All practice questions

3551 questions

Question 1101Question

A IT support specialist is reviewing wireless security protocols and authentication mechanisms for an upcoming network refresh. Match each wireless security term on the left with its corresponding operational definition or characteristic on the right.

Click a left item, then click its matching right item

Items

WPA3-Personal
802.1X / RADIUS
WEP
TKIP

Matches

Show answer & explanation

Answer

WPA3-Personal matches SAE protection against dictionary attacks; 802.1X / RADIUS matches enterprise authentication via a central server; WEP matches legacy protocol with weak 24-bit IV; TKIP matches interim per-packet key rotation protocol.
Each wireless protocol is correctly paired to its cryptographic or authentication mechanism: WPA3-Personal utilizes SAE to protect against dictionary attacks; 802.1X with RADIUS provides centralized enterprise access management; WEP is defined by its vulnerable 24-bit IV; and TKIP dynamically changes encryption keys per packet to fix initial WEP flaws.

Step-by-Step Solution

1
Identify the key technology feature of WPA3-Personal.
Recognize that WPA3-Personal introduces SAE (Simultaneous Authentication of Equals) to secure passphrases.
SAE prevents dictionary attacks even when weak passwords are chosen.
2
Identify the primary function of 802.1X / RADIUS.
Associate 802.1X with enterprise access control reliant on a centralized RADIUS authentication server.
Enterprise networks require unique user credentials validated by a central server rather than a shared passphrase.
3
Differentiate between legacy encryption protocols WEP and TKIP.
Identify WEP as the older 24-bit IV flawed protocol and TKIP as the dynamic per-packet key replacement introduced with WPA.
Understanding legacy protocol flaws is essential for migration and network security assessment.

Key Concept

Wireless Security Protocols and Authentication Mechanisms
Estimated Time:1m 0s
Question 1102Question

A cybersecurity analyst is investigating an unauthorized network intrusion at a mid-sized engineering firm. System logs indicate that several high-level research engineers were infected with keylogger malware after visiting a legitimate, specialized computer-aided design (CAD) software forum that they frequently use for industry updates. Further analysis confirms the attacker compromised the forum site's web server beforehand to serve exploit code specifically targeting site visitors originating from the engineering firm's public IP address range. Which of the following social engineering threat types best describes this attack strategy?

Show answer & explanation

Answer: Watering hole attack

Answer

The attack strategy described is a watering hole attack because the attacker compromised a trusted third-party website routinely visited by the target group to deliver malware.
The correct answer is the option identifying a watering hole attack. In a watering hole attack, adversaries identify and compromise a trusted third-party website that members of a targeted organization frequently visit. Once the website is infected, visitors from the targeted organization are quietly served malicious code.

Step-by-Step Solution

1
Analyze the vector used to deliver the malware
The malware was delivered via a legitimate, trusted third-party industry forum that users visit regularly.
Identifying the medium helps distinguish between direct communication attacks and passive web-based exploits.
2
Evaluate the targeting mechanism
The attacker compromised the forum server in advance to target specific visitors coming from the organization's IP address range.
Watering hole attacks specifically target resources frequented by a particular group or organization.
3
Differentiate from alternative web and social engineering threats
Since DNS host resolution was not tampered with (pharming) and direct targeted email communication was not used (whaling), the incident represents a watering hole attack.
Watering hole attacks leverage preexisting trust in external web resources without needing to lure victims via direct phishing links.

Key Concept

Watering Hole Attack
Question 1103Question

A systems administrator is configuring an automated script to silently deploy a critical line-of-business application distributed as an `.msi` package to multiple Windows 11 Enterprise workstations. The corporate deployment policy requires that the installer run completely unattended without displaying a user interface, log all detailed installation events to `C:\Logs\app_deploy.log`, prevent an automatic system restart upon completion, and apply a custom installation transform file named `corporate_defaults.mst`. Which of the following command-line executions correctly fulfills all of these requirements?

Show answer & explanation

Answer: msiexec.exe /i "AppPackage.msi" /qn /norestart /L*V "C:\Logs\app_deploy.log" TRANSFORMS="corporate_defaults.mst"

Answer

The command string `msiexec.exe /i "AppPackage.msi" /qn /norestart /L*V "C:\Logs\app_deploy.log" TRANSFORMS="corporate_defaults.mst"` correctly performs a unattended installation of an `.msi` file while adhering to all logging, restart suppression, and transform configuration requirements.
The correct command utilizes standard Windows Installer (`msiexec.exe`) syntax options: `/i` specifies installation of the target `.msi` file; `/qn` sets the UI level to 'No UI' (completely silent); `/norestart` suppresses automatic system restarts; `/L*V` enables verbose logging to capture all status and error messages into the designated log file path; and `TRANSFORMS=` passes the path to the custom `.mst` configuration file.

Step-by-Step Solution

1
Identify the executable tool required for Windows Installer (.msi) packages
`msiexec.exe` with the `/i` switch is required to initiate an installation.
Standard `.msi` installation packages rely on the native Windows Installer engine.
2
Determine the parameter for unattended (silent) execution
The `/qn` switch sets the user interface level to 'No UI'.
Corporate unattended scripts require zero user interaction and no modal pop-ups.
3
Identify parameters for verbose logging, reboot suppression, and modification transforms
`/L*V` generates verbose logs, `/norestart` prevents automated reboot, and `TRANSFORMS="file.mst"` passes custom property values.
These exact switch definitions match official CompTIA A+ command-line syntax standards for `msiexec`.

Key Concept

Windows Installer (`msiexec.exe`) Command-Line Switches for Unattended App Deployment
Question 1104Question

A technician is trying to configure incoming Remote Desktop access on a user's workstation running Windows 11 Home. However, the setting to enable incoming Remote Desktop connections is not available in System Settings. Which of the following best explains why the technician cannot enable this feature?

Show answer & explanation

Answer: Windows Home edition can initiate outgoing Remote Desktop sessions but cannot act as a Remote Desktop host for incoming connections.

Answer

Windows Home edition supports outgoing Remote Desktop client connections, but lacks the ability to host incoming Remote Desktop sessions.
Microsoft Windows Home editions include the RDP client software, allowing users to connect out to other remote systems. However, incoming Remote Desktop host capability is explicitly restricted to Windows Pro, Enterprise, and Education editions. To allow incoming RDP sessions, the operating system must be upgraded.

Step-by-Step Solution

1
Identify the OS edition and remote feature requirement
The target workstation is running Windows 11 Home edition, and the goal is to host an incoming RDP session.
Microsoft restricts certain enterprise and management features by operating system edition.
2
Evaluate feature availability across Windows editions
Windows Home edition includes the Remote Desktop Connection client (RDP client) to connect to remote computers, but does not support acting as an RDP server/host.
Hosting incoming Remote Desktop sessions requires Windows Pro, Enterprise, or Education edition.

Key Concept

Windows Edition Remote Desktop Host Limitations
Question 1105Question

A desktop support technician is deploying physical and hardware security controls across multiple corporate facilities. Match each physical security control mechanism on the left to its corresponding primary protective function on the right.

Click a left item, then click its matching right item

Items

USB data blocker
Anti-passback system
Kensington lock
Privacy screen filter

Matches

Show answer & explanation

Answer

The physical security controls correctly match their primary protective functions: USB data blocker prevents data exchange during charging by disabling data lines; Anti-passback system prevents credential sharing and tailgating by enforcing badge exit tracking; Kensington lock physically tethers hardware to fixed objects; Privacy screen filter prevents shoulder surfing by narrowing screen viewing angles.
Each physical security control directly counters a distinct physical threat: USB data blockers mitigate juice jacking attacks; anti-passback rules eliminate badge-passing and tailgating; Kensington locks deter physical theft of mobile hardware; privacy screen filters prevent shoulder surfing.

Step-by-Step Solution

1
Analyze the function of USB data blockers.
Identified that USB data blockers disable data pin continuity, protecting devices charging on untrusted public charging stations from data exfiltration or juice jacking.
Matches the protective function that prevents data transfer while allowing power delivery.
2
Analyze the operation of anti-passback access controls.
Identified that anti-passback enforces an alternating sequence of entry and exit scans for credential validity.
Matches the protective function requiring registered exit scans before allowing re-entry with the same credential.
3
Analyze hardware security cable locks (Kensington locks).
Identified that cable locks physically tether laptop or monitor chassis to immovable furniture or fixtures.
Matches the protective function anchoring equipment to fixed structural elements using steel cabling.
4
Analyze visual security controls.
Identified that privacy screens narrow viewing angles to prevent unauthorized observation from peripheral viewing angles.
Matches the protective function narrowing the display viewing cone to counter shoulder surfing.

Key Concept

Physical Security Controls
Question 1106Question

A systems administrator is configuring a centralized log management solution within an Active Directory domain. The administrator needs to set up a subscription on a Windows console to automatically collect and aggregate system and security event entries forwarded from multiple remote client workstations across the network. Which Windows administrative tool should the administrator use to manage these event subscriptions?

Show answer & explanation

Answer: Event Viewer

Answer

Event Viewer is the correct tool because its Subscriptions node manages Windows Event Forwarding (WEF) to centralize event logs from remote network computers.
Event Viewer (eventvwr.msc) features a Subscriptions node used by administrators to configure Windows Event Forwarding (WEF). This allows a designated collector computer to aggregate events from remote source devices.

Step-by-Step Solution

1
Identify the core requirement
The scenario requires centralizing system and security event logs forwarded from remote Windows workstations.
Windows Event Forwarding (WEF) allows collector machines to aggregate log data from source computers.
2
Evaluate available administrative tools
Event Viewer (eventvwr.msc) includes a dedicated Subscriptions folder built specifically to define and manage event collector rules.
Neither Performance Monitor, Component Services, nor Task Scheduler natively manage event log subscription feeds.

Key Concept

Centralized Event Log Management via Event Viewer Subscriptions
Question 1107Question

A systems administrator needs to enforce specific administrative privilege policies on standalone Windows 11 Pro workstations. Specifically, the administrator must configure User Account Control (UAC) settings so that built-in administrative accounts are explicitly prompted for credentials on the Secure Desktop whenever an elevation request occurs. Which tool should the administrator open to modify these detailed UAC security options?

Show answer & explanation

Answer: Local Security Policy (secpol.msc)

Answer

Local Security Policy (secpol.msc) is the correct tool for configuring detailed User Account Control security policies and elevation prompt behaviors.
The Local Security Policy console (secpol.msc) provides administrative access to Local Policies and Security Options in Windows Professional and higher editions. Under the Security Options folder, administrators can configure specific User Account Control settings, including requiring credential prompts on the Secure Desktop for administrative accounts during privilege elevation.

Step-by-Step Solution

1
Identify the administrative task
The requirement is to configure granular UAC policies such as administrative elevation prompt behavior.
Standard UAC slider controls in Control Panel only offer basic level adjustments, whereas specific security policies require advanced management snap-ins.
2
Locate the appropriate administrative management snap-in
Access secpol.msc to navigate to Security Settings > Local Policies > Security Options.
This location houses policies such as 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode'.

Key Concept

Windows Local Security Policy (secpol.msc) and UAC Policy Configuration
Question 1108Question

A desktop technician is configuring a Windows 11 workstation used by a software developer who works with a proprietary application that outputs custom data files with a .log extension. When searching for specific text strings inside these files using Windows Search in File Explorer, only file names are returned in the search results, not the file contents. The technician confirms that the folder containing the log files is already included under indexed locations. Which of the following Control Panel applet configurations should the technician perform to ensure the file contents of this custom extension are indexed?

Show answer & explanation

Answer: Open Indexing Options, click Advanced, select the File Types tab, locate the file extension, and select 'Index Properties and File Contents'.

Answer

Open Indexing Options in Control Panel, navigate to Advanced > File Types, locate the extension, and change the setting to 'Index Properties and File Contents'.
The Indexing Options applet in Control Panel provides access to the File Types configuration tab under Advanced settings. Here, technicians can specify whether Windows Search should index only file properties or both properties and file contents for any specific file extension.

Step-by-Step Solution

1
Identify the cause of the missing search results.
Recognize that while the folder directory is included in indexed locations, the search engine treats the custom file extension as a properties-only file.
Windows Search defaults to indexing only file metadata for non-standard extensions to save index space and processing time.
2
Open the appropriate Windows Control Panel utility.
Launch Indexing Options and select the Advanced button.
Indexing Options manages index catalog locations, file type filters, and rebuild commands.
3
Modify the file extension filter settings.
Switch to the File Types tab, highlight the target extension, and change how the file is indexed to 'Index Properties and File Contents'.
This instructs the Windows Search service to extract and parse the internal text content of files matching that extension.

Key Concept

Windows Control Panel Indexing Options File Type Filtering
Estimated Time:1m 30s
Question 1109Question

A security technician is preparing training materials to help staff recognize different security risks. Match each threat type on the left with its correct description on the right.

Click a left item, then click its matching right item

Items

Watering Hole Attack
Whaling
Dumpster Diving
Logic Bomb

Matches

Show answer & explanation

Answer

Watering Hole Attack matches compromising a frequently visited website. Whaling matches targeted phishing against high-profile executives. Dumpster Diving matches physically searching trash bins for sensitive documents. Logic Bomb matches dormant malicious code triggered by specified logical conditions.
Watering Hole Attack pairs with compromising a trusted website used by a target group. Whaling pairs with phishing aimed directly at high-level executives. Dumpster Diving pairs with looking through paper trash for confidential data. Logic Bomb pairs with malicious code designed to execute when specific criteria are met.

Step-by-Step Solution

1
Analyze the web-based attack targeting specific industry sites.
Watering Hole attack infects a third-party site frequented by employees of the target group.
Attackers exploit trust in a third-party site to compromise visitors automatically.
2
Identify the high-profile targeted social engineering email scam.
Whaling targets senior executives such as CEOs and CFOs.
Whaling is a specific category of spear phishing aimed exclusively at high-level leadership.
3
Identify the physical security threat vector.
Dumpster Diving involves looking through physical waste containers for sensitive documents.
Attackers search municipal trash for unredacted passwords, internal directories, or proprietary documents.
4
Identify the dormant condition-triggered malware.
Logic Bomb triggers malicious commands when specific events or dates occur.
Logic bombs lie dormant until predetermined parameters are met.

Key Concept

Social Engineering and Threat Vector Classification
Question 1110Question

A technician completes a motherboard replacement on a desktop computer. Upon pressing the power button, the system power LED turns on and internal cooling fans spin continuously at high speed, but no video output is displayed and the system does not produce any POST beep codes. The internal speaker is confirmed to be properly connected. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The 8-pin EPS12V CPU power connector is not plugged into the motherboard.

Answer

The 8-pin EPS12V CPU power connector is disconnected from the motherboard.
The 24-pin ATX cable supplies power to motherboard circuits, fans, and LEDs, but the CPU requires dedicated power via the 4/8-pin EPS12V connector. When the EPS12V connector is missing, the system turns on fans but cannot initialize the processor to run POST, leading to no video display and no diagnostic beeps.

Step-by-Step Solution

1
Analyze the observed symptoms
Fans run and LEDs light up (main 24-pin ATX connector provides standby and basic board power), but no POST beep codes or video output occur.
Indicates that power is reaching the motherboard chassis components, but core processing hardware is unable to execute code.
2
Evaluate hardware power architecture
Modern CPUs rely on a dedicated 4-pin or 8-pin EPS12V connection to power the CPU VRMs.
Without this dedicated power line, the CPU remains completely unpowered and cannot execute the BIOS/UEFI POST sequence.
3
Identify the primary corrective action
Connect the 8-pin EPS12V power cable from the power supply firmly into the top-left motherboard power connector.
Restores electrical power to the processor, allowing POST to proceed normally.

Key Concept

CPU Auxiliary Power Requirements during POST
Estimated Time:1m 15s
Question 1111Question

A graphic designer reports that full-color proof sheets printed on a dedicated desktop inkjet printer exhibit faint horizontal white streaks across images and slightly misaligned color edges. The ink tanks are confirmed to be full. Which TWO of the following maintenance procedures should the technician perform to resolve these print quality issues?

Select all that apply

Show answer & explanation

Answer: Run a printhead nozzle cleaning utility to clear blocked ink channels.; Perform a printhead alignment calibration through the printer software.

Answer

The technician should run a printhead nozzle cleaning utility to clear blocked ink channels and perform a printhead alignment calibration through the printer software.
Horizontal streaks across inkjet prints are caused by clogged printhead nozzles preventing ink deposition, which is cleared by running a nozzle cleaning utility. Misaligned color edges occur when printhead alignment drifts out of tolerance, which is resolved by running a printhead alignment calibration.

Step-by-Step Solution

1
Analyze the observed print quality symptoms (horizontal streaks and misaligned color borders) relative to inkjet technology.
Identified clogged nozzles causing missing ink streaks and misaligned printheads causing registration errors.
Horizontal white lines on inkjet output indicate missing dots due to dried ink in the nozzles, while misaligned edges indicate printhead misalignment across passes.
2
Select the appropriate software maintenance utilities for inkjet printers.
Initiating a nozzle cleaning cycle clears dried ink obstruction, and running alignment calibration re-aligns the printhead nozzles.
Both procedures directly target the identified physical printhead defects using standard manufacturer maintenance tools.

Key Concept

Inkjet Print Quality Troubleshooting and Printhead Maintenance
Estimated Time:1m 30s
Question 1112Question

A desktop technician needs to increase the User Account Control (UAC) notification level on a Windows workstation to 'Always notify' using the classic interface. What is the correct sequence of steps to complete this configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with opening Control Panel and selecting User Accounts, followed by clicking Change User Account Control settings, moving the slider to 'Always notify' and clicking OK, and concluding by confirming the UAC prompt with Yes.
The correct order follows standard Windows management workflow: opening the User Accounts Control Panel applet, opening the UAC settings dialog, adjusting the slider to the highest security setting and clicking OK, and finally confirming the UAC prompt to apply the system policy change.

Step-by-Step Solution

1
Open Control Panel and choose User Accounts
Accesses the Windows user management applet containing account security settings
Control Panel serves as the central administrative hub for legacy account settings
2
Select Change User Account Control settings link
Launches the User Account Control Settings dialog
This link provides direct access to the UAC slider interface
3
Adjust the slider to 'Always notify' and click OK
Configures the desired security baseline level
Moving the slider alters the security threshold before saving
4
Accept the UAC elevation warning by clicking Yes
Applies the new UAC configuration to the operating system
Modifying UAC behavior is a system-wide administrative action that requires privilege elevation confirmation

Key Concept

Windows User Account Control (UAC) configuration steps
Estimated Time:1m 0s
Question 1113Question

A help desk technician resolves an issue where a user was unable to access shared network drives following a password expiration. The technician guided the user through a domain password reset, verified that the user could access all required network folders, and confirmed that normal operations were restored. Before changing the ticket status to resolved or closed, which of the following is the MOST appropriate documentation step the technician should take?

Show answer & explanation

Answer: Document the root cause, exact resolution steps taken, and user confirmation in the ticket work log.

Answer

The technician should document the root cause, exact resolution steps taken, and user confirmation in the ticket work log.
According to CompTIA A+ operational procedures, completing an incident ticket requires entering comprehensive details into the work log—including the problem cause, specific resolution steps executed, and confirmation that the user is satisfied—before marking the ticket as resolved or closed.

Step-by-Step Solution

1
Identify the standard operating procedure for ticket lifecycle management.
Recognize that resolved incidents require complete documentation prior to ticket closure.
Complete ticketing records enable knowledge sharing, accurate reporting, and auditability.
2
Evaluate the mandatory components of a ticket resolution entry.
Determine that the entry must contain the root cause (password expiration), specific steps taken (guided password reset and drive access verification), and user confirmation.
Capturing these elements ensures the issue is verified and documented accurately.
3
Select the option reflecting thorough documentation within the ticketing system.
Documenting resolution details and user confirmation directly in the ticket work log is the correct final action.
Omitting details or escalating resolved tickets violates ticketing workflow best practices.

Key Concept

Incident Lifecycle Documentation and Ticketing Workflows
Question 1114Question

A desktop user reports that during intensive 3D rendering, the monitor periodically displays random colored specks, flickering geometric artifacts, and screen distortion. A technician takes a screenshot of the corrupted display and opens the image on a different, working computer, where the screenshot image appears completely clear without any artifacts. Which of the following is the most likely cause of this display issue?

Show answer & explanation

Answer: The graphics card video memory (VRAM) is overheating or defective.

Answer

The graphics card video memory (VRAM) is overheating or defective.
Visual artifacts such as random colored specks and geometric distortion occurring specifically during intensive graphical tasks indicate hardware-level GPU or VRAM thermal issues. The fact that a screenshot appears clean on another machine proves that the operating system and display driver generated the image frame buffer correctly, ruling out software corruption.

Step-by-Step Solution

1
Analyze the reported symptoms and test results
Visual artifacts occur specifically under heavy 3D load, and taking a screenshot produces an uncorrupted image when viewed on another system.
Screenshots capture data from the OS frame buffer before physical VRAM/GPU output conversion. An uncorrupted screenshot proves software rendering is intact and isolates the issue to physical GPU hardware/VRAM rendering output or thermal breakdown.
2
Differentiate between software and hardware video failures
The failure occurs only under heavy load and is uncaptured by OS screenshots, confirming physical hardware (GPU/VRAM) overheating or corruption.
Failing VRAM modules or GPU overheating produce characteristic artifacts like colored specks ('snow') and geometric pattern tearing.

Key Concept

Troubleshooting Video Artifacts and Hardware Failure Symptoms
Question 1115Question

A system administrator manages software permissions, service ports, credential vaults, and system processes across macOS and Linux endpoints in an enterprise environment. Match each CLI command or native operating system utility on the left with its exact administrative function or outcome on the right.

Click a left item, then click its matching right item

Items

chmod 750 /scripts/backup.sh
Keychain Access
lsof -i :8080
kill -9 4152

Matches

Show answer & explanation

Answer

chmod 750 /scripts/backup.sh matches granting rwx to owner, r-x to group, and no access to others. Keychain Access matches the native macOS security utility for passwords and certificates. lsof -i :8080 matches listing open files and processes bound to port 8080. kill -9 4152 matches sending an uncatchable SIGKILL signal to forcibly terminate PID 4152.
Each tool or command accurately matches its system function: chmod 750 assigns permissions by user tier (owner: rwx, group: r-x, others: none); Keychain Access manages macOS encrypted credentials; lsof -i :8080 inspects network-bound processes on port 8080; and kill -9 sends a SIGKILL signal to forcibly terminate the specified PID.

Step-by-Step Solution

1
Analyze octal file permissions for chmod 750
7 = rwx (4+2+1), 5 = r-x (4+0+1), 0 = --- (0+0+0). This restricts all access for 'others'.
Understanding Linux/macOS octal permission flags is required to configure file security correctly.
2
Identify the macOS security management tool
Keychain Access manages stored credentials, tokens, and certificates in macOS.
Differentiating macOS-specific system utilities from standard Unix tools.
3
Determine the network diagnostic capabilities of lsof
The lsof command lists open files; in Unix/Linux systems, open network sockets are treated as files.
The -i flag filters output by network connections and ports.
4
Evaluate process termination signals using the kill command
Signal -9 corresponds to SIGKILL, which forces process shutdown immediately.
Standard kill (SIGTERM 15) allows graceful exit, while SIGKILL cannot be caught or ignored.

Key Concept

macOS and Linux Operating System Features and Tools
Question 1116Question

A systems administrator is setting up an automated network deployment to install Windows 11 Enterprise across 200 client workstations using Preboot Execution Environment (PXE) booting and a customized image. Which of the following configuration actions must be performed to successfully prepare the network infrastructure and reference image? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the DHCP server with Option 66 and Option 67 to direct PXE-booting client computers to the TFTP boot server and specify the boot file location.; Execute sysprep.exe with the /generalize and /oobe switches on the reference computer to remove system-specific Security Identifiers (SIDs) prior to capturing the image.

Answer

The correct procedures are configuring DHCP Options 66 and 67 on the network boot server, and running sysprep.exe with /generalize and /oobe on the reference image.
For a successful PXE network deployment, DHCP Options 66 and 67 must be configured on the network so that clients know where to fetch the network boot files. Simultaneously, the reference Windows image must be generalized using sysprep.exe /generalize /oobe to strip hardware details and unique security identifiers (SIDs) before deployment.

Step-by-Step Solution

1
Identify the network requirements for PXE booting.
PXE client network boot requests require DHCP Options 66 and 67 to identify the TFTP server IP/hostname and the boot file name.
Without DHCP Options 66 and 67, PXE clients cannot locate the deployment server to download the Windows Preinstallation Environment (WinPE) image over the network.
2
Identify the master image preparation requirements.
The reference computer must be generalized using sysprep.exe with /generalize /oobe.
Sysprep strips computer-specific parameters such as SID and hardware abstraction information so the image can be duplicated onto multiple target workstations.

Key Concept

PXE Network Deployment and Image Generalization
Question 1117Question

A user on a macOS system needs to retrieve a previously saved password for a corporate Wi-Fi network. Which native macOS utility should the technician open to locate this saved credential?

Show answer & explanation

Answer: Keychain Access

Answer

Keychain Access is the correct utility because it is the central password and security certificate management application built into macOS.
Keychain Access is the built-in macOS credential management system designed to securely store and organize passwords, encryption keys, and digital certificates.

Step-by-Step Solution

1
Identify the administrative task
The requirement is to retrieve a stored password on a macOS operating system.
Different operating system tools serve distinct utility purposes.
2
Select the appropriate native macOS tool
Keychain Access stores encrypted user passwords, Wi-Fi keys, and digital certificates.
Keychain Access is specifically designed for credential storage and management.

Key Concept

macOS Security Features and Tools
Estimated Time:45s
Question 1118Question

A systems administrator is troubleshooting a newly deployed enterprise graphics application on Windows 11 workstations. Standard domain users can launch the application, but it fails whenever the software attempts to save shared project templates to its default installation directory. Additionally, the application fails to load required 32-bit legacy automation add-ins. Which of the following actions should the administrator perform to resolve these operational issues while adhering to security best practices and architecture requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Relocate the shared project templates to the ProgramData directory and grant standard users Modify permissions to that folder.; Deploy the 32-bit edition of the host application instead of the 64-bit edition to match the add-in architecture.

Answer

The administrator should relocate the shared project templates to the ProgramData folder with appropriate user permissions and deploy the 32-bit version of the host application.
The correct options address both permission restrictions and process bitness requirements. Moving user-writable files to the ProgramData folder with modified ACLs allows standard users to save files without compromising system security. Furthermore, installing the 32-bit version of the main application ensures process-level architecture compatibility with 32-bit legacy add-ins.

Step-by-Step Solution

1
Analyze the file write failure in the application directory.
Identify that default NTFS permissions on Program Files restrict standard users from write access.
Windows protects System and Program Files directories from unauthorized user modification.
2
Identify the proper location for user-modifiable shared application data.
Move shared templates to ProgramData and adjust folder ACLs.
ProgramData is designed for application configuration and shared data accessible across user sessions.
3
Analyze the add-in loading failure.
Determine that 32-bit add-ins cannot be loaded directly by a 64-bit host process.
Process architecture rules mandate matching bitness between host applications and compiled add-in modules.

Key Concept

Application installation folder permissions and bitness/architecture compatibility requirements
Question 1119Question

A tier 2 helpdesk technician receives multiple incident reports from accounting personnel stating that when navigating to an industry-specific news and regulatory updates website they visit daily, their web browsers display certificate warnings and attempt to redirect them to a fake single sign-on portal. Upon investigation, the technician confirms that internal corporate DNS server records and local workstation hosts files are unmodified and accurate. Further forensic analysis reveals that malicious code was injected directly into the external news site to target visitors originating from the company's public IP address range. Which of the following security threat types is demonstrated in this scenario?

Show answer & explanation

Answer: Watering hole attack

Answer

Watering hole attack
The correct answer identifies a watering hole attack. In this attack vector, adversaries compromise a third-party website known to be regularly visited by employees of a targeted organization. Because internal DNS and local host settings remain untouched, the malicious redirection originates directly from the compromised external site targeting visitors from specific corporate IP blocks.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario.
The target website is a legitimate, trusted external site frequently visited by the specific group of users (accounting department).
Threat actors strategically identify websites commonly trusted and frequented by their target organization.
2
Evaluate the technical findings and delivery mechanism.
DNS resolution and local host configurations are intact, proving the redirection originates from malicious code injected into the compromised third-party site targeting specific public IP addresses.
Watering hole attacks selectively serve malicious payloads or redirects based on the visitor's IP range or enterprise profile.
3
Identify the matching social engineering/threat classification.
Compromising a common trusted resource to ambush specific organization members matches the definition of a watering hole attack.
This strategy bypasses traditional perimeter defenses by exploiting trust in an external resource.

Key Concept

Watering Hole Attack Identification
Question 1120Question

A field technician is servicing a Windows 11 desktop that frequently displays system error messages following an improper shutdown. The technician runs `sfc /scannow` from an elevated Command Prompt, which completes with the status message: 'Windows Resource Protection found corrupt files but was unable to fix some of them.' Which of the following commands should the technician execute next to repair the local component store so that system file repair can succeed?

Show answer & explanation

Answer: dism /online /cleanup-image /restorehealth

Answer

Execute the command `dism /online /cleanup-image /restorehealth` from an elevated Command Prompt.
When System File Checker (`sfc /scannow`) reports that it found corrupted files but was unable to fix them, it indicates that the cached backup copies within the Windows Component Store (`%WinDir%\WinSxS`) are also damaged. Running `dism /online /cleanup-image /restorehealth` connects to Windows Update (or a designated servicing source) to repair the corrupted component store files. Once DISM completes, running `sfc /scannow` a second time will successfully repair the operating system files.

Step-by-Step Solution

1
Analyze the System File Checker (SFC) output
SFC detected corrupted files but could not repair them because its source payload inside the Windows Component Store (WinSxS) is also corrupted.
SFC relies on a healthy Component Store to pull known-good replacement copies of corrupted operating system files.
2
Run DISM to repair the Component Store
Executing `dism /online /cleanup-image /restorehealth` scans the component store for corruption and automatically downloads healthy replacement files from Windows Update.
Restoring the health of the component store satisfies SFC's prerequisite for repairing protected system files.
3
Re-run System File Checker
Running `sfc /scannow` again will now successfully replace the corrupted system files using the newly repaired component store.
Completes the two-step repair process for Windows system file corruption.

Key Concept

DISM and SFC Repair Sequence for Windows File Corruption
Estimated Time:1m 15s
PreviousPage 56 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin