Examkin

All practice questions

3551 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 2641Question →

A technician is setting up a workstation to host multiple 64-bit guest virtual machines using a client-side hypervisor. When launching a guest operating system, the hypervisor reports an error indicating that hardware virtualization support and extended page table translation are disabled or unsupported. Which TWO of the following hardware features or BIOS/UEFI configurations must be enabled on the host system to resolve this issue?

Select all that apply

Show answer & explanation

Answer: Intel VT-x or AMD-V CPU virtualization extensions in BIOS/UEFI; Second Level Address Translation (SLAT) support on the host processor

Answer

Intel VT-x or AMD-V CPU extensions enabled in BIOS/UEFI and Second Level Address Translation (SLAT) CPU support are the required host configurations.
Hosting 64-bit guest virtual machines requires CPU hardware-assisted virtualization (Intel VT-x or AMD-V) enabled in the motherboard BIOS/UEFI settings, along with CPU support for Second Level Address Translation (SLAT) to handle virtual memory mapping directly in hardware.

Step-by-Step Solution

1
Determine the CPU virtualization requirement for running 64-bit guest VMs.
Intel VT-x or AMD-V must be enabled in BIOS/UEFI firmware to allow the host processor to perform hardware-assisted virtualization.
Without hardware virtualization extensions enabled, client hypervisors cannot manage 64-bit guest OS execution.
2
Identify the memory virtualization feature needed for hypervisor address mapping.
Second Level Address Translation (SLAT) maps guest virtual memory directly to host physical RAM in CPU hardware.
SLAT significantly reduces memory translation overhead and is required by modern client hypervisors.

Key Concept

Virtual Machine Hardware Requirements and BIOS/UEFI Virtualization Settings
Question 2642Question →

A desktop technician is performing malware remediation on a compromised Windows 10 workstation controlling automated machinery on a manufacturing floor. The technician has already confirmed malware infection symptoms and physically disconnected the ethernet cable to isolate the system. In what exact order should the technician perform the remaining steps to complete the standard CompTIA malware removal process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the remaining remediation steps is: Disable System Restore, Update anti-malware signatures offline and execute a full scan, Configure recurring automated scans and schedule OS security updates, Enable System Restore and generate a clean system restore point, and Conduct end-user security training.
According to CompTIA's official 7-step malware removal process, after identifying the symptoms (Step 1) and isolating the system (Step 2), the technician must proceed through the remaining steps in strict sequence: Step 3 is Disabling System Restore, Step 4 is Remediating infected systems (updating anti-malware signatures and scanning), Step 5 is Scheduling scans and running updates, Step 6 is Enabling System Restore and creating a new restore point, and Step 7 is Educating the end user.

Step-by-Step Solution

1
Identify malware symptoms
Malware presence confirmed (already completed in scenario).
Establishes the problem state before taking remediation steps.
2
Isolate infected systems
Ethernet cable disconnected (already completed in scenario).
Prevents lateral movement across the manufacturing network.
3
Disable System Restore
System Protection disabled; corrupted restore points purged.
Prevents the infected system from keeping backup copies of infected binaries during cleaning.
4
Remediate infected systems
Anti-malware definitions updated via external media and full system scan completed.
Ensures active malicious processes and files are completely quarantined and erased.
5
Schedule scans and run updates
Scheduled tasks created for periodic scanning and Windows Update checks.
Ensures long-term protection against re-infection.
6
Enable System Restore and create restore point
System Protection enabled; baseline restore point created.
Provides a healthy recovery baseline now that the OS is known clean.
7
Educate end user
Operators trained on security awareness and threat prevention.
Reduces human-factor vulnerability to future attacks.

Key Concept

CompTIA 7-Step Best Practice Methodology for Malware Removal
Question 2643Question →

A receptionist at a medical clinic reports that a Windows workstation used for check-ins is displaying unexpected adware pop-ups and generating heavy unauthorized network traffic. A technician inspects the system and confirms an active malware infection. According to the CompTIA standard 7-step malware removal process, which of the following actions should the technician perform IMMEDIATELY after identifying the infection?

Show answer & explanation

Answer: Disconnect the workstation from the network

Answer

Disconnect the workstation from the network
Following the CompTIA 7-step malware removal process (1. Identify symptoms, 2. Isolate infected system, 3. Disable System Restore, 4. Remediate infected system, 5. Schedule scans and updates, 6. Enable System Restore, 7. Educate end user), the immediate next step after identifying malware is to isolate the system by disconnecting it from wired or wireless networks.

Step-by-Step Solution

1
Identify the current step in the CompTIA 7-step malware removal workflow
The scenario states that the technician has already confirmed the malware infection (Step 1: Identify malware symptoms).
Determining the current phase dictates what action must follow immediately.
2
Determine the next sequential step in the process
Step 2 is to isolate the infected system.
Isolating the device by unplugging the Ethernet cable or disconnecting Wi-Fi prevents malware from spreading to other network assets or exfiltrating data.

Key Concept

CompTIA 7-Step Malware Removal Procedure (Step 2: Isolate infected systems)
Estimated Time:45s
Question 2644Question →

An IT support technician is remediating a malware-infected Windows workstation following the official CompTIA 7-step malware removal process. Place the following steps of the remediation procedure in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Isolate the infected workstation from the network, 2) Disable System Restore in Windows, 3) Update anti-malware signatures and perform full system remediation scans, and 4) Re-enable System Restore and create a clean restore point.
The standard CompTIA 7-step malware removal process strictly follows this sequence: 1. Identify malware symptoms, 2. Isolate the infected system, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Disconnecting network access comes first among these choices to contain the threat, followed by disabling restore points, executing anti-malware scans/remediation, and finally re-enabling System Restore once cleanliness is assured.

Step-by-Step Solution

1
Isolate the system
The infected endpoint is disconnected from wireless and wired network connections.
Prevents the malware from spreading to other systems on the network or communicating with remote command-and-control servers.
2
Disable System Restore
System Restore is turned off and existing restore points containing infected files are cleared.
Ensures that malware cannot be restored inadvertently from an infected restore point later.
3
Remediate infected systems
Anti-malware software is updated with current definition files and full system scans are run.
Identifies and removes active malware threats and associated infected files.
4
Re-enable System Restore
System Restore is re-enabled and a new, verified clean system restore point is created.
Establishes a reliable recovery point now that the machine is entirely clean.

Key Concept

CompTIA 7-Step Malware Remediation Procedure
Question 2645Question →

A help desk analyst is troubleshooting a user's workstation where launching the web browser via its desktop shortcut consistently opens an unfamiliar advertising web page alongside the corporate homepage. The analyst verifies that the browser's startup settings and default search engine are configured correctly, and no suspicious browser extensions are installed. Which of the following should the technician inspect NEXT to resolve the persistent redirection?

Show answer & explanation

Answer: The Target field in the desktop shortcut properties for the web browser

Answer

The technician should inspect the Target field in the desktop shortcut properties for the web browser.
Inspecting the Target field in the desktop shortcut properties addresses shortcut hijacking, a common redirection technique where malicious software appends a URL to the browser executable command line. Because internal browser configurations and extensions were verified as clean, the launch parameter outside the browser is the primary root cause.

Step-by-Step Solution

1
Analyze the troubleshooting context and prior findings.
Internal browser startup settings, default search engines, and browser add-ons/extensions have already been verified as clean.
Eliminating internal browser configuration rules out standard homepage hijacking and rogue extensions.
2
Identify potential external launch vectors for browser redirection.
Browser shortcuts on the desktop or taskbar can have additional command-line arguments added to their target paths (e.g., chrome.exe http://malicious-site.com).
When the user clicks the modified shortcut, the OS passes the appended URL directly to the browser executable upon launch.
3
Select the appropriate inspection and remediation action.
Right-click the shortcut, select Properties, and inspect the Target string to remove any appended URLs.
Cleaning the shortcut path restores normal browser launching behavior.

Key Concept

Browser Shortcut Target Hijacking Remediation
Estimated Time:1m 0s
Question 2646Question →

A field technician is configuring a hypervisor host workstation equipped with 32 GB32\text{ GB} of physical RAM to run four concurrent virtual machines (VMs) for software testing. Each guest VM requires 8 GB8\text{ GB} of dedicated RAM, and the host operating system requires a reserved minimum of 4 GB4\text{ GB} of physical RAM to ensure system stability. What is the minimum amount of additional physical RAM that must be installed in the host workstation to support this deployment?

Show answer & explanation

Answer: 4 GB4\text{ GB}

Answer

The host workstation requires a minimum of 4 GB4\text{ GB} of additional physical RAM to run four guest VMs of 8 GB8\text{ GB} each alongside the 4 GB4\text{ GB} host OS memory reserve.
Four VMs requiring 8 GB8\text{ GB} each demand 32 GB32\text{ GB} of RAM. Adding the mandatory 4 GB4\text{ GB} host OS memory overhead brings the total system requirement to 36 GB36\text{ GB}. Since the host currently has 32 GB32\text{ GB} installed, a minimum addition of 4 GB4\text{ GB} of physical RAM is necessary to prevent memory starvation.

Step-by-Step Solution

1
Calculate total memory required for all guest virtual machines.
4 VMs×8 GB/VM=32 GB4 \text{ VMs} \times 8\text{ GB/VM} = 32\text{ GB}.
Each guest VM requires dedicated RAM allocated for its guest operating system and applications.
2
Add the mandatory host operating system memory overhead.
32 GB (guests)+4 GB (host reserve)=36 GB32\text{ GB (guests)} + 4\text{ GB (host reserve)} = 36\text{ GB} total system requirement.
The hypervisor and host OS require dedicated physical RAM to avoid paging and system instability.
3
Subtract currently installed physical RAM from total system requirement.
36 GB (total required)−32 GB (installed)=4 GB36\text{ GB (total required)} - 32\text{ GB (installed)} = 4\text{ GB} additional RAM required.
Determines the exact hardware capacity deficit.

Key Concept

Virtual Machine RAM Capacity Planning and Host Overhead
Question 2647Question →

A cybersecurity analyst at a research facility is responding to a compromised Windows 11 workstation connected to automated lab sequencing hardware. The machine exhibits persistent pop-up alerts, altered host files, and unauthorized background process creation. The analyst has already isolated the workstation by disabling its network interfaces and has disabled Windows System Restore. Which of the following actions should the analyst perform IMMEDIATELY before launching a full remediation scan on the infected system?

Show answer & explanation

Answer: Update the local anti-malware definition signatures using an offline installation package.

Answer

Update the local anti-malware definition signatures using an offline installation package.
The scenario describes a system where Step 1 (Identify malware symptoms), Step 2 (Quarantine/Isolate), and Step 3 (Disable System Restore) have already been performed. Step 4 of the CompTIA malware removal process is 'Remediate infected systems,' which explicitly requires updating the anti-malware software and definitions (sub-step 4a) before running scans and using removal techniques (sub-step 4b). Because the workstation is disconnected from the network to maintain isolation, signature updates must be transferred via an offline installation package.

Step-by-Step Solution

1
Analyze the current state within CompTIA's 7-step malware removal framework.
The technician has completed Step 1 (Identify symptoms), Step 2 (Quarantine/Isolate system), and Step 3 (Disable System Restore).
Establishing the current phase in the standard workflow dictates the required next action.
2
Identify the sub-steps of Step 4 (Remediate infected systems).
Step 4 requires updating the anti-malware engine/signatures first (Step 4a) before running scans and removal tools (Step 4b).
Scanning with outdated definition files may miss newly mutated malware signatures or rootkit payloads.
3
Determine the proper method for updating signatures on an isolated system.
Because the system is isolated from the network, signatures must be updated offline via removable media containing signed signature packages.
Maintaining network isolation prevents malware propagation while providing the scanner with current detection signatures.

Key Concept

CompTIA 7-Step Malware Removal Procedure - Step 4 (Remediate: Update anti-malware software before scanning)
Estimated Time:2m 0s
Question 2648Question →

A desktop technician at an online retail fulfillment center is troubleshooting a Windows 11 workstation. The machine was isolated from the network after an employee reported rogue browser pop-ups and unauthorized system settings changes. The technician has verified the malware symptoms, quarantined the workstation, and disabled System Restore. Which of the following is the NEXT step the technician should perform according to the standard CompTIA malware remediation process?

Show answer & explanation

Answer: Update the anti-malware software and signature definition files.

Answer

Update the anti-malware software and signature definition files.
According to the CompTIA 7-step malware remediation process, once System Restore has been disabled (Step 3), the technician must begin remediation (Step 4). Remediation specifically requires updating anti-malware software and definition files (Step 4a) before executing full system scans and removal techniques (Step 4b).

Step-by-Step Solution

1
Review the CompTIA 7-step malware remediation process sequence.
Process order: 1. Identify symptoms, 2. Quarantine, 3. Disable System Restore, 4. Remediate (a. Update anti-malware, b. Scan/remove), 5. Schedule updates/scans, 6. Enable System Restore & create restore point, 7. Educate user.
CompTIA standards mandate a strict sequence to ensure complete malware eradication.
2
Identify current progress in the scenario.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) are already complete.
Determines the precise entry point into the remediation workflow.
3
Determine the mandatory next sub-step.
Sub-step 4a is updating the anti-malware software and signature definition files prior to scanning (4b).
Updating definitions ensures the scanner has the newest threat signatures to detect and remove the active infection effectively.

Key Concept

CompTIA 7-Step Malware Remediation Process
Estimated Time:1m 15s
Question 2649Question →

A Windows 11 workstation equipped with UEFI firmware fails to start, displaying an error stating that the Boot Configuration Data (BCD) file is missing or corrupted. Automatic Repair is unable to resolve the issue. A system administrator boots the computer using Windows installation media to manually rebuild the EFI System Partition (ESP) boot loader from the Command Prompt. Place the technician's administrative steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with booting into the WinRE Command Prompt via installation media, using diskpart to identify and assign a drive letter to the hidden EFI System Partition, formatting that partition as FAT32, executing the bcdboot command to reconstruct the EFI boot store, and finally rebooting the workstation to confirm normal startup.
The correct order follows the standard procedure for repairing corrupted UEFI boot structures: first boot into an offline command shell, mounting/lettering the hidden EFI partition, wiping existing corrupt boot headers with a FAT32 format, writing new boot files with bcdboot, and rebooting to complete testing.

Step-by-Step Solution

1
Boot from Windows 11 installation media and select 'Repair your computer' to open the WinRE Command Prompt.
Obtained offline administrative CLI access to the unbootable workstation.
System partition modification and offline BCD repairs require an unmounted, offline recovery environment.
2
Launch Diskpart, select the disk and EFI System Partition, and run 'assign letter=S'.
The hidden FAT32 EFI System Partition becomes accessible via drive letter S:.
UEFI bootloader recovery commands require a target drive letter path to apply new boot files.
3
Execute 'format S: /FS:FAT32' within Diskpart or Command Prompt.
The target partition is clean-formatted with the mandatory FAT32 file system.
Clearing corrupted file systems and damaged boot blocks ensures clean deployment of replacement boot infrastructure.
4
Run 'bcdboot C:\Windows /s S: /f UEFI'.
Fresh UEFI boot files and BCD entries are copied from C:\Windows into S:.
The bcdboot tool initializes the EFI System Partition with essential boot files and BCD configuration mandatory for UEFI startup.
5
Remove installation media, exit the command prompt, and restart the system.
The workstation successfully boots into the Windows operating system.
Rebooting verifies that the UEFI firmware correctly detects the restored EFI System Partition boot sequence.

Key Concept

Manual repair of corrupt UEFI/GPT boot structures using Diskpart and BCDBoot in WinRE.
Estimated Time:2m 0s
Question 2650Question →

A desktop technician is establishing baseline security settings for standalone Windows laptops issued to remote sales personnel. The technician must ensure that the laptops automatically lock when left unattended and that malicious code cannot execute automatically when a USB drive is plugged in. Which of the following actions should the technician perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable AutoPlay and AutoRun features for all removable storage media.; Configure screen saver timeout settings and enforce password re-authentication on resume.

Answer

The technician should disable AutoPlay and AutoRun features for all removable media and configure screen saver timeout settings requiring password re-authentication on resume.
Disabling AutoPlay and AutoRun mitigates risks associated with malicious flash drives by stopping automatic file execution. Configuring a screen saver timeout with password protection guarantees that unattended systems lock automatically, satisfying local physical security hardening baselines.

Step-by-Step Solution

1
Address the requirement to prevent automatic execution of software from USB devices.
Disabling AutoPlay and AutoRun ensures inserted drives will not execute commands automatically without user interaction.
AutoRun and AutoPlay policies serve as primary hardening defenses against USB-borne malware vectors.
2
Address the requirement to prevent physical access to unattended workstations.
Configuring a short screen saver timeout that requires a password upon resume locks the operating system session.
Screen saver locking protects local confidentiality if an employee leaves their device unattended in a public or remote environment.

Key Concept

Workstation Security Baselines and Removable Media Policies
Question 2651Question →

An IT technician working at a logistics corporate headquarters is remediating a Windows workstation infected with rogue antivirus software. The technician has already identified the symptoms, isolated the machine from the network, and disabled System Restore. Which of the following actions should the technician perform NEXT before launching a full system anti-malware scan?

Show answer & explanation

Answer: Update the anti-malware engine and signature definitions using an isolated media device.

Answer

The technician should update the anti-malware engine and definition files prior to performing a full system scan.
According to the CompTIA 7-step malware remediation process, Step 4 is 'Remediate infected systems', which consists of two sequential parts: sub-step 4a (Update anti-malware software and definitions) followed by sub-step 4b (Scan and use removal techniques). Since the workstation is isolated from the network, definitions must be updated via external out-of-band media before initiating the scan.

Step-by-Step Solution

1
Analyze the current state within the CompTIA 7-step malware remediation process.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) have already been completed.
Determines the appropriate next sequential remediation action required.
2
Identify the sub-components of Step 4 (Remediate the infected systems).
Sub-step 4a is updating anti-malware software/signatures, and sub-step 4b is scanning and executing removal techniques.
Antivirus software cannot effectively detect or clean current threat signatures unless updated first.
3
Select the correct action matching Step 4a.
Updating anti-malware definitions using isolated/out-of-band media (since the system is disconnected from the network).
Ensures the scanner has the latest detection patterns before scanning.

Key Concept

CompTIA 7-Step Malware Remediation Process Order
Question 2652Question →

A systems administrator is provisioning standalone Android-based digital signage kiosks deployed in public transit stations. The administrator needs to protect these embedded endpoints against unauthorized software installation, interface tampering, and OS-level access by members of the public. Which TWO of the following security configurations should be implemented to best harden these devices?

Select all that apply

Show answer & explanation

Answer: Enforce application whitelisting and enable a single-app kiosk mode profile to restrict navigation.; Disable hardware interface options such as USB debugging and restrict firmware access with administrative credentials.

Answer

The administrator should enforce application whitelisting with kiosk mode and disable USB debugging while securing firmware access.
Hardening embedded kiosks requires restricting the software layer through application whitelisting and kiosk mode profiles, alongside locking down physical debugging interfaces like USB debugging and securing bootloader/firmware settings.

Step-by-Step Solution

1
Identify software restrictions required for public-facing embedded kiosks.
Configuring single-app kiosk mode combined with application whitelisting ensures users cannot leave the designated app interface or run unapproved software.
Public terminals are highly vulnerable to unauthorized software installation and operating system navigation.
2
Identify physical and hardware interface hardening measures.
Disabling USB debugging and protecting firmware modifications prevents physical access exploits via external media or debug connections.
Physical access to exposed ports like USB can allow attackers to bypass software controls if debugging interfaces remain active.

Key Concept

Embedded System and Kiosk Device Hardening Controls
Question 2653Question →

A technician is troubleshooting a Windows 11 workstation where a critical line-of-business application crashes immediately upon opening. Event Viewer records Event ID 1000 in the Application log, specifying ntdll.dll as the faulting module. Hardware diagnostics for memory and storage report no errors. Which of the following commands should the technician execute FIRST from an elevated command prompt to verify and repair corrupted system files?

Show answer & explanation

Answer: sfc /scannow

Answer

The technician should execute sfc /scannow from an elevated command prompt to repair corrupted system files.
Executing sfc /scannow is the standard non-destructive troubleshooting step to repair corrupted system files when Event Viewer indicates a core Windows library like ntdll.dll is the faulting module.

Step-by-Step Solution

1
Analyze Event Viewer logs
Identify Event ID 1000 indicating an application crash caused by a corrupted core system library (ntdll.dll).
Event ID 1000 logs application crashes along with the faulting application path and faulting module.
2
Select the appropriate non-destructive command-line utility
Choose System File Checker (sfc /scannow) to inspect Windows system files.
Since ntdll.dll is an essential Windows component, System File Checker compares current system files against cached, known-good versions.
3
Execute the repair command
System File Checker replaces damaged system binaries without altering user data or requiring OS reinstallation.
This isolates and resolves OS system file corruption efficiently.

Key Concept

Using System File Checker (sfc /scannow) to resolve Windows application crashes caused by corrupted system binaries.
Question 2654Question →

A technician is troubleshooting a Windows 11 workstation where a local database indexing tool crashes during file export operations. Performance Monitor displays an Avg. Disk Queue Length of 8.58.5 on the C:C: drive, with Task Manager indicating 100%100\% Disk Active Time while CPU and Memory utilization remain below 30%30\%. Additionally, Event Viewer logs multiple Event ID 51 (paging operation warning) entries. Which of the following actions should the technician take first to resolve the application crashes?

Show answer & explanation

Answer: Run chkdsk C: /r to check for and repair bad physical sectors on the storage drive.

Answer

Run chkdsk C: /r to check for and repair bad physical sectors on the storage drive.
An Avg. Disk Queue Length continuously above 2.02.0 per drive, combined with 100%100\% Disk Active Time and low CPU/RAM usage, indicates that the storage sub-system is the primary bottleneck. Event ID 51 in Windows Event Viewer explicitly warns of paging operation errors during data transfers between physical RAM and pagefile.sys on disk. Running the command to check and repair bad sectors on the disk identifies bad storage clusters, relocates data, and fixes disk-level read/write failures causing the application crash.

Step-by-Step Solution

1
Analyze the reported metrics in Performance Monitor and Event Viewer.
An Avg. Disk Queue Length of 8.58.5 (well above the normal threshold of 22 per spindle/drive) combined with 100%100\% Disk Active Time indicates a major storage disk I/O bottleneck. Event ID 51 specifically logs warnings during paging operations between physical RAM and pagefile.sys.
Identifying the bottleneck source prevents unnecessary OS reinstallation or software reconfiguration.
2
Correlate disk queue metrics with application crash symptoms.
When virtual memory requests time out due to disk read/write failures, applications attempting high disk I/O fail to respond and crash.
Paging file corruption or physical bad sectors on the disk block memory allocation, causing the indexing tool to crash.
3
Select the appropriate command-line repair tool for storage hardware sector recovery.
Executing chkdsk C: /r scans the disk surface, locates bad sectors, and attempts to recover readable data from affected sectors.
The /r switch includes all functionality of /f and specifically isolates bad sectors to resolve paging read/write failures.

Key Concept

Troubleshooting Storage Bottlenecks and Virtual Memory Paging Errors
Question 2655Question →

A technician is responding to a malware incident on a workstation at a community medical clinic. The system is showing pop-up warnings and redirecting browser traffic. Place the following remediation actions in the correct sequential order according to the standard CompTIA 7-step malware removal process.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard CompTIA 7-step malware removal methodology: 1) Quarantine the infected system, 2) Disable System Restore, 3) Update anti-malware signatures and scan, 4) Re-enable System Restore and create a restore point, and 5) Educate the end user.
The CompTIA standard 7-step malware removal process follows a specific logical sequence: 1) Identify symptoms, 2) Quarantine system, 3) Disable System Restore, 4) Remediate infected systems (update definitions and scan), 5) Schedule updates and scans, 6) Enable System Restore and create restore point, and 7) Educate end user. The items provided map directly to steps 2, 3, 4, 6, and 7 in exact chronological order.

Step-by-Step Solution

1
Isolate the compromised system from the local environment.
Network communication is terminated, preventing malware spread.
Quarantine (Step 2) must occur before modifying system settings or performing scans.
2
Disable System Restore.
Existing restore points containing malicious files are cleared and new automatic restore points are suspended.
Disabling System Restore (Step 3) ensures malware cannot persist in Windows system restore points.
3
Remediate the infected system.
Anti-malware signatures are updated and malicious payloads are detected and removed.
Updating definitions and scanning (Step 4) removes the active infection from the machine.
4
Re-enable System Restore and create a clean restore point.
System protection is restored using a clean state baseline.
Re-enabling System Restore (Step 6) guarantees future recovery options without reintroducing cleared malware.
5
Conduct end-user training.
The user is informed about security best practices.
End-user education (Step 7) completes the workflow to help prevent future infections.

Key Concept

CompTIA 7-Step Malware Removal Process
Question 2656Question →

A technician is remediating a enterprise workstation where the web browser frequently redirects to unauthorized ad portals and displays intrusive desktop notifications. What is the correct sequence of steps the technician should follow to remediate the web browser configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence is: 1) Disconnect the workstation from the local network to isolate the system, 2) Inspect browser add-ons and uninstall unrecognized or suspicious extensions, 3) Clear the browser cache, cookies, and reset site notification permissions, and 4) Restore the default search engine, home page settings, and browser startup preferences.
The correct remediation sequence begins with system isolation to prevent further remote activity or secondary downloads. Next, the underlying cause of redirect behavior—malicious browser extensions—must be removed. Once the extensions are uninstalled, clearing the browser cache, cookies, and site notification permissions revokes rogue push notification access. Finally, restoring the search engine defaults and home page configuration establishes clean browser operation.

Step-by-Step Solution

1
Isolate the compromised system from the network.
Stops ongoing data transfer and prevents further malicious script injection or remote adware downloads.
Isolation is the immediate standard practice when dealing with browser hijacking or malware symptoms.
2
Remove unauthorized or malicious browser extensions.
Eliminates the root vector overriding standard search requests and injecting pop-ups.
Extensions often hold persistent control over browser behavior.
3
Purge temporary internet files, tracking cookies, and clear push notification permissions.
Removes existing persistent session tokens and revokes rogue push notification approvals.
Pop-ups are frequently driven by lingering notification permissions and stored site data.
4
Reconfigure search engine defaults and home page settings to corporate standards.
Ensures clean browser launches going forward.
Hijackers frequently modify default search URLs and startup pages.

Key Concept

Web Browser Security and Hijacker Remediation Workflow
Estimated Time:1m 30s
Question 2657Question →

A systems administrator is configuring security settings on a standalone Windows workstation placed in a public access area. The administrator must minimize the attack surface by ensuring unauthenticated users cannot gain access using built-in system privileges, while also preventing arbitrary scripts from executing automatically whenever a flash drive is inserted. Which of the following administrative actions best achieves these workstation hardening goals?

Show answer & explanation

Answer: Disable the built-in Guest account and configure Local Group Policy to disable AutoRun and AutoPlay for all drives.

Answer

Disable the built-in Guest account and configure Local Group Policy to disable AutoRun and AutoPlay for all drives.
Disabling the built-in Guest account removes a primary default attack vector for unauthenticated users, while disabling AutoRun and AutoPlay via Local Group Policy prevents malicious binaries on inserted USB drives from executing automatically.

Step-by-Step Solution

1
Identify key hardening requirements from the scenario.
Requirements are blocking unauthorized privilege-less login via built-in default accounts and preventing automated media execution.
Hardening standard images requires disabling unnecessary default accounts and restricting removable media auto-execution vectors.
2
Evaluate technical controls for default accounts.
Disabling the built-in Guest account mitigates unauthorized access attempts.
Built-in Guest accounts provide a known target for unauthorized users if left active.
3
Evaluate technical controls for removable media safety.
Disabling AutoRun and AutoPlay via Group Policy stops unauthorized automatic execution upon device insertion.
AutoRun and AutoPlay allow executable code on USB storage to launch without explicit user authorization.

Key Concept

Workstation Hardening Principles: Account Disabling and Auto-execution Policy Restrictions
Estimated Time:1m 15s
Question 2658Question →

A server administrator is planning a hypervisor deployment on a physical host workstation configured with 64 GB64\text{ GB} of RAM. The host operating system and hypervisor core require a baseline allocation of 8 GB8\text{ GB} of RAM, and organizational compliance requires reserving an additional 10%10\% of the total physical RAM for hypervisor dynamic overhead and host stability. If each planned guest virtual machine requires 5 GB5\text{ GB} of dedicated RAM, what is the maximum number of virtual machines that can be concurrently deployed on this host?

Show answer & explanation

Answer: 9

Answer

The maximum number of virtual machines that can be hosted concurrently without exceeding host resource limits is 9.
Subtracting both host core memory (8 GB8\text{ GB}) and dynamic safety overhead (10%10\% of 64 GB=6.4 GB64\text{ GB} = 6.4\text{ GB}) leaves 49.6 GB49.6\text{ GB} of usable RAM for guest workloads. Dividing 49.6 GB49.6\text{ GB} by 5 GB5\text{ GB} per VM yields 9.929.92, which rounds down to 9 fully provisioned virtual machines.

Step-by-Step Solution

1
Calculate the host dynamic overhead buffer
10%×64 GB=6.4 GB10\% \times 64\text{ GB} = 6.4\text{ GB}
Hypervisors require reserved memory overhead beyond the base operating system requirements to manage VM states safely.
2
Calculate total host RAM requirements
8 GB+6.4 GB=14.4 GB8\text{ GB} + 6.4\text{ GB} = 14.4\text{ GB}
Combines base host OS requirement with the mandatory dynamic buffer overhead.
3
Determine total remaining RAM available for guest virtual machines
64 GB−14.4 GB=49.6 GB64\text{ GB} - 14.4\text{ GB} = 49.6\text{ GB}
Deduct host host dependencies from physical RAM capacity.
4
Calculate maximum VM count and floor to whole unit
⌊49.6 GB/5 GB⌋=⌊9.92⌋=9\lfloor 49.6\text{ GB} / 5\text{ GB} \rfloor = \lfloor 9.92 \rfloor = 9
Virtual machines cannot be provisioned partially; total memory allocation must be fully satisfied per instance.

Key Concept

Virtual Machine Memory Allocation & Host Overhead Capacity Planning
Estimated Time:1m 30s
Question 2659Question →

An IT technician is remediating a severe malware infection on a Windows 11 workstation used in a healthcare clinic's billing department. The technician has confirmed the presence of rogue security software, disconnected all network interfaces, and disabled System Restore. When attempting to launch the local anti-malware utility to scan the system, the malicious process immediately forces the security application to close. Which of the following is the NEXT best step the technician should take to remediate the machine?

Show answer & explanation

Answer: Boot the workstation into Safe Mode or a pre-installation environment to update definitions and run the scan

Answer

Boot the workstation into Safe Mode or a pre-installation environment to update definitions and run the scan
When active malware interferes with security tools in standard Windows operational mode, booting into Safe Mode or an isolated pre-installation environment (such as WinPE) prevents third-party malware services and startup hooks from running. This allows the technician to update anti-malware definitions (via USB/offline package) and execute remediation scans successfully as part of Step 4 in the CompTIA removal process.

Step-by-Step Solution

1
Assess current progress within the CompTIA 7-step malware removal framework
Step 1 (Identify), Step 2 (Isolate), and Step 3 (Disable System Restore) are complete. The technician is performing Step 4 (Remediate infected systems).
Remediation requires updating anti-malware signatures and running scans to remove malicious files.
2
Analyze the barrier preventing standard anti-malware execution
The malware uses active self-defense mechanisms in standard boot mode to kill security software processes.
Rogue software relies on active background services and startup registry entries running in standard user mode.
3
Implement a minimal boot environment to bypass malware persistence
Safe Mode or a WinPE boot environment loads only essential operating system drivers.
Disabling non-essential startup items prevents the malware process from starting, enabling security software to execute scans and clean infected files.

Key Concept

CompTIA 7-Step Malware Remediation Procedure - Step 4 (Remediate Infected Systems)
Estimated Time:2m 0s
Question 2660Question →

An IT technician is troubleshooting a Windows 10 desktop computer using legacy BIOS and an MBR partition layout. Following an improper system shutdown caused by a power outage, the computer fails to boot and displays the message 'Missing operating system' on a black screen. The technician boots the system using a Windows installation media flash drive into the Windows Recovery Environment (WinRE) Command Prompt and launches the DiskPart utility. Inspection of the disk reveals that the primary system partition containing the boot loader files is fully intact, but its boot flag status is no longer marked as active. Which command within DiskPart should the technician execute after selecting the primary system partition to restore boot capability?

Show answer & explanation

Answer: Execute the active command

Answer

The technician should execute the active command after selecting the primary system partition in DiskPart.
Executing the active command in DiskPart sets the selected primary partition as the active boot partition. On legacy MBR systems, BIOS inspects the MBR partition table to find the partition marked active, which contains the boot loader code needed to initiate Windows startup.

Step-by-Step Solution

1
Analyze the boot error symptoms and environment
Identified a legacy MBR system displaying 'Missing operating system' due to a missing active flag on the primary system partition.
Legacy BIOS systems require an MBR partition to be marked as 'active' so the system BIOS knows which partition contains the boot sector code.
2
Navigate DiskPart focus to the correct partition
Selected the target disk and system partition containing boot files.
DiskPart commands apply strictly to the currently focused disk, volume, or partition.
3
Run the active command
The selected partition is marked as active in the Master Boot Record partition table.
Executing the active command configures the partition table so the Master Boot Record can transfer control to the partition's boot sector during startup.

Key Concept

Legacy MBR Active Partition Configuration
PreviousPage 133 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin