All practice questions

3551 questions

Question 1181Question

A desktop support specialist is performing routine administration on a Windows 11 Pro workstation configured as a localized file host. The specialist needs to perform two specific administrative tasks:
1. View all active incoming SMB network connections and forcibly disconnect files currently locked open by remote workgroup users.
2. Generate and export a complete hardware environment summary that includes the exact BIOS/UEFI firmware version and system motherboard manufacturer.

Which of the following native Windows administrative tools should the specialist use to complete these tasks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Shared Folders snap-in (fsmgmt.msc); System Information utility (msinfo32.exe)

Answer

The Shared Folders snap-in (fsmgmt.msc) and System Information utility (msinfo32.exe) are the required management tools.
The Shared Folders snap-in (fsmgmt.msc) allows administrators to manage active remote SMB sessions, view files locked by network users, and close open files. The System Information utility (msinfo32.exe) provides a centralized overview of system hardware specifications—including BIOS/UEFI version, motherboard manufacturer, and memory layout—and supports exporting the data to a report file.

Step-by-Step Solution

1
Identify the utility for inspecting remote SMB user sessions and open files.
Determine that the Shared Folders snap-in (fsmgmt.msc) or Computer Management console contains the Sessions and Open Files nodes to view active SMB connections and forcibly disconnect locked files.
Shared Folders specifically manages local SMB shares, active sessions, and file locks.
2
Identify the utility for generating and exporting system firmware and motherboard hardware details.
Determine that System Information (msinfo32.exe) aggregates BIOS/UEFI version, baseboard manufacturer, HAL, and hardware resources into an exportable text summary.
msinfo32.exe is designed for detailed configuration auditing and reporting.

Key Concept

Windows Administrative Management Consoles and Information Utilities
Question 1182Question

An administrative assistant attempts to print a multi-page PDF document to a newly deployed network printer. Instead of printing the document contents, the printer continuously feeds paper and outputs dozens of pages containing random symbols, unreadable characters, and raw programming code. Which of the following is the most likely root cause of this issue?

Show answer & explanation

Answer: An incompatible or incorrect print driver is installed on the user's workstation.

Answer

An incompatible or incorrect print driver is installed on the user's workstation.
When a workstation uses an incompatible print driver (such as sending PostScript commands to a printer that only understands PCL), the printer cannot process the incoming stream as graphical instructions. Instead, it prints the raw control codes, resulting in pages filled with garbled text, symbols, and unreadable output.

Step-by-Step Solution

1
Analyze the reported symptom.
The printer hardware operates normally and feeds paper, but prints endless streams of random characters and symbols.
This behavior indicates that the printer is receiving data formatted in a Page Description Language (PDL) it does not understand, causing it to print the raw code.
2
Identify the component responsible for converting print jobs into printer language.
The client-side print driver converts document data into formats such as PostScript or PCL.
If a generic or wrong driver (e.g., PostScript driver sent to a PCL-only printer) is configured, the data stream will be misinterpreted.
3
Select the appropriate resolution step.
Installing the official, model-specific printer driver resolves the formatting mismatch.
Ensuring the client driver matches the printer's supported PDL allows valid print jobs to render correctly.

Key Concept

Printing garbled text or symbols is caused by an incorrect or corrupted print driver mismatched with the printer's Page Description Language (PDL).
Estimated Time:1m 30s
Question 1183Question

A network technician is troubleshooting a Windows client workstation that lost network and internet access following a local router maintenance task. The technician needs to follow a standard, inside-out command-line diagnostic process to isolate the failure point.

Place the following Windows command-line actions in the correct logical troubleshooting order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical troubleshooting sequence is: 1) Run `ipconfig /all` to inspect local interface configuration, 2) Run `ping 127.0.0.1` to verify internal TCP/IP stack integrity, 3) Run `ping 192.168.1.1` to test local gateway reachability, 4) Run `nslookup www.example.com` to check DNS name resolution, and 5) Run `tracert 8.8.8.8` to trace the external network path.
Systematic network troubleshooting follows an inside-out progression: first verify local adapter configuration details (`ipconfig /all`), validate internal TCP/IP software stack operation (`ping 127.0.0.1`), verify local gateway reachability (`ping 192.168.1.1`), test DNS host resolution (`nslookup`), and finally trace path hops to remote destinations (`tracert`).

Step-by-Step Solution

1
Inspect local client IP configuration
Retrieve IP address, subnet mask, default gateway, and DNS server details using `ipconfig /all`.
You must establish whether the machine has acquired valid networking parameters before generating diagnostic network traffic.
2
Verify internal protocol stack operation
Send ICMP echo requests to `127.0.0.1`.
Confirms that the internal network adapter software stack and protocol drivers are operational.
3
Verify local area network segment reachability
Send ICMP echo requests to the default gateway IP (`192.168.1.1`).
Tests physical cabling/wireless links and local router interface responsiveness.
4
Test domain name resolution service
Query host names using `nslookup www.example.com`.
Determines whether network issues stem from DNS resolution failures versus IP connectivity issues.
5
Isolate external WAN routing failure points
Trace network hops to a public IP using `tracert 8.8.8.8`.
Identifies the exact external gateway or hop where traffic is delayed or dropped.

Key Concept

Command-Line Network Diagnostic Workflow
Question 1184Question

A security technician is investigating a series of compromised user credentials in the accounting department. The investigation reveals that affected employees attempted to navigate to the corporate vendor portal at `vendorportal.com`, but accidentally mistyped the web address as `venderportal.com`. The misspelled website presented an identical mirrored login interface that captured the employees' domain credentials. Which of the following social engineering attack types best describes this threat?

Show answer & explanation

Answer: Typosquatting

Answer

Typosquatting
Typosquatting (also known as URL hijacking) is a form of social engineering where an attacker registers domain names that are common misspellings of legitimate websites. When users accidentally mistype the URL, they are directed to a malicious site designed to steal credentials or deliver malware.

Step-by-Step Solution

1
Analyze the attack mechanism presented in the scenario.
The attack relies on users accidentally making typing errors when entering a legitimate domain URL (`vendorportal.com` vs `venderportal.com`).
Identifying how the victim arrived at the malicious site determines the vector.
2
Evaluate the delivery method against social engineering threat classifications.
Registering common mistyped variants of popular or corporate domain names to host fake credential-harvesting sites is known as typosquatting or URL hijacking.
Matching the characteristic behavior to standard CompTIA threat definitions isolates the correct term.

Key Concept

Typosquatting (URL Hijacking)
Estimated Time:1m 0s
Question 1185Question

A network technician needs to manually configure a static IPv4 address, subnet mask, default gateway, and primary DNS server on a Windows 11 client workstation using the Command Prompt. Which sequence of steps must the technician perform from first to last to complete and verify this configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with launching an elevated Command Prompt, identifying the target interface name using `netsh interface ipv4 show interfaces`, applying the static IP address and default gateway, assigning the static DNS server address, and finally executing `ipconfig /all` to verify the configuration.
Configuring static IP settings on Windows via netsh requires administrative privileges, which must be obtained first. Next, querying active interfaces ensures the correct adapter name is targeted in netsh syntax. Setting the primary IPv4 address, subnet mask, and default gateway precedes setting the DNS server address. Finally, verification via `ipconfig /all` confirms that all settings have taken effect.

Step-by-Step Solution

1
Elevate Command Prompt permissions
Administrator Command Prompt window opened
Administrative rights are required to write changes to Windows network interface properties.
2
Query network interface names
Target interface name (e.g., 'Ethernet') confirmed
The netsh command requires an explicit interface name parameter.
3
Set static IPv4 address, subnet, and default gateway
IP addressing properties assigned to interface
Establishes basic IP Layer 3 connectivity properties on the client.
4
Set primary static DNS server
DNS server IP assigned to interface
Configures name resolution services for the static adapter profile.
5
Verify applied settings
ipconfig output confirms all configuration parameters
Validates that settings were correctly committed to the Windows networking stack.

Key Concept

Windows Client Netsh IPv4 and DNS Configuration
Question 1186Question

A system administrator is updating a company laptop from 64-bit Windows 10 Home to 64-bit Windows 11 Pro to enable BitLocker drive encryption and Active Directory domain integration. The administrator needs to preserve all existing user data, personal settings, and installed applications without wiping the drive. Which procedure should the administrator use to complete this upgrade?

Show answer & explanation

Answer: Upgrade the OS edition by entering a valid Windows Pro product key in Activation Settings, and then execute the Windows 11 setup program to perform an in-place upgrade.

Answer

Upgrade the OS edition by entering a valid Windows Pro product key in Activation Settings, and then execute the Windows 11 setup program to perform an in-place upgrade.
Upgrading the OS edition from Home to Pro by entering a Pro product key in Activation Settings allows an in-place transition without data loss. Following this with an in-place upgrade to Windows 11 Pro retains all user settings, applications, and files.

Step-by-Step Solution

1
Identify the edition and architecture upgrade requirements.
The target OS is 64-bit Windows 11 Pro starting from 64-bit Windows 10 Home, requiring an edition upgrade alongside the OS version upgrade.
In-place upgrades between matching 64-bit architectures preserve user files, settings, and applications.
2
Perform an edition upgrade from Home to Pro within Settings.
Entering a valid Pro product key unlocks Windows Pro features such as BitLocker and Active Directory domain join without reinstallation.
Windows supports direct, non-destructive edition upgrades via product key activation.
3
Run the Windows 11 Setup executable to perform the OS version upgrade.
The system upgrades to Windows 11 Pro while retaining all user profiles, configurations, and installed applications.
In-place version upgrades retain existing software and data when upgrading along supported upgrade paths.

Key Concept

Windows OS Edition and Version In-Place Upgrade Paths
Question 1187Question

Match each enterprise wireless security role to its correct function within an 802.1X network infrastructure.

Click a left item, then click its matching right item

Items

Supplicant
Authenticator
Authentication Server

Matches

Show answer & explanation

Answer

Supplicant matches Client software or endpoint requesting access; Authenticator matches Wireless Access Point (WAP) relaying EAP messages; Authentication Server matches RADIUS server validating user credentials.
In an 802.1X architecture, the Supplicant requests network access, the Authenticator (WAP) relays authentication traffic, and the Authentication Server (RADIUS) evaluates credentials against the centralized database.

Step-by-Step Solution

1
Identify the endpoint requesting connectivity.
The client device operating on the wireless network is defined as the Supplicant.
In the 802.1X standard, the device seeking network admission is the supplicant.
2
Identify the intermediary network device controlling access.
The Wireless Access Point serves as the Authenticator.
The access point acts as a gatekeeper, relaying EAPOL packets from the client to RADIUS format for the server.
3
Identify the database authority issuing authentication decisions.
The central server running RADIUS functions as the Authentication Server.
The AAA/RADIUS server compares submitted credentials against directory services like Active Directory to grant or deny access.

Key Concept

802.1X Wireless Framework Roles
Question 1188Question

A system administrator is reviewing recent security incident reports involving distinct social engineering tactics across different corporate departments. Match each specific incident scenario on the left with the correct social engineering threat classification on the right.

Click a left item, then click its matching right item

Items

An adversary injects malicious client-side code into a niche regional trade publication website routinely visited by the company's research team, causing visitors' browsers to silently download a payload.
An adversary contacts a database engineer via telephone while assuming a fabricated identity as a third-party compliance auditor, using fake audit ticket numbers to persuade the engineer to provide internal schema details.
An adversary registers a web domain that replaces the letter 'o' with a '0' in the company's Single Sign-On (SSO) login portal URL, successfully capturing credentials from employees who miskey the address.
An adversary sends a tailored, highly specific email to the Chief Financial Officer's executive assistant, referencing an ongoing confidential acquisition to trick the assistant into opening a weaponized file attachment.

Matches

Show answer & explanation

Answer

Watering Hole Attack matches the trade publication injection scenario; Pretexting matches the phone call with a fabricated auditor identity; Typosquatting matches the slightly miskeyed SSO portal domain; Spear Phishing matches the highly targeted email to the executive assistant.
Each attack scenario aligns with a specific CompTIA A+ threat definition based on its vector and mechanism: watering hole attacks leverage compromised frequented websites; pretexting relies on a invented background/persona; typosquatting relies on domain mistyping; and spear phishing uses customized targeted email content.

Step-by-Step Solution

1
Analyze the trade publication injection scenario.
Identified as a Watering Hole Attack because the attacker compromised a trusted third-party website frequently visited by a specific targeted demographic.
Watering hole attacks target specific groups by infecting websites they naturally frequent rather than targeting them directly.
2
Analyze the phone call scenario involving the fake auditor identity.
Identified as Pretexting because the attacker created a complex scenario and fake persona to build trust and extract internal data.
Pretexting relies on crafting a deceptive story or persona to manipulate someone into releasing information.
3
Analyze the misspelled SSO portal domain scenario.
Identified as Typosquatting (URL hijacking) due to deliberate domain registration matching common typing errors.
Typosquatting exploits human typographical errors when entering web addresses into browsers.
4
Analyze the customized email scenario sent to the executive assistant.
Identified as Spear Phishing because it is a tailored email attack targeted at a specific individual using specific internal context.
Spear phishing differs from mass phishing by customizing content for high-value individuals or specific personnel within an organization.

Key Concept

Distinguishing distinct social engineering vector characteristics and attack methodologies in corporate IT environments.
Estimated Time:2m 0s
Question 1189Question

A desktop support technician is configuring a dedicated Windows 11 workstation for a CAD drafting station. The user requires a non-standard custom paper size (form) that must be available across all installed print drivers on the system. Which Control Panel applet allows the technician to select an installed printer and open Print Server Properties to create system-wide custom paper forms?

Show answer & explanation

Answer: Devices and Printers

Answer

Devices and Printers provides access to Print Server Properties, allowing administrators to define custom paper forms system-wide.
In Windows, accessing the Devices and Printers Control Panel applet allows a user to select an existing printer and click 'Print Server Properties' from the top toolbar. From there, administrators can define custom paper form sizes that become available across all installed print drivers on the operating system.

Step-by-Step Solution

1
Identify the Control Panel utility responsible for managing peripheral hardware and printing interfaces.
Devices and Printers is identified as the central management applet for printers and print options.
Print management tasks at the user interface level are handled via the Devices and Printers applet.
2
Locate the administrative tool interface for global print settings.
Selecting a printer in Devices and Printers exposes the 'Print Server Properties' button on the menu bar.
Print Server Properties is where global forms, drivers, and ports are created and assigned.
3
Select the option that matches this Control Panel location.
Devices and Printers is selected as the correct answer.
It is the only utility among the options that hosts Print Server Properties.

Key Concept

Windows Control Panel Devices and Printers Utility
Question 1190Question

During a security audit at a financial consulting firm, a technician discovers that multiple workstations in the payroll department were infected with stealth malware. Logs show that all compromised users routinely visit an obscure, third-party state tax regulation portal to verify daily compliance updates. An attacker secretly compromised this trusted external portal and injected code that automatically redirects visiting payroll staff to a server hosting an exploit kit, executing malicious code on unpatched web browsers without requiring any user interaction or email link clicks. Which of the following attack vectors best describes this incident?

Show answer & explanation

Answer: Watering hole attack

Answer

The attack vector described in the scenario is a watering hole attack.
A watering hole attack occurs when an attacker identifies a website frequently visited by members of a targeted group or organization, compromises that site, and plants malicious code to infect visitors' systems. In this scenario, compromising the third-party state tax regulation portal to infect payroll staff automatically upon visiting aligns precisely with a watering hole attack.

Step-by-Step Solution

1
Analyze the attack mechanism described in the incident report.
Identified that the attacker did not send direct messages or rely on user typing errors, but instead compromised a legitimate third-party website frequently used by a targeted group (payroll staff).
Understanding how the initial compromise occurred isolates the specific social engineering threat category.
2
Evaluate the delivery method of the exploit.
The exploit was delivered automatically upon visiting the compromised industry site via an exploit kit, taking advantage of a trusted user environment.
Targeting a trusted website frequented by a specific demographic is the defining characteristic of a watering hole attack.
3
Compare against alternative attack classifications.
Eliminated spear phishing (requires targeted messaging), pretexting (requires direct social interaction/manipulation), and typosquatting (requires domain misspelling).
Differentiating attack indicators ensures accurate threat classification and appropriate mitigation planning.

Key Concept

Watering Hole Attack
Estimated Time:2m 0s
Question 1191Question

A helpdesk technician has successfully scanned and removed a malware infection from a user's Windows workstation. Which TWO actions should the technician perform next to complete the final steps of the CompTIA standard malware remediation process? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable System Restore and create a new restore point.; Educate the end user on security awareness and safe browsing practices.

Answer

The technician must enable System Restore and create a new restore point, and also educate the end user on safe browsing practices.
According to the CompTIA standard 7-step malware remediation process, once malware is successfully removed and software updates are scheduled, the final procedures are to re-enable System Restore and create a clean restore point, followed by educating the end user on security best practices.

Step-by-Step Solution

1
Identify the remaining required steps in the CompTIA 7-step malware removal process following malware remediation.
The final steps in the official process are scheduling updates, enabling System Restore / creating a restore point (Step 6), and educating the end user (Step 7).
These steps ensure long-term system recovery capability and prevent recurring infection through user awareness.
2
Match the required process steps to the valid options.
Re-enabling System Restore with a clean restore point and conducting end-user education are the correct actions.
Both actions directly correspond to steps 6 and 7 of the CompTIA 7-step remediation process.

Key Concept

CompTIA 7-Step Malware Remediation Process
Question 1192Question

A field technician is setting up network equipment inside an Intermediate Distribution Frame (IDF) closet located in a public hallway of a multi-tenant facility. Because the closet door must remain unlocked during business hours to comply with local building regulations, the technician needs to secure the physical hardware itself from unauthorized physical extraction and prevent unauthorized Ethernet connections. Which of the following physical security controls should the technician implement?

Show answer & explanation

Answer: Install lockable equipment enclosures and physical RJ-45 port locks

Answer

Installing lockable equipment enclosures and physical RJ-45 port locks directly secures the hardware inside the unlocked room from physical theft and blocks unauthorized physical connections.
Lockable rack enclosures prevent unauthorized removal of network switches from the rack frame, and RJ-45 port locks physically restrict insertion of cables into open ports. Together, these measures secure hardware and ports even when the room itself cannot be locked.

Step-by-Step Solution

1
Analyze the physical security threat in the scenario.
The equipment is exposed in an unlocked room where unauthorized individuals could physically steal devices or plug into open network ports.
Identifying the specific threat vector dictates which physical controls are appropriate.
2
Evaluate the controls that prevent physical extraction and unauthorized port access.
Lockable equipment enclosures prevent unauthorized removal of hardware from server racks, and RJ-45 port locks block open ports from unauthorized cable insertion.
These controls provide direct active physical deterrence against theft and unauthorized network connection.

Key Concept

Physical Hardware and Port Security Controls
Estimated Time:1m 0s
Question 1193Question

A Linux technician is attempting to establish a remote administration session using a custom private key stored at `~/.ssh/id_rsa`. Upon executing the authentication command `ssh -i ~/.ssh/id_rsa [email protected]`, the terminal rejects the key and terminates the connection, displaying a warning that the private key file permissions of `0777` are too open and unprotected. Which of the following commands must the technician execute to assign the proper restrictive permissions so that SSH accepts the key file?

Show answer & explanation

Answer: chmod 600 ~/.ssh/id_rsa

Answer

The technician must run 'chmod 600 ~/.ssh/id_rsa' to grant read and write permissions exclusively to the file owner.
SSH clients enforce strict file mode checks on private key files to protect cryptographic credentials. The command 'chmod 600 ~/.ssh/id_rsa' grants read (4) and write (2) privileges solely to the file owner, while setting group and world permissions to 0. This removes all external access and satisfies SSH security validation.

Step-by-Step Solution

1
Analyze the SSH client error requirement
SSH clients strictly refuse private key files accessible by other user accounts on the local system.
Open permissions (such as 0777 or 0644) expose sensitive private key material to unauthorized system users.
2
Determine the required permission bits in octal format
The file owner needs read (4) and write (2) access (summing to 6), while group (0) and world (0) must have zero access.
The 600 permission profile enforces owner-only access without unnecessary executable attributes.
3
Select the proper command syntax to change permissions
Executing 'chmod 600 ~/.ssh/id_rsa' updates the file mode.
The 'chmod' utility modifies file access control bits in Unix-like operating systems.

Key Concept

Linux file permission management and SSH client identity security standards
Estimated Time:1m 30s
Question 1194Question

A desktop technician is hardening standalone Windows 11 Pro workstations. The security policy mandates that administrative users must explicitly re-enter their credentials on the Secure Desktop whenever an application requests elevated privileges. In what sequence should the technician perform the steps to configure this behavior via Local Security Policy?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is to first open the Run dialog box and launch secpol.msc, then navigate to Local Policies > Security Options, next open User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode, and finally select Prompt for credentials on the secure desktop and click OK.
To enforce credential prompting for administrators on the Secure Desktop, the technician must first access the Local Security Policy console via secpol.msc. From there, expanding Local Policies and clicking Security Options brings up UAC policy settings. Opening 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' allows changing the default consent behavior to 'Prompt for credentials on the secure desktop'.

Step-by-Step Solution

1
Launch the Local Security Policy console
The secpol.msc console window opens.
Administrative security options such as UAC elevation behaviors are managed through the Local Security Policy console.
2
Navigate to the Security Options node
The panel displays security policies related to account behavior and UAC settings.
User Account Control policies reside under Local Policies > Security Options in the console hierarchy.
3
Select the administrator elevation policy
The properties dialog window for administrator elevation prompts opens.
The policy named 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' explicitly targets administrator elevation responses.
4
Configure the dropdown option to prompt for credentials on the secure desktop
The policy is updated to require full credential entry on the dimmed Secure Desktop whenever elevation is requested.
This setting enforces re-authentication on the Secure Desktop to prevent automated malware privilege escalation.

Key Concept

Configuring User Account Control elevation policy settings using secpol.msc
Question 1195Question

A help desk technician needs to display the full contents of a plain text configuration file directly within a Linux terminal window without opening an interactive editor. Which of the following commands should the technician use?

Show answer & explanation

Answer: cat

Answer

The cat command should be used to display the contents of a file in the terminal.
The command 'cat' (short for concatenate) is standard in Linux and macOS terminals for printing the complete contents of one or more text files straight to standard output.

Step-by-Step Solution

1
Identify the administrative requirement
The technician needs to print out the complete text of a configuration file directly to the terminal output stream.
The task specifies displaying text without opening an interactive text editor like nano or vi.
2
Select the appropriate Linux utility
The cat utility outputs file content directly to standard output.
Running 'cat filename' reads and prints the file text cleanly into the terminal session.

Key Concept

Linux Terminal Command Usage for File Inspection
Question 1196Question

A network administrator is evaluating authentication methods and security protocols for a corporate wireless network deployment. Match each wireless security protocol or framework on the left with its defining technical requirement or operational feature on the right.

Click a left item, then click its matching right item

Items

EAP-TLS
PEAP / EAP-TTLS
WPA3-Personal (SAE)
802.1X with RADIUS

Matches

Show answer & explanation

Answer

EAP-TLS matches mutual certificate authentication; PEAP / EAP-TTLS matches tunneled authentication with server-side certificates; WPA3-Personal (SAE) matches key exchange resistant to offline dictionary attacks; 802.1X with RADIUS matches centralized port-based access control.
Each protocol or framework is accurately paired with its primary technical requirement: EAP-TLS relies on mutual certificates, PEAP/EAP-TTLS tunnels password authentication via a server certificate, WPA3-Personal employs SAE to protect against dictionary attacks, and 802.1X with RADIUS provides centralized port-based network authentication.

Step-by-Step Solution

1
Identify the authentication requirements for mutual certificate-based EAP frameworks.
EAP-TLS requires certificates installed on both the client and server for mutual authentication.
EAP-TLS is uniquely defined by dual-sided certificate verification.
2
Differentiate tunneled EAP methods that simplify client onboarding.
PEAP and EAP-TTLS require only a server certificate to establish a secure tunnel for user credentials.
This avoids managing client-side certificates while securing password transmission.
3
Analyze key authentication mechanisms in modern WPA3 standards.
WPA3-Personal uses SAE (Simultaneous Authentication of Equals) to protect pre-shared key exchanges.
SAE provides forward secrecy and protects against offline password guessing.
4
Determine the overarching access control architecture for enterprise wireless networks.
802.1X with RADIUS handles port-based access control and relays EAP packets to a centralized directory server.
802.1X acts as the authentication framework transport mechanism.

Key Concept

Wireless Authentication Frameworks and Protocol Characteristics
Question 1197Question

A user reports that an office desktop PC fails to complete the boot process after being relocated to a different desk. When the power button is pressed, the system power LED illuminates and internal cooling fans spin normally, but no video output appears on the monitor and the system emits a continuous series of repeating short beeps. Which of the following components is most likely unseated or failing?

Show answer & explanation

Answer: System RAM module

Answer

System RAM module
The correct answer identifies the system RAM module. During POST, if the motherboard BIOS/UEFI cannot detect or properly initialize memory, it halts the boot process before initializing the display adapter and emits a designated audible beep code sequence. Relocating equipment frequently causes slightly loose RAM modules to shift out of proper pin alignment.

Step-by-Step Solution

1
Analyze the symptoms reported during system startup.
The system powers on and fans operate, but video output is absent and audible POST beep codes are produced.
Audible beep codes are generated by the motherboard firmware during the Power-On Self-Test (POST) to report critical hardware initialization failures.
2
Interpret the specific POST error code pattern.
A continuous or repeating short beep pattern indicates a critical failure in detecting or initializing memory (RAM).
Physical movement during relocation often dislodges loosely latched RAM modules from their slots.
3
Determine the appropriate diagnostic and corrective action.
Reseat or replace the system RAM module.
Ensuring proper physical contact in memory slots resolves POST memory identification errors.

Key Concept

Power-On Self-Test (POST) Diagnostics and Memory (RAM) Troubleshooting
Question 1198Question

A desktop technician is troubleshooting a Windows 11 Pro workstation experiencing severe storage performance degradation. The technician needs to identify in real time which specific executable process and associated file paths are causing the highest disk read and write throughput. Which Windows administrative utility should the technician use to inspect this process-level and file-level disk activity?

Show answer & explanation

Answer: Resource Monitor

Answer

Resource Monitor is the correct utility for viewing real-time disk activity broken down by process and active file paths.
Resource Monitor provides a detailed real-time view of hardware resource usage. Its Disk tab specifically shows processes with disk activity, active disk response times, and the exact target file paths currently being written to or read from.

Step-by-Step Solution

1
Analyze the technical requirement.
The technician needs real-time process identification alongside active file path I/O metrics.
Standard Task Manager shows total disk usage percentage per process, but does not display specific file paths or detailed disk queue breakdowns per file.
2
Evaluate Windows Administrative Management Tools.
Resource Monitor (resmon.exe) features a dedicated Disk tab that breaks down Disk Activity by executable name, PID, file path, read/write B/sec, and total B/sec.
This allows isolation of the exact application and file responsible for system storage degradation.

Key Concept

Selecting the appropriate Windows administrative tool for real-time resource analysis
Question 1199Question

A systems administrator deleted a folder containing confidential financial spreadsheets from a Windows workstation's local storage (`C:\Confidential`). To meet compliance standards, the administrator must ensure that any residual data in the unallocated space of that directory is permanently overwritten without reformatting the drive or affecting existing files. Which of the following command-line utilities and switches should the administrator execute?

Show answer & explanation

Answer: cipher /w:C:\Confidential

Answer

The command 'cipher /w:C:\Confidential' correctly overwrites unused unallocated disk space within the specified path without modifying active files or formatting the partition.
The correct command uses 'cipher /w:directory', which securely wipes unallocated disk space in the designated directory by overwriting free sectors with zero bytes, one bytes, and random numbers. This ensures deleted files cannot be reconstructed using forensic recovery utilities while preserving all active files.

Step-by-Step Solution

1
Identify the administrative goal and constraints
The requirement is to sanitize residual unallocated space left by deleted files on a specific folder path on a Windows system without formatting the volume.
Standard file deletion in Windows only removes pointers from the file system table while leaving data payload in unallocated sectors until overwritten.
2
Evaluate native Windows command-line options for securely wiping unallocated space
The Windows Cipher utility (`cipher.exe`) with the `/w` switch overwrites deallocated/free space across specified directories.
Executing 'cipher /w:directory' writes three passes (zeros, ones, and random numbers) to the unallocated space of the designated folder, rendering deleted files unrecoverable.

Key Concept

Microsoft Windows Command-Line Utilities - Cipher Utility Data Sanitization
Question 1200Question

A technician is reviewing incident reports following a security breach at a branch office. According to the investigation, an attacker called several employees pretending to be internal IT support to solicit user credentials over the telephone. Later that afternoon, the attacker entered the restricted server facility without a badge by closely following a worker who held the door open out of courtesy. Which of the following social engineering threat types were directly demonstrated in this scenario? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Vishing; Piggybacking

Answer

The correct threat types demonstrated in the incident are vishing and piggybacking.
The scenario describes two distinct attacks: soliciting credentials over the phone (voice phishing or vishing) and gaining physical entry into a secure building by relying on an employee to hold the door open (piggybacking).

Step-by-Step Solution

1
Analyze the phone-based attack vector described in the incident report.
Impersonating IT personnel over the telephone to solicit credentials matches the definition of voice phishing (vishing).
Vishing specifically relies on voice communications to conduct social engineering attacks.
2
Analyze the physical access vector described in the incident report.
Entering a physical security perimeter by having an authorized employee hold the door open constitutes piggybacking.
Piggybacking relies on social courtesy to gain access behind an authorized badge holder.

Key Concept

Identifying social engineering attack vectors across voice and physical channels
PreviousPage 60 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin