Examkin

All practice questions

423 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 261Question →

A field maintenance technician reports that an augmented reality (AR) equipment inspection app on an enterprise Android tablet frequently stutters and freezes during live diagnostic streams. Place the following troubleshooting steps in the correct order, starting from the least invasive action to the most invasive action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper troubleshooting sequence from least to most invasive is: 1) Force stop the application, 2) Clear the application cache, 3) Clear the application data, 4) Uninstall and reinstall the application, and 5) Perform a factory reset of the mobile OS.
The correct order follows standard CompTIA least-invasive-first troubleshooting procedure: force stopping the app addresses software glitches without data loss, clearing cache removes corrupt temp files without wiping configuration, clearing app data resets app settings, reinstalling the app fixes binary corruption, and factory resetting wipes the entire OS as a last resort.

Step-by-Step Solution

1
Terminate frozen or misbehaving application processes
App shuts down completely; re-opening tests if a simple process hang was the issue.
Force quitting is non-destructive and takes minimal effort.
2
Clear cached temporary files
Removes temporary unneeded files without removing user settings or login credentials.
Addresses performance issues caused by bloated or corrupt temporary files.
3
Clear application data
Resets the application configuration completely to its default post-install state.
Fixes internal app state corruption but requires re-authentication.
4
Reinstall the application
Replaces all installation files and application binaries.
Fixes corrupted installation binaries.
5
Factory reset the device OS
Erases all user data, applications, and system configurations on the mobile device.
Resolves systemic OS-level corruption as a final resort.

Key Concept

Least Invasive Troubleshooting Methodology for Mobile OS Applications
Question 262Question →

A storage administrator is preparing to perform a major firmware upgrade on an enterprise Storage Area Network (SAN) controller. Place the following standard change management lifecycle steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the change management steps is: (1) Perform a comprehensive risk analysis to evaluate potential business impact and service dependencies -> (2) Formulate a detailed implementation procedure accompanied by a verified backout strategy -> (3) Submit the change request to the Change Advisory Board (CAB) for review and authorization -> (4) Issue an advance maintenance window notification to affected end users and business units -> (5) Conduct post-implementation testing to confirm array performance and close the change ticket.
Standard enterprise change management follows a strict progression: initial risk analysis and scope definition, development of technical deployment and rollback plans, formal review and authorization by the Change Advisory Board (CAB), user/stakeholder notification of the scheduled maintenance window, and post-implementation testing prior to ticket closure.

Step-by-Step Solution

1
Define scope and conduct risk assessment.
Potential downtime and affected infrastructure dependencies identified.
Evaluating potential impact is required before creating technical deployment and recovery plans.
2
Draft implementation details and backout procedures.
Complete change proposal documentation created.
CAB reviewers require step-by-step installation instructions and rollback plans to evaluate the request.
3
Present proposal to the Change Advisory Board (CAB).
Formal authorization granted.
Organizational governance requires CAB approval before scheduling maintenance windows or executing system modifications.
4
Distribute maintenance window notices.
Impacted users informed of expected downtime.
User notification must happen after authorization is secured so accurate window details are communicated.
5
Execute post-implementation testing and record documentation.
Verified system functionality and closed ticket.
Final validation ensures system stability before the change management process is formally completed.

Key Concept

Sequential IT Change Management Lifecycle
Question 263Question →

A technician is writing a simple PowerShell script to automate a routine maintenance task. Place the following script constructs in the correct order to initialize a path variable, evaluate whether the path exists, execute an automated action, and close the execution block.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence initializes the target variable (LogPath="C:\Logs\system.log"),openstheconditionalevaluation(if(Test−PathLogPath = "C:\Logs\system.log"), opens the conditional evaluation (if (Test-Path LogPath) {), runs the file deletion command within the block (Remove-Item -Path $LogPath), and closes the control structure (}).
In standard procedural scripting logic, environment variables must be declared and assigned before they can be evaluated by control constructs such as conditional 'if' statements. Once the condition opens, nested tasks run within the block before the enclosing block is terminated.

Step-by-Step Solution

1
Initialize variable
$LogPath variable is set with string value
Scripting constructs require variable assignment prior to evaluation.
2
Open conditional statement
if (Test-Path $LogPath) { is evaluated
Conditional branching checks environmental state before executing reliant actions.
3
Perform action inside block
Remove-Item -Path $LogPath executes
Actions governed by conditional checks reside within the construct body.
4
Terminate block
} closes the block
Closing braces signal the end of the conditional execution scope.

Key Concept

Execution sequence of basic scripting variables and conditional control constructs
Question 264Question →

A help desk technician is responding to a ticket where a user's web browser consistently opens to a rogue search engine upon startup, and intrusive advertisement pop-ups appear periodically. The technician suspects a browser hijacker that modified shortcut parameters and installed a malicious extension. In what sequence should the technician perform the following steps to remediate the browser redirect and pop-up issue?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Disconnect the workstation from the local network; 2) Inspect browser shortcut properties to remove injected URL arguments and uninstall unauthorized extensions; 3) Reset browser security settings to default configurations and clear all cached web content and cookies; 4) Execute a full anti-malware scan of the local system; 5) Reconnect the workstation to the network and verify proper browser operation.
The correct order follows standard CompTIA malware and browser troubleshooting protocols: first isolate the system from the network to contain the threat; second, remove active browser hijacker components (shortcut target overrides and rogue extensions); third, reset browser settings and clear residual cached data and unauthorized notification permissions; fourth, run a comprehensive system anti-malware scan to clean OS-level artifacts; and fifth, restore network connectivity and verify resolution.

Step-by-Step Solution

1
Isolate the infected machine from the network.
Prevents active malicious extensions or scripts from transmitting data or downloading additional payloads.
Following malware remediation procedures, isolation is always the immediate first step upon identifying a compromise.
2
Remove malicious shortcut parameters and rogue extensions.
Eliminates the immediate cause of forced URL redirects and unwanted pop-up behavior.
Directly targets the active injection vectors within the browser environment while disconnected.
3
Reset browser settings and clear browser data/cache.
Restores original security defaults, removes unauthorized push notification permissions, and clears malicious cookies/cache.
Ensures no residual persistent browser state or pop-up permissions remain.
4
Run a full system anti-malware scan.
Detects and removes any OS-level malware components, scheduled tasks, or persistent registry keys.
Guarantees the system is clean beyond just the browser profile before restoring network access.
5
Reconnect to the network and verify functionality.
Confirms that redirects are gone and browser security settings remain intact during live web browsing.
Final verification step ensures successful remediation under normal operating conditions.

Key Concept

Browser Hijacker Remediation and Malware Best Practices
Question 265Question →

A technician is troubleshooting a Windows workstation that displays frequent system error dialogs after an unclean shutdown. The technician ran the System File Checker (`sfc /scannow`), but the utility reported that it found corrupt files and was unable to fix some of them because the local component store itself is damaged. In what sequence should the technician execute the following procedures to properly repair the component store image, fix the corrupted system files, and complete the repair process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence is: First, open an elevated Command Prompt. Next, execute `dism /online /cleanup-image /restorehealth` to repair the component store. Then, execute `sfc /scannow` to fix corrupt system files. Finally, restart the system to complete file replacement operations.
The correct sequence begins with opening an elevated Command Prompt to gain administrative access. The Deployment Image Servicing and Management tool (`dism /online /cleanup-image /restorehealth`) must be run next to repair the corrupted Windows component store image. Once the component store is healthy, running System File Checker (`sfc /scannow`) allows the utility to successfully replace damaged system files with clean copies from the store. Finally, restarting the computer applies any pending file operations that require a reboot.

Step-by-Step Solution

1
Launch Command Prompt with elevated (administrator) rights.
System grants necessary administrative privileges to run low-level repair utilities.
Both DISM and SFC require full administrative rights to inspect and modify Windows system files and component store manifests.
2
Execute `dism /online /cleanup-image /restorehealth`.
The Windows Component Store image is scanned, repaired, and restored to a healthy state.
SFC relies on the local component store (WinSxS) to retrieve clean copies of corrupted system files. If the component store itself is corrupted, DISM must repair it first.
3
Execute `sfc /scannow`.
Protected Windows system files are checked and any corrupted files are successfully replaced with healthy versions from the repaired component store.
With a healthy component store restored, System File Checker can successfully repair corrupted OS binaries.
4
Restart the workstation.
Pending file swaps are finalized at system boot, ensuring complete system file integrity.
Certain locked system files can only be replaced during the boot cycle prior to OS initialization.

Key Concept

DISM vs. SFC Repair Dependency Sequence
Question 266Question →

A help desk technician is responding to a ticket where a workstation web browser continuously opens pop-up advertisements and redirects to unauthorized search engines. Place the following remediation steps in the correct chronological order from first to last to resolve the browser hijacking issue.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence to troubleshoot and remediate browser redirects and pop-ups is: 1) Disconnect the workstation from the network to isolate the system, 2) Remove unrecognized browser extensions and reset the browser to default settings, 3) Run a full anti-malware scan using updated virus definitions, and 4) Reconnect the workstation to the network and verify web browser functionality.
The standard incident response procedure requires isolating the system first to stop malware traffic, cleaning browser configurations and running anti-malware scans to eliminate persistent threats, and finally reconnecting the device to verify normal operation.

Step-by-Step Solution

1
Isolate the compromised system
Network communication to external malicious ad servers is interrupted.
Preventing further data exfiltration or secondary malware payload downloads takes immediate priority.
2
Clean the web browser environment
Rogue add-ons and altered homepages/search engines are cleared.
Browser hijackers primarily operate through unauthorized extensions and modified default settings.
3
Perform system-level anti-malware scanning
Root cause malware components residing in system directories or memory are purged.
Scanning cleans underlying adware components that might re-infect the browser upon restart.
4
Reconnect and validate resolution
Browser performance and network connectivity are confirmed secure.
Testing web browsing after network re-engagement ensures the issue is fully resolved.

Key Concept

Standard order of operations for malware containment and browser security remediation.
Question 267Question →

An IT technician discovers a corporate workstation actively communicating with a known malicious command-and-control server on the internet. To follow proper CompTIA incident response guidelines and preserve evidence integrity, in what order should the technician execute the following actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response and evidence preservation steps is: 1) Report the security incident immediately to the designated incident response team and management, 2) Isolate the workstation from the network by disconnecting the network cable and disabling Wi-Fi, 3) Capture the volatile system memory (RAM) while the machine remains powered on, and 4) Fill out a chain of custody log and place the seized physical storage drive into a tamper-evident anti-static bag.
Standard operational procedures specify that security incidents must first be reported to proper authorities. Next, the technician must isolate the compromised system from the network to stop active communication without powering down the machine. Once isolated, volatile memory (RAM) must be collected before system state changes. Finally, chain of custody logs are filled out as physical evidence is packaged and handed off.

Step-by-Step Solution

1
Report the incident through proper organizational escalation channels.
The incident handling protocol is officially initiated with appropriate management awareness.
Reporting ensures that incident response procedures begin promptly and authorization is granted for further intervention.
2
Isolate the compromised system from local and wide area networks.
Active command-and-control traffic is severed without shutting down the system.
Immediate containment protects other network assets from infection and halts data exfiltration.
3
Perform volatile evidence capture (RAM collection).
Volatile artifacts like running processes, decrypted contents, and socket details are saved.
RAM is highly volatile and must be acquired while the system is live before non-volatile drives are removed or powered off.
4
Complete chain of custody documentation and secure physical evidence.
Legal defensibility and evidence tracking are established with verified timestamps and signatures.
Chain of custody forms account for evidence possession, transfers, and secure physical storage.

Key Concept

Incident Response Life Cycle and Order of Volatility in Evidence Handling
Question 268Question →

A field surveyor uses a specialized GIS mapping application on an enterprise iOS tablet to collect spatial terrain data. During operation, the application frequently stops responding, causing thermal throttling and accelerated battery discharge on the device. Following CompTIA troubleshooting methodology, in what sequence should the technician perform the following steps, ordered from least invasive to most invasive?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper troubleshooting order from least invasive to most invasive is: 1) Force close the application, 2) Restart (soft reset) the mobile device, 3) Install application and OS updates, 4) Reinstall the application, and 5) Perform a factory reset.
CompTIA troubleshooting methodology dictates progressing from the least disruptive action to the most disruptive action. Force closing the application is the quickest, least invasive step. If the problem persists, soft resetting the device clears shared system memory. Installing updates fixes software bugs. Reinstalling the app replaces corrupted files, and performing a factory reset is the final, most invasive step.

Step-by-Step Solution

1
Terminate the affected application process.
Clears transient application lockups without impacting other services or device uptime.
Always begin troubleshooting at the least invasive layer closest to the problem.
2
Restart the operating system (soft reset).
Flushes system memory and restarts system services.
If force quitting fails, restarting the device resolves lower-level OS memory leaks or stuck background tasks.
3
Update software packages (app and OS).
Applies developer bug fixes and system optimization patches.
Ensures the issue is not caused by a known code bug before modifying application installations.
4
Remove and reinstall the application.
Replaces app binaries and refreshes local configuration stores.
More invasive step that clears persistent app-specific file corruption.
5
Execute a factory reset.
Wipes all local data and returns OS to default clean state.
Most invasive measure, reserved as a last resort when OS corruption or system-wide failure persists.

Key Concept

Least-invasive to most-invasive mobile OS troubleshooting sequence
Question 269Question →

During a scheduled infrastructure migration, an IT specialist must coordinate with department leaders whose teams will experience temporary application downtime. In what order should the specialist execute the communication steps to maintain professional interaction standards from initial outreach through project completion?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with a professional, jargon-free initial greeting and explanation, followed by active listening to address schedule concerns. Next, clear expectations and approval are established prior to work. During the outage, status updates are provided. Finally, service restoration is verified with stakeholders and documented in the ticketing system.
The correct order follows standard CompTIA customer interaction guidelines: establish initial rapport with clear language, practice active listening to address concerns, set transparent expectations and secure consent, provide ongoing communication during implementation, and complete the process by verifying customer satisfaction and updating documentation.

Step-by-Step Solution

1
Initiate communication with a proper greeting and clear, jargon-free explanation.
Stakeholders understand the scope of the upcoming work without confusion.
Professional communication starts with establishing rapport and clarity.
2
Practice active listening to understand customer concerns.
Business scheduling impacts are identified and accommodated.
Understanding user needs takes priority before finalizing implementation schedules.
3
Set clear expectations and obtain authorization.
Mutual agreement is reached regarding outage timelines and deliverables.
Prevents misunderstandings and ensures proper authorization before changes occur.
4
Maintain progress updates during system maintenance.
Department heads remain informed of progress and timeline adherence.
Proactive updates prevent unnecessary anxiety during service downtime.
5
Verify customer satisfaction and log details in the ticketing system.
Service functionality is validated and complete history is recorded.
Ensures resolution completeness and administrative compliance.

Key Concept

Professional Communication and Customer Service Life Cycle
Question 270Question →

An IT support technician is handling a service desk incident for a departmental file server that experienced an unexpected service disruption. Place the standard IT service desk workflow steps in the correct sequence from initial intake to final ticket closure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of standard ticketing lifecycle steps is: 1) Log the incoming incident with initial details and assign a ticket ID and priority. 2) Perform initial triage, gather logs, and document diagnostic findings. 3) Implement corrective action and record resolution details. 4) Contact the representative to test access and verify resolution. 5) Record root cause analysis and mark the ticket status as Closed.
The standard ticketing workflow follows a structured lifecycle: ticket creation/categorization, triage and diagnostic logging, implementation of the resolution, end-user verification, and final administrative documentation with ticket closure. Placing these steps in sequence ensures complete auditability and adheres to standard IT service management practices.

Step-by-Step Solution

1
Identify the initial ticketing phase
Ticket Creation and Categorization
An incident must first be logged into the ITSM framework with initial user details, symptoms, and priority assignment before work begins.
2
Identify the investigation phase
Triage and Diagnostics
Once logged, the technician investigates the system, collects logs, and records diagnostic notes in the ticket.
3
Identify the remediation phase
Resolution Implementation
The technician applies the fix to resolve the root cause or fault and updates work notes.
4
Identify the validation phase
User Verification
Before closing a ticket, best practices dictate contacting the affected party to verify service restoration.
5
Identify the final administrative phase
Root Cause Documentation and Ticket Closure
After user confirmation, final notes regarding root cause are logged and the status is changed to Closed.

Key Concept

IT Service Desk Ticket Lifecycle and Workflow Management
Estimated Time:1m 30s
Question 271Question →

A database administrator is preparing to deploy a major version upgrade and schema modification to an organization's central transactional database system. To align with formal CompTIA change management processes, in which chronological order should the administrator execute the following steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for standard change management processes is: 1) Document the purpose, business rationale, and technical scope; 2) Perform a risk assessment and construct a detailed backout plan; 3) Submit the change request to the Change Advisory Board (CAB) for formal evaluation and authorization; 4) Broadcast maintenance window notifications to impacted business stakeholders and end users; 5) Execute the database upgrade within the maintenance window and complete post-implementation testing.
The standard CompTIA change management workflow begins by defining the purpose and scope of the change. Next, potential risks are evaluated and a detailed backout plan is drafted. The completed proposal is then submitted to the Change Advisory Board (CAB) for formal review and authorization. Once CAB approval is obtained, maintenance window notifications are issued to end users and business leaders. Finally, the technician executes the upgrade during the maintenance window and performs post-implementation testing to confirm success.

Step-by-Step Solution

1
Identify the initial scope definition step.
Documenting the purpose and scope forms the baseline requirement for any change request.
A change request cannot begin without defining what is changing and why.
2
Identify the risk and contingency planning phase.
Conducting risk analysis and drafting a backout plan follows scope definition.
Understanding potential business impacts and fallback procedures is necessary to complete the change proposal.
3
Identify the formal authorization stage.
Submitting the change request package to the Change Advisory Board (CAB) follows documentation.
CAB approval grants official approval and schedules the authorized deployment window.
4
Identify stakeholder communication timing.
Sending end-user notifications takes place after securing CAB approval.
Users should only be informed of maintenance windows once authorized by governance.
5
Identify execution and post-change validation.
Executing the upgrade and conducting post-implementation testing occurs during the approved window.
Implementation and functional verification are the concluding steps of the operational change.

Key Concept

Change Management Lifecycle Phases
Question 272Question →

A network technician is setting up a newly deployed multifunction device (MFD) to enable Scan-to-Network Folder (SMB) for a department file server. In what sequence should the technician perform the following configuration steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Create the destination folder on the file server and assign permissions; 2) Access the MFD Embedded Web Server (EWS); 3) Configure the UNC share path and credentials in the EWS; 4) Perform a test scan from the physical MFD control panel.
Configuring Scan-to-SMB requires preparing the host environment first. The server folder, share permissions, and NTFS permissions must be established so the MFD service account has write access. Next, the technician accesses the Embedded Web Server (EWS) of the MFD to manage settings. The technician then inputs the specific UNC target path (e.g., \\server\share) and service account credentials. Finally, an operational test from the physical MFD scanner ensures end-to-end integration and verifies write access.

Step-by-Step Solution

1
Prepare network share folder and permissions
Server directory established with SMB and NTFS write permissions
The target folder must exist on the network before the MFD can map to it.
2
Connect to MFD Embedded Web Server
Admin web page opened to the network scan profile setup screen
Administrative features like scan shortcuts are managed through the EWS.
3
Program SMB destination parameters
UNC path and account credentials saved to device configuration
The MFD needs network authentication details to pass server security checks.
4
Run end-to-end verification test
Scanned image successfully saved in target file server folder
Confirms complete functional path from physical scanning to remote network storage.

Key Concept

Scan-to-SMB Configuration Sequence
Estimated Time:1m 30s
Question 273Question →

A technician is responding to a support ticket regarding a Windows 11 desktop where web browsers continuously redirect users to malicious advertising sites upon opening any URL. Place the following remediation steps in the correct chronological order to effectively resolve the browser hijack and restore secure browser operation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with network isolation, followed by removing suspicious browser extensions and resetting browser settings, inspecting and restoring system hosts and proxy configurations, running a full anti-malware scan in Safe Mode, and concluding with browser security hardening and user education.
Remediating a browser hijacker requires adhering to proper operational sequence: first isolate the host to prevent network-based malware activity, next eliminate user-level browser modifications, then clear system-level redirection vectors (hosts file and proxy settings), proceed with offline anti-malware scanning to remove core binaries, and finally restore security controls and provide end-user education.

Step-by-Step Solution

1
Isolate the compromised system from the network.
Halts ongoing external malware communication and blocks secondary drive-by downloads.
Standard incident response protocol dictates quarantining infected systems prior to active remediation.
2
Purge unapproved browser extensions and reset browser profiles.
Eliminates application-level hijacker scripts, modified homepages, and rogue search engine redirects.
Most browser hijacking symptoms originate from malicious add-ons or altered browser startup preferences.
3
Examine the local hosts file and network proxy settings.
Restores legitimate DNS resolution and network routing.
Hijackers frequently tamper with the system hosts file or force localhost proxy configurations to ensure redirects persist even after browser resets.
4
Perform a complete anti-malware scan while booted in Safe Mode.
Detects and quarantines background malware processes and registry persistence keys.
Safe Mode prevents active malware binaries from running or locking files during scan and removal routines.
5
Enforce pop-up blocker rules and provide end-user security guidance.
Hardens the workstation against recurring threats and improves user defense against social engineering.
Finalizing remediation requires restoring defensive policies and conducting post-incident user training.

Key Concept

Web Browser Hijacker Remediation and Security Troubleshooting Sequence
Question 274Question →

A technician is troubleshooting a Windows workstation experiencing system errors caused by corrupted system files. The technician determines that the local Windows Component Store (WinSxS) may also be corrupted. Arrange the following steps in the correct sequential order to properly restore the component store and repair the protected system files.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence starts by launching an elevated Command Prompt, executing DISM restorehealth to fix the component store image, running SFC scannow to replace damaged system files, and restarting the workstation to finalize file replacements.
The sequence correctly prioritizes elevating privileges first, repairing the underlying source repository via DISM next, executing SFC scannow to repair protected OS binaries from the fixed store, and rebooting to replace locked files.

Step-by-Step Solution

1
Open Command Prompt as Administrator
Grants necessary elevated security tokens for system file modifications
Both DISM and SFC require elevated permissions; otherwise, access denied errors will occur.
2
Run DISM with `/restorehealth` flag
Repairs corrupted files within the local Windows Component Store (WinSxS)
SFC relies on the WinSxS store as its source repository. Running SFC when WinSxS is corrupt causes SFC repairs to fail.
3
Run SFC with `/scannow` flag
Scans all protected system files and replaces corrupted instances with healthy copies from WinSxS
SFC directly inspects system integrity against the validated store restored by DISM.
4
Restart the computer
Applies pending replacements for files locked by active processes
Operating system files currently loaded into memory cannot be swapped until the next system initialization.

Key Concept

DISM and SFC Repair Sequencing
Estimated Time:1m 30s
Question 275Question →

A technician needs to restore default security configurations and eliminate persistent pop-ups and unwanted redirects on a workstation web browser. Arrange the remediation steps in the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence begins by terminating active browser processes, followed by removing suspicious extensions and clearing browser data, auditing operating system level proxy and hosts file settings, scanning the host machine with anti-malware software, and finally re-enabling built-in pop-up blocking while testing browser operation.
The correct operational sequence isolates the application first by closing active processes, cleans application-specific threats (extensions and cache), checks OS-level routing settings (proxy and hosts file), removes system-level malware via anti-malware scans, and finishes by confirming protective browser controls and testing functionality.

Step-by-Step Solution

1
Terminate active browser instances and background processes.
Stops active malicious scripts and unlocks the browser application interface.
Active scripts can prevent settings modifications or spawn continuous new pop-up windows if not terminated first.
2
Audit extensions, clear browser cache, cookies, and reset site permissions.
Eliminates browser-level adware, hijacked homepages, and malicious script persistence.
Rogue extensions and cached data are the primary cause of browser-internal redirection.
3
Check system-level OS network settings including proxy servers and the static hosts file.
Identifies and reverses system-wide DNS hijacking or unauthorized proxy redirection.
If malicious static mappings exist in the hosts file or proxy settings, browser-level cleanup alone will not solve domain redirects.
4
Execute a full anti-malware and security software scan.
Quarantines host OS malware infections that reinstall adware or tamper with system files.
Ensures underlying system infections are removed so redirects do not return upon reboot.
5
Verify browser security settings (pop-up blocker) and perform test navigation.
Confirms system health and restores secure browser operations for the user.
Final testing validates that pop-up protection is enforced and legitimate websites load correctly.

Key Concept

Browser Hijacker and Redirect Remediation Workflow
Question 276Question →

A senior systems technician is documenting standard operational procedures for analyzing print quality defects on enterprise electrophotographic (EP) laser printers. To isolate where in the cycle a failure occurs, new technicians must master the sequential workflow of laser image generation. What is the correct operational sequence of the initial five steps in the electrophotographic (EP) printing process, starting from incoming job reception through paper media image placement?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the initial five steps of the electrophotographic (EP) laser printing process is: 1) Processing (rasterizing job data into bitmap memory), 2) Charging (applying a uniform negative DC charge to the drum), 3) Exposing (laser writing to form an electrostatic latent image), 4) Developing (attracting negatively charged toner to discharged drum regions), and 5) Transferring (using positive polarity to pull toner from drum onto paper).
The standard EP printing process requires a precise functional sequence: Processing converts print job commands into raster bitmap data; Charging applies a uniform negative DC charge across the photosensitive drum; Exposing uses a laser to write an electrostatic latent image by discharging target areas; Developing attracts negatively charged toner onto the discharged areas; and Transferring uses a strong positive charge behind the paper to pull toner off the drum onto the media.

Step-by-Step Solution

1
Identify data translation before hardware operation.
The controller processes incoming print job data into a raster bitmap image stored in RAM.
Hardware components cannot operate until the controller renders the page content into printable image coordinates.
2
Identify drum surface preparation.
The primary charging roller conditions the OPC drum surface with a high uniform negative voltage (typically around -600V to -1000V).
A uniform electrostatic base level is required so that localized laser exposure can later create potential differences.
3
Identify latent electrostatic image creation.
The laser beam scans the charged drum surface, discharging exposed spots to roughly -100V.
Discharging specific areas creates a voltage delta (latent image) relative to the surrounding charged drum surface.
4
Identify physical toner application to drum.
Developer roller applies negatively charged toner particles, which jump only to the lower-potential discharged spots on the drum.
Toner is electrostatically repelled by highly negative unexposed areas but attracted to the less negative exposed spots.
5
Identify media toner transfer stage.
The transfer roller charges the underside of the paper media with a strong positive charge to attract toner off the drum.
Opposite electrostatic polarity overcomes the drum's hold on the toner particles, transferring them onto the paper surface.

Key Concept

Electrophotographic (EP) Laser Printing Process Sequence
Estimated Time:2m 0s
Question 277Question →

An IT technician responds to an active security incident where a workstation is suspected of transmitting sensitive customer files to an unauthorized external server. Which of the following represents the correct chronological sequence of initial incident response and evidence collection procedures the technician should perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with reporting the incident to proper authorities, followed by isolating the workstation from the network, preserving volatile RAM memory, and finally logging the chain of custody upon drive extraction.
The standardized first responder framework dictates reporting the breach first, containing the threat via network isolation second, capturing volatile memory (RAM) third in compliance with the order of volatility, and establishing chain of custody documentation fourth during evidence collection.

Step-by-Step Solution

1
Identify and Report Incident
Formally notify security management or the designated incident response officer.
Standard operational procedures mandate proper authorization and policy execution prior to unilateral technician actions.
2
Isolate System
Disconnect physical network connections and disable Wi-Fi.
Halts ongoing malicious network communications and data exfiltration while keeping power intact.
3
Preserve Volatile Memory
Capture RAM and volatile artifacts.
Adheres to the order of volatility; shutting down the PC before memory capture permanently destroys volatile evidence.
4
Document Chain of Custody
Fill out evidence tags, timestamps, and transfer logs when handling physical hardware.
Maintains evidence integrity and legal admissibility during forensic handling.

Key Concept

First Responder Incident Response Sequence and Order of Volatility
Question 278Question →

A mobile security technician receives an automated alert indicating that an enterprise-managed smartphone is transmitting unauthorized data over an unencrypted channel after a user installed an untrusted profile. In what sequence should the technician perform the remediation steps to secure the device and restore access?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct incident response sequence is: 1) Isolate the mobile device by enabling Airplane Mode, 2) Remove the unauthorized configuration profile and application, 3) Execute a full system scan using mobile anti-malware, 4) Re-enroll the mobile device into the MDM portal, and 5) Disable Airplane Mode and verify secure connectivity.
Standard operational procedures for mobile security incident handling require containment (isolation via Airplane Mode) first. Once isolated, the root cause (untrusted profile/app) is removed, followed by anti-malware verification. The device must then be restored to corporate compliance via MDM re-enrollment before re-establishing network access and verifying functionality.

Step-by-Step Solution

1
Isolate the compromised mobile device from all networks immediately.
Network communication is terminated, stopping active exfiltration.
Containment is the primary objective in security incident handling to prevent further risk.
2
Uninstall the untrusted profile and associated application.
The unauthorized access mechanism is eliminated from the operating system.
Removing the rogue configuration prevents it from maintaining elevated privileges.
3
Perform a thorough antimalware inspection.
Any lingering secondary malware or spyware is identified and remediated.
Ensures the device is clean before re-introducing enterprise credentials or management baselines.
4
Re-enroll the device in MDM.
Compliant security policies, certificates, and app restrictions are pushed to the device.
Restores the enterprise trust state and security baseline required for network access.
5
Restore wireless network interfaces and validate corporate service access.
Normal secure operational status is confirmed.
Verification confirms that connectivity functions properly under secured conditions.

Key Concept

Mobile Incident Response and Unauthorized Access Remediation
Question 279Question →

An IT help desk technician is following standard operating procedures to process a service desk incident from initial report through completion. Place the following ticket lifecycle stages in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of the ticketing workflow stages is: 1) Create the initial ticket record with user and asset details; 2) Assign urgency categorization and impact priority; 3) Apply the technical fix and verify functionality; 4) Obtain end-user confirmation; 5) Document final resolution details and set ticket status to closed.
The standard operational procedure for ticket lifecycle management follows a strict sequence: ticket creation/logging, triage (categorization and prioritization), technical remediation/troubleshooting, end-user verification of resolution, and finally detailed documentation with ticket closure.

Step-by-Step Solution

1
Identify the initial logging phase.
The initial ticket must be logged first with contact, problem, and asset details.
Without a recorded ticket, issue tracking and accountability cannot begin.
2
Determine the triage phase.
Categorizing and prioritizing the ticket follows ticket creation.
Proper classification ensures correct technician routing and adherence to service level agreements.
3
Identify the technical execution phase.
Applying the technical remediation occurs after routing.
The core technical work fixes the underlying root cause.
4
Identify the user validation phase.
User confirmation follows technical remediation.
Technicians must confirm satisfaction with the user before closing any incident.
5
Determine the final documentation and closure phase.
Resolution logging and closing the ticket complete the workflow.
Thorough documentation builds the corporate knowledge base and closes out the ticket lifecycle.

Key Concept

Standard Ticket Lifecycle and Operational Workflow Management
Question 280Question →

A field support technician visits an employee's workstation to resolve a local scanner configuration error. To follow CompTIA best practices for professional communication and customer interaction, in what sequence should the technician perform these actions from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for customer interaction is: 1) Greet the customer and introduce yourself, 2) Actively listen to the user's description of the problem without interrupting, 3) Request permission before interacting with the user's computer or workspace, 4) Perform the repair while communicating clearly without technical jargon, and 5) Verify issue resolution with the user and document the ticket.
The proper sequence begins with greeting the customer and actively listening to their description of the issue. The technician must then gain explicit permission before touching equipment or workspace items. Next, the technician completes the repair while explaining actions in plain language, and finally verifies the fix with the customer before recording documentation.

Step-by-Step Solution

1
Initiate the interaction professionally.
Establishes a positive line of communication and confirms the purpose of the visit.
Professional etiquette dictates beginning every customer interaction with a polite greeting and personal introduction.
2
Gather information through active listening.
Collects complete details regarding the problem from the user's perspective.
Allowing the customer to explain the issue completely without interruption builds trust and prevents missing critical details.
3
Obtain consent to access workspace and equipment.
Maintains professional boundaries and respects customer privacy and physical space.
Technicians must never touch a user's computer or personal belongings on their desk without explicit permission.
4
Execute the technical resolution while communicating clearly.
Resolves the issue while keeping the user informed in accessible terms.
Avoid acronyms and complex technical jargon so the user understands the work being done on their system.
5
Validate resolution and finalize documentation.
Ensures customer satisfaction and updates administrative ticket records.
A ticket should only be closed after confirming with the user that the issue is completely resolved to their satisfaction.

Key Concept

Professional Communication and Customer Interaction Workflow
PreviousPage 14 / 22Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin