relies on the component store payload; if the component store is corrupt, SFC cannot fix system files.
4
Execute sfc /scannow.
Scans protected system files and replaces corrupted files using the restored store.
System File Checker repairs OS files using the healthy image source prepared by DISM.
5
Reboot the workstation.
Applies file updates for locked system files.
Certain operating system files can only be replaced during system startup.

Key Concept

Sequential Repair of System File Corruption and Component Store
Question 254Question →

An IT technician discovers a corporate desktop actively communicating with a suspected command-and-control server. Which of the following represents the correct chronological sequence of steps the technician should take from initial containment through physical evidence handoff?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response steps is: 1) Disconnect the Ethernet cable and disable wireless interfaces to isolate the workstation while keeping it powered on; 2) Capture volatile system memory (RAM) and record active system connections; 3) Shut down the workstation, remove the storage drive, calculate its cryptographic hash, and place it in a tamper-evident bag; 4) Log the transfer timestamps and serial numbers on the chain of custody form and collect required signatures during physical handoff.
Standard incident response mandates containing the threat first by isolating the system from the network while preserving power. Next, volatile evidence (RAM) is captured in accordance with the order of volatility. Once RAM is acquired, non-volatile evidence (the hard drive) is imaged, hashed, and sealed in a tamper-evident container. Finally, during physical transfer, the chain of custody log is populated with timestamps, device details, and signatures from both parties to maintain legal evidence integrity.

Step-by-Step Solution

1
Isolate the compromised computer from all network connections.
Stops communication with command-and-control servers without destroying volatile data in RAM.
Immediate containment minimizes ongoing risk and prevents threat propagation.
2
Preserve volatile evidence (RAM).
Captures memory-resident malware, encryption keys, and active network sockets.
According to the order of volatility, RAM is lost upon power loss and must be dumped first.
3
Preserve non-volatile evidence and hash the drive image.
Ensures the integrity of the physical media can be verified mathematically later.
Static drive storage preservation occurs after live volatile evidence has been captured.
4
Document and complete the chain of custody transfer during physical handoff.
Establishes an unbroken record of control and legal accountability for the evidence.
Chain of custody documentation must record the exact time, date, and signatures of both the releasing and receiving handlers.

Key Concept

Incident Handling Containment, Order of Volatility, and Chain of Custody Protocol
Question 255Question →

A corporate smartphone was reported lost in a public location and contains confidential company data. Place the standard mobile device security remediation steps in the correct order from FIRST action to LAST action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of actions is: 1) Perform a remote lock on the mobile device via the MDM console, 2) Issue a remote wipe command to erase corporate data, 3) Revoke active authentication tokens and reset the user's account password, 4) Unenroll the lost device record from the enterprise MDM portal.
When responding to a lost corporate mobile device, technicians must prioritize containment by locking the device, followed by data destruction (remote wipe), identity protection (password/token reset), and administrative portal maintenance (MDM unenrollment).

Step-by-Step Solution

1
Locate the device in the Mobile Device Management (MDM) portal and issue a remote lock command.
The screen locks immediately, preventing unauthorized local access while location tracking is assessed.
Immediate containment is necessary to secure corporate information.
2
Execute a remote wipe command through the MDM system.
All company and personal data on the device is securely erased.
If physical recovery is doubtful, wiping prevents data breaches.
3
Reset user domain credentials and revoke OAuth/session tokens associated with the mobile device.
The user's corporate email, VPN, and cloud access tokens become invalid for any unauthorized handler of the device.
Token revocation secures enterprise cloud resources connected to the account.
4
Unenroll and remove the device entry from the MDM directory.
The asset inventory is accurately updated and the hardware lifecycle for that device instance is closed.
Administrative cleanup prevents obsolete devices from clogging management portals.

Key Concept

Mobile Device Security Incident Response
Estimated Time:1m 0s
Question 256Question →

An IT technician is preparing to replace a core network switch as part of a planned infrastructure maintenance activity. Place the standard change management workflow phases in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for the change management process is: 1) Define the purpose and scope of the proposed change, 2) Perform a risk analysis to evaluate potential business impact, 3) Develop the implementation plan and a detailed rollback plan, 4) Obtain formal authorization from the Change Advisory Board (CAB), and 5) Execute the change and complete post-implementation testing.
The standard CompTIA change management lifecycle requires identifying the purpose and scope first, evaluating risk second, building implementation and rollback plans third, securing CAB approval fourth, and executing followed by post-implementation testing last.

Step-by-Step Solution

1
Establish change boundaries
Defining purpose and scope comes first.
Before assessing risks or making plans, the technician must clearly define what change is being proposed and why.
2
Evaluate consequences
Performing risk analysis comes second.
Assessing risk helps the organization understand the severity and scope of potential disruptions.
3
Create technical deployment and recovery procedures
Developing implementation and rollback plans comes third.
A documented plan for deployment and a contingency plan to revert changes must exist before submitting for approval.
4
Submit proposal for review
Obtaining CAB approval comes fourth.
The Change Advisory Board reviews all documentation (scope, risk, implementation, and rollback) to authorize execution.
5
Perform work and verify outcome
Executing the change and completing post-implementation testing comes last.
Implementation occurs in the scheduled window, followed by testing and documentation to ensure successful completion.

Key Concept

Standard Change Management Process Lifecycle
Question 257Question →

A technician is preparing an anti-static work area to safely perform internal maintenance on sensitive computer hardware. Place the following steps in the correct order from first to last to properly establish a grounded ESD-safe workstation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: first, clear the workbench of static-generating materials; second, lay the ESD mat flat across the work surface; third, attach the grounding wire from the ESD mat to a ground source; fourth, wrap the ESD wrist strap snugly around your wrist with skin contact; and fifth, connect the wrist strap clip to the grounded snap point on the ESD mat.
Establishing an anti-static workstation follows a logical sequence: first remove static generators (paper, plastics) from the surface; second, lay down the ESD mat; third, ground the mat to a known ground source; fourth, secure the ESD wrist strap against bare skin; fifth, attach the wrist strap lead to the grounded mat snap to equalize potential.

Step-by-Step Solution

1
Remove static-generating items from the workbench area.
The immediate work environment is free of ambient static hazards such as plastic wrappings or synthetic foam.
Eliminating static sources prevents accidental static discharge to components while setting up.
2
Position the ESD mat on the bench.
A dissipative work surface is established.
The mat serves as the central point for grounding both tools and personnel.
3
Connect the mat grounding wire to a verified ground.
The ESD mat is grounded and capable of safely draining electrostatic charges.
Un-grounded mats cannot dissipate static electricity to the earth.
4
Fasten the ESD wrist strap to your wrist with direct skin contact.
The personal body static protection interface is established.
Direct skin contact is required for electrical conductivity to drain body charge.
5
Clip the wrist strap cord to the grounded mat or equipment chassis ground snap.
The technician and mat share the same electrical potential grounded pathway.
Equipotential grounding prevents static potential differences between the technician and the hardware components.

Key Concept

ESD Safe Workstation Setup Procedures
Question 258Question →

An enterprise security operations center detects unauthorized remote shell access on a database server containing sensitive customer records. As the initial incident responder, in what sequence should you execute the following response and forensic preservation actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: 1) Report the security incident and record initial system indicators, 2) Disconnect the server from networks while keeping system power on, 3) Capture volatile system RAM, 4) Fill out the chain-of-custody log with timestamps and signatures, and 5) Secure the server in a tamper-evident bag and transport it to a lockable evidence room.
First responder protocol requires immediate reporting and baseline logging, followed by host network isolation while keeping power enabled. Following the order of volatility, volatile evidence in RAM must be captured next. After evidence collection is complete, chain-of-custody documentation must be recorded before physical hardware is packed into tamper-evident containers and stored in a secure evidence vault.

Step-by-Step Solution

1
Report and Document Initial Findings
Escalation pathways are activated and initial indicators of compromise are logged.
Official incident response policies dictate immediate notification to authority figures before making unauthorized system changes.
2
Isolate the Host
Network communication is terminated while system power remains uninterrupted.
Quarantining network access prevents data exfiltration and further attacker movement while preserving volatile evidence.
3
Preserve Volatile Memory
Active RAM contents are dumped to external media.
Following the order of volatility, transient data in RAM is destroyed when power is lost, making RAM capture a top priority before shutdown.
4
Establish Chain of Custody
A complete custody form is created with exact time, date, location, and handler identity.
Legal defensibility requires continuous accounting of evidence handling before physical transportation or transfer of responsibility.
5
Secure Physical Hardware
Device is sealed in tamper-evident packaging and stored securely.
Protects physical evidence against unauthorized access, tampering, or loss prior to formal forensic analysis.

Key Concept

First Responder Incident Handling Sequence and Chain of Custody
Estimated Time:2m 0s
Question 259Question →

An IT support technician is handling a service desk ticket for a user experiencing application launch failures following an update. Place the standard ticketing workflow stages in the correct chronological order from initial incident logging to final ticket closure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the ticketing workflow is: Record user contact information and asset ID (Creation) → Assign category, urgency, and priority (Triage) → Perform diagnostic steps and apply software fix (Resolution) → Contact end user for confirmation (Verification) → Select final resolution code and mark status as Closed (Closure).
The standard ticket lifecycle follows a strict progression: Creation (logging user and asset info) → Triage (categorizing and setting priority) → Resolution (troubleshooting and documenting technical notes) → Verification (confirming fix with the user) → Closure (setting final status and resolution code).

Step-by-Step Solution

1
Identify the initial intake step.
Recording user details, asset IDs, and symptoms creates the ticket record in the ticketing database.
A ticket must exist and contain identifying context before any administrative or technical action can occur.
2
Determine the administrative routing step.
Categorizing the ticket and assigning urgency/priority allows automated or manual queue assignment.
Triage ensures the issue is prioritized according to service level agreements (SLAs) and routed to the correct tier.
3
Identify the technical remediation step.
Troubleshooting the application fault, performing the fix, and recording technical notes.
Technical work notes document root cause and solution steps so other technicians can review historical context.
4
Determine the validation step.
Contacting the end user to verify that the application operates normally.
CompTIA best practices require verifying resolution with the affected end user before closing a ticket.
5
Identify the final administrative step.
Entering closure codes and setting the state to Closed.
Closing the ticket completes the incident lifecycle and updates reporting metrics.

Key Concept

Standard Ticket Lifecycle Management
Question 260Question →

An IT support technician is assigned to assist a remote user experiencing recurring email synchronization errors. Place the technician's communication and customer interaction steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of professional communication steps is: 1) Greet the user and obtain remote control permission, 2) Actively listen to the problem description, 3) Explain troubleshooting steps in plain language, 4) Have the user verify the resolution, and 5) Document the ticket details.
The correct professional communication sequence begins with greeting the user and securing explicit consent for remote access. Next, the technician actively listens to the user's issue description. The technician then performs troubleshooting while explaining actions in non-technical terms. Once completed, the user must test and verify functionality, followed finally by thorough ticket documentation.

Step-by-Step Solution

1
Establish initial contact and obtain consent.
Proper introduction completed and permission granted for remote access.
CompTIA guidelines require technicians to identify themselves and obtain consent before controlling a user's device.
2
Gather diagnostic details using active listening.
Complete context obtained without interrupting the customer.
Allowing the user to explain their issue fully prevents misunderstandings and builds professional rapport.
3
Perform remediation while maintaining clear communication.
The user understands what is being done without being confused by acronyms or technical jargon.
Transparent, plain-language communication sets clear expectations and reduces user anxiety during maintenance.
4
Verify complete system functionality with the user.
The user tests and confirms that email synchronization functions as expected.
The technician must ensure customer satisfaction and functional resolution prior to ticket closure.
5
Document the incident in the ticketing system.
Detailed technical record saved to the corporate knowledge base.
Thorough documentation fulfills administrative requirements and assists peer technicians with future issues.

Key Concept

Standard Professional Communication and Customer Interaction Workflow
Estimated Time:1m 30s
PreviousPage 13 / 22Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin