Examkin

All practice questions

3551 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 1221Question →

A technician is troubleshooting a desktop computer that experiences sudden thermal shutdowns during high CPU processing tasks. The technician suspects improper thermal interface material application and heatsink mounting. Place the following remediation steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence begins with gathering baseline temperature metrics in UEFI/BIOS, discharging flea power after removing power cables, detaching and cleaning the CPU/heatsink surfaces, applying new thermal paste and securing the cooler, and finally stress testing the system to verify thermal stability.
CompTIA hardware troubleshooting methodology requires establishing baseline symptoms first (UEFI hardware monitoring), ensuring safety by cutting power and draining flea power second, performing physical surface preparation and reinstallation third, and finally verifying repair integrity under load.

Step-by-Step Solution

1
Check baseline metrics in UEFI/BIOS
Confirms abnormal idle/load temperatures prior to disassembly.
Establishes a diagnostic baseline according to CompTIA troubleshooting methodology.
2
Disconnect power and drain flea power
Prevents electrical shock and damage to sensitive internal motherboard circuitry.
Safety procedures mandate complete power removal before physical component handling.
3
Unmount cooling unit and clean contact surfaces
Removes old, dried, or improperly applied thermal paste.
Clean metallic surfaces are necessary for optimal thermal transfer.
4
Reapply thermal paste and reinstall heatsink
Restores efficient heat dissipation path from CPU die to heatsink fins.
Correct compound volume and even mounting pressure eliminate thermal gaps.
5
Reboot system and perform load testing
Verifies that CPU temperatures stay within safe operating limits under full load.
Confirming full functionality under stress ensures permanent resolution.

Key Concept

CPU Thermal Management and Safe Component Replacement Procedures
Estimated Time:1m 30s
Question 1222Question →

A Tier 2 support technician is assigned an escalated incident regarding a department-wide network authentication failure. The technician isolates the root cause to an expired digital certificate on the enterprise RADIUS server, installs a renewed certificate, and verifies connectivity by successfully authenticating a test account. The technician then enters detailed technical notes into the work history field describing the issue, root cause, and remediation steps. To strictly follow standard ticketing system workflow and ITIL operational practices, which of the following actions must the technician complete NEXT prior to transitioning the ticket to the Closed state?

Show answer & explanation

Answer: Obtain explicit confirmation from the affected users or designated department point of contact that normal service has been restored.

Answer

Obtain explicit confirmation from the affected users or designated department point of contact that normal service has been restored.
In standardized ticketing workflows, once technical resolution and internal testing are complete, the technician must verify service restoration with the impacted end user or business unit representative. Only after user verification is logged should the ticket be formally transitioned to Closed status.

Step-by-Step Solution

1
Identify the current stage of the ticket lifecycle.
The technician has performed technical troubleshooting, applied the resolution (certificate renewal), verified functionality using a test account, and documented technical work notes.
Establishing the current workflow step determines what requirement remains before ticket finalization.
2
Evaluate standard ITIL and CompTIA ticketing workflow closure criteria.
Before moving an incident ticket from Resolved to Closed, the service desk standard operating procedure requires user confirmation of service restoration and user satisfaction verification.
Technician-side testing verifies functional repair, but user verification ensures business functionality is restored without secondary issues.
3
Select the correct mandatory next step in the workflow.
Contact the end user or client representative to obtain formal verification of resolution before setting the ticket state to Closed.
Closing tickets without end-user verification leads to premature closure of incomplete issues.

Key Concept

Incident Lifecycle and Ticket Closure Verification Workflow
Estimated Time:1m 30s
Question 1223Question →

A systems administrator is configuring local security policies on standalone Windows 11 Pro workstations in a multi-user clinical environment. Management requires that when a workstation is locked or restarted, the sign-in screen must not display the account name or email address of the user who previously logged in. Which setting within Local Security Policy (`secpol.msc`) must the administrator enable to satisfy this requirement?

Show answer & explanation

Answer: Interactive logon: Don't display last signed-in

Answer

Interactive logon: Don't display last signed-in
Enabling 'Interactive logon: Don't display last signed-in' within Local Security Policy (`secpol.msc` under Local Policies > Security Options) ensures Windows will not display the username, full name, or email address of the account that last signed in. This requires any user approaching the workstation to type both their username and password to log in.

Step-by-Step Solution

1
Identify the administrative tool needed for local security configuration.
Open Local Security Policy (`secpol.msc`).
Security policy configurations for local account display and interactive logon are managed within Local Security Policy.
2
Navigate to the Security Options policy container.
Expand Local Policies and select Security Options.
Security Options contains policies governing interactive logon behaviors and User Account Control parameters.
3
Locate and configure the target logon privacy policy.
Enable 'Interactive logon: Don't display last signed-in'.
Enabling this setting ensures that the sign-in screen remains blank until a user explicitly enters their full credentials.

Key Concept

Local Security Policy Interactive Logon Settings
Question 1224Question →

A system administrator is troubleshooting a hung application named app_service.exe on a Windows workstation. Working exclusively from an elevated Command Prompt, the administrator needs to identify the Process Identifier (PID) of the non-responsive process and then forcefully terminate it along with any child processes it launched. Which of the following commands should the administrator use to accomplish these tasks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: tasklist /fi "imagename eq app_service.exe"; taskkill /pid [PID] /f /t

Answer

The administrator should run 'tasklist /fi "imagename eq app_service.exe"' to identify the PID, followed by 'taskkill /pid [PID] /f /t' to terminate the process and its child processes.
To identify the process PID from the command line, the tasklist utility with the filter flag (/fi) is used to locate 'imagename eq app_service.exe'. To forcefully terminate that process along with all of its child processes, the taskkill command with the /pid flag, /f (force), and /t (tree) flags must be executed.

Step-by-Step Solution

1
Filter running processes by name using the tasklist command
Obtain the Process Identifier (PID) corresponding to app_service.exe
Before killing a specific hung process safely by PID, its process ID must be identified from the running tasks list.
2
Execute taskkill specifying the PID, /f (force), and /t (tree/child processes)
Forcefully terminate app_service.exe and all child processes created by it
The /f flag overrides unresponsive states to force closure, while /t ensures sub-processes spawned by the application are also closed.

Key Concept

Identifying and terminating processes via Windows Command Line using TASKLIST and TASKKILL
Question 1225Question →

A system administrator needs to implement WPA3-Enterprise security on an office wireless network to replace an outdated setup. Which TWO of the following authentication components and protocols are required to support a WPA3-Enterprise deployment?

Select all that apply

Show answer & explanation

Answer: Centralized authentication server using RADIUS; IEEE 802.1X framework for network access control

Answer

The required components for WPA3-Enterprise are a centralized RADIUS authentication server and the IEEE 802.1X access control framework.
WPA3-Enterprise requires both an IEEE 802.1X access control framework and a centralized authentication server (such as RADIUS) to authenticate users individually rather than using a single shared passphrase.

Step-by-Step Solution

1
Identify the authentication framework required for enterprise wireless security.
Enterprise modes use IEEE 802.1X to manage network access control and pass authentication packets between client devices and the backend server.
802.1X provides the standard structure for enterprise-grade wireless access control.
2
Determine the server component required for user credential verification.
A RADIUS server is used to maintain and check individual user credentials (or certificates) rather than relying on a shared key.
Centralized credential verification allows individual user account auditing and revocation.

Key Concept

WPA3-Enterprise Security Requirements
Question 1226Question →

A field technician responds to a service ticket at a retail store where a thermal receipt printer feeds paper correctly but prints completely blank receipts after a cashier replaced the paper roll. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The thermal paper roll was loaded backward, placing the non-heat-sensitive side toward the thermal printhead.

Answer

The thermal paper roll was loaded backward, placing the non-heat-sensitive side toward the thermal printhead.
Direct thermal printers use a heated printhead to create images on specially treated, heat-sensitive paper. The chemical coating is only applied to one side of the paper roll. If the roll is inserted upside down, the heating elements contact the uncoated back of the paper, resulting in completely blank receipts while the mechanical feed functions normally.

Step-by-Step Solution

1
Analyze thermal printing mechanics
Identify that direct thermal printing relies on precise contact between the heated printhead pins and the coated side of heat-sensitive paper without using ink or toner.
Understanding technology-specific mechanisms helps isolate hardware from paper issues.
2
Evaluate the reported symptom
Note that the printer feeds paper normally, indicating mechanical movement and data transmission are working, but no text renders.
This rules out connectivity or motor failures.
3
Determine root cause following recent maintenance context
Since the issue immediately followed a paper roll replacement, loading thermal paper upside down or backward is the primary cause of blank output.
Only one side of direct thermal paper is treated with heat-reactive dye.

Key Concept

Direct Thermal Printer Operation and Media Orientation
Question 1227Question →

A human resources manager receives an urgent phone call from an individual claiming to be a senior network administrator from the corporate help desk. The caller states that an emergency security patch must be applied immediately to the manager's account to prevent a critical data leak, requiring the manager to read back a one-time passcode sent via SMS and approve an incoming multi-factor authentication (MFA) push notification. After the manager complies, an unauthorized user registers a new authentication device and accesses sensitive personnel records. Which of the following social engineering threat types best describes the attack vector used in this scenario?

Show answer & explanation

Answer: Pretexting

Answer

Pretexting is the correct social engineering attack type described in the scenario.
Pretexting occurs when an attacker invents a scenario (the pretext) and assumes a fraudulent identity—such as a corporate help desk technician—to build trust and trick a targeted employee into granting unauthorized access or revealing sensitive verification codes.

Step-by-Step Solution

1
Analyze the attack vector and communication method presented in the scenario.
The attacker established a fraudulent role (help desk technician) and backstory (emergency security patching) over a voice communication line to manipulate the victim.
Identifying the caller's manipulation tactic helps differentiate between active social interaction vectors and automated/technical attacks.
2
Evaluate the victim's interaction and the resulting compromise.
The victim was duped into disclosing a dynamic multi-factor authentication SMS code and approving an MFA prompt based on the deceptive scenario.
Pretexting relies on creating trust through a realistic narrative (pretext) to convince targets to bypass standard security procedures.
3
Match the observed attack behaviors against CompTIA threat classifications.
Creating an elaborate fake scenario and impersonating authority figures to trick an employee into revealing authentication credentials defines pretexting (specifically vishing/pretexting).
Distinguishing pretexting from passive observation or technical exploitation ensures proper security awareness training and incident reporting.

Key Concept

Social Engineering Principles and Pretexting Identification
Question 1228Question →

A technician is tasked with removing a malware infection from a workstation. According to the standard CompTIA 7-step malware remediation process, in what sequence should the technician perform the following steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence following the CompTIA 7-step malware removal process is: Quarantine the infected system -> Disable System Restore in Windows -> Remediate the infected system by updating anti-malware software and scanning -> Enable System Restore and create a new restore point -> Educate the end user.
The standard CompTIA 7-step malware removal process follows a specific order: 1. Identify malware symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware / scan and remove), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Arranging the actions starting with quarantine and ending with user education strictly aligns with this methodology.

Step-by-Step Solution

1
Isolate the compromised computer from the network.
System is quarantined, preventing malware spread.
Quarantine is step 2 of the remediation framework.
2
Disable System Restore.
Prevents Windows from saving infected files in restore points.
Disabling System Restore is step 3 of the remediation framework.
3
Update signatures and perform malware removal.
Infected files are identified, cleaned, or deleted.
Remediation is step 4 of the remediation framework.
4
Re-enable System Restore and create a clean restore point.
Restores system protection capabilities with clean state.
Enabling System Restore is step 6 of the remediation framework.
5
Provide security awareness guidance to the user.
Reduces future infection risks.
User education is step 7 (the final step) of the remediation framework.

Key Concept

CompTIA 7-step Best Practice Methodology for Malware Remediation
Question 1229Question →

A systems technician is addressing two hardware tickets regarding computer displays in an enterprise environment:

1. Ticket A: A desktop user upgraded to a 4K monitor, but the screen constantly flickers and drops signal when set to 4K resolution at 60 Hz over a legacy HDMI cable. The monitor displays standard 1080p fine.
2. Ticket B: A mobile user has an ultraportable laptop with a completely dark OLED screen. A desktop support intern suggests replacing the screen's backlight inverter board to restore brightness.

Which of the following troubleshooting statements and resolution steps are CORRECT? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replacing the inverter board will not resolve the dark laptop screen because OLED displays feature self-emissive pixels and do not use a backlight or inverter board.; The 4K resolution flickering is likely caused by inadequate cable bandwidth, requiring an upgrade to an Ultra High Speed HDMI (HDMI 2.1) cable.

Answer

Replacing the inverter board will not resolve the dark laptop screen because OLED displays do not use backlight inverters, and the 4K monitor flickering is caused by insufficient video cable bandwidth requiring an upgraded HDMI cable.
The correct statements recognize two fundamental hardware principles: OLED screens do not use backlight inverter boards because each pixel generates its own light, and driving high resolutions like 4K at 60 Hz requires high-bandwidth video cables like Ultra High Speed HDMI cables.

Step-by-Step Solution

1
Analyze the OLED laptop display symptom.
Recognize that OLED (Organic Light-Emitting Diode) technology utilizes self-emissive pixels rather than a CCFL backlight array.
Because OLED displays do not have backlights, they do not utilize backlight inverter boards. Attempting to replace an inverter on an OLED display is impossible.
2
Analyze the 4K display flickering symptom.
Determine that 4K at 60 Hz requires up to 18 Gbps (HDMI 2.0) or 48 Gbps (HDMI 2.1) of data throughput.
Legacy HDMI cables lack the required shielding and clock speeds for high bandwidth, causing signal degradation and flickering at higher resolutions while functioning at lower resolutions like 1080p.

Key Concept

Display Technologies (OLED vs LCD) and Cable Bandwidth Constraints
Question 1230Question →

A technician is tasked with upgrading a company-owned workstation from 64-bit Windows 10 Home to 64-bit Windows 11 Pro. The user requires that all personal files, application data, and localized settings remain intact after the transition. Which of the following installation methods should the technician use to fulfill this request?

Show answer & explanation

Answer: Perform an in-place upgrade by entering a valid Windows 11 Pro product key within the Windows Activation settings.

Answer

Perform an in-place upgrade by entering a valid Windows 11 Pro product key within the Windows Activation settings.
Performing an in-place upgrade by updating the product key directly in Windows Activation allows a smooth transition from Windows 10 Home to Windows 11 Pro of the same 64-bit architecture, fully preserving installed applications, configuration preferences, and personal files.

Step-by-Step Solution

1
Evaluate the current operating system architecture and target edition.
The system currently runs 64-bit Windows 10 Home and needs to move to 64-bit Windows 11 Pro while preserving user files and settings.
Matching 64-bit architectures support direct in-place edition upgrades without needing a full system reinstall.
2
Select the correct upgrade path method.
Entering the Pro product key in Windows Activation upgrades the edition directly while retaining all applications and personal data.
In-place edition upgrades modify system components and unlock Pro features seamlessly without data loss.

Key Concept

Windows OS Edition Upgrade Paths
Question 1231Question →

An IT technician is tasked with decommissioning sensitive magnetic hard drives following standard organizational security procedures. Place the following hardware disposal steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for drive disposal is: 1) Log the hard drive serial numbers in the inventory asset management database, 2) Degauss the magnetic hard drives to neutralize data stored on the platters, 3) Pass the sanitized hard drives through a physical shredder, and 4) Obtain and archive a Certificate of Destruction for regulatory compliance.
The secure decommissioning process begins with administrative logging of serial numbers to maintain audit capability. Magnetic degaussing follows to sanitize data content. Physical shredding then destroys the hardware itself. Finally, obtaining and archiving the Certificate of Destruction validates the completed process for compliance records.

Step-by-Step Solution

1
Identify the initial chain-of-custody administrative requirement.
Documenting serial numbers in the asset database establishes an audit trail before any physical or logical modification.
Tracking must precede destruction so the organization knows which assets are being processed.
2
Perform initial data sanitization on the magnetic media.
Degaussing disrupts the magnetic domains on the platters, sanitizing the stored data.
Sanitizing media prior to physical transport or shredding minimizes data exposure risks.
3
Execute physical destruction of the hardware.
Industrial shredding destroys the physical integrity of the platters and drive electronics.
Physical destruction prevents drive reconstruction.
4
Finalize compliance documentation.
A Certificate of Destruction is generated and logged for legal and regulatory audit purposes.
Final documentation completes the disposal lifecycle and proves compliance.

Key Concept

Chain of Custody and Secure Hardware Disposal Lifecycle
Question 1232Question →

A desktop support technician arrives at an executive office to resolve an urgent local printer issue required for an upcoming board presentation. Upon arrival, the executive is visibly agitated, venting about previous helpdesk delays and demanding that the technician immediately fix a personal tablet's email connectivity issue before looking at the printer. In addition, highly sensitive employee salary spreadsheets are displayed on the executive's monitor and printed papers lie open on the desk. Which of the following is the most appropriate course of action for the technician to take?

Show answer & explanation

Answer: Actively listen to the executive's concerns without interrupting, politely request that the executive lock or cover the confidential documents, prioritize resolving the ticketed printer issue, and offer to open a new support ticket for the personal device.

Answer

Maintain a calm and professional demeanor, actively listen without interrupting, ask the user to secure confidential materials, prioritize the ticketed printer task, and set proper expectations for secondary requests.
The correct response demonstrates all key elements of CompTIA professional interaction guidelines: active listening without interrupting, maintaining a calm and non-defensive tone, respecting customer privacy by prompting the user to secure confidential salary documents, focusing on the high-priority business task, and setting proper expectations by creating a separate ticket for additional requests.

Step-by-Step Solution

1
De-escalate the user and practice active listening
The technician listens attentively to the customer's frustration without interrupting or offering defensive excuses, building rapport and understanding.
De-escalating an irate user requires validating their concerns and maintaining a professional, empathetic demeanor.
2
Address data privacy and confidentiality appropriately
The technician asks the user to minimize screen content or cover physical documents containing sensitive information.
Technicians must respect customer privacy and confidential data, ensuring the customer retains control of their own sensitive files rather than touching their property without permission.
3
Scope work and set expectations
The technician completes the urgent, business-critical printer repair first and offers to create a separate ticket for the out-of-scope personal device.
Setting clear expectations ensures primary SLA requirements are met while providing a structured path to address additional user requests.

Key Concept

CompTIA Professional Communication Standards, Active Listening, Data Confidentiality, and Expectation Management
Estimated Time:2m 0s
Question 1233Question →

A help desk technician is setting up a specialized Windows 11 workstation connected to an isolated laboratory network. According to organizational security policy, the workstation must communicate with local devices on the 10.1.5.0/24 subnet, must be prevented from attempting to route any traffic outside of its local network segment, and must keep network discovery disabled to remain hidden from other endpoints on the local segment.

Which TWO configuration actions should the technician perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a static IPv4 address and subnet mask on the ethernet adapter properties while leaving the default gateway field blank; Set the network location profile for this network connection to Public within Windows Network & internet settings

Answer

The technician should configure a static IPv4 address and subnet mask while leaving the default gateway empty, and set the network location profile to Public.
Leaving the default gateway address field blank ensures that the Windows host will not send traffic off the local 10.1.5.0/24 subnet. Additionally, designating the network connection as Public in Windows settings activates the restrictive network profile that turns off network discovery and file sharing.

Step-by-Step Solution

1
Identify how to restrict network communication strictly to the local subnet on a Windows client.
Leaving the default gateway unconfigured prevents the host from attempting to forward packets to remote subnets or internet destinations.
The default gateway provides the IP address of the local router used to reach outside networks.
2
Identify how to disable network discovery and hide the endpoint on the local segment.
Configuring the network location profile as Public disables network discovery and network file/printer sharing by default.
Windows network location profiles (Private vs. Public) govern Windows Firewall rules and discovery behaviors for connected interfaces.

Key Concept

Windows client IP address properties and network location profile settings
Question 1234Question →

A help desk technician is servicing a Windows system that continuously displays blue screen errors following a failed feature update and an unverified graphics driver installation. Initial diagnostics indicate that both critical operating system binaries and the local component store have suffered data corruption. Which of the following troubleshooting steps should the technician take to repair the component store, replace damaged system files, and restore driver stability? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute dism /online /cleanup-image /restorehealth from an elevated command prompt prior to running system file scans.; Boot the system into Safe Mode and use Device Manager to roll back the display driver to its previously installed version.

Answer

The technician must first execute DISM with the RestoreHealth switch to repair the local component store, and use Safe Mode along with Device Manager to roll back the unstable graphics driver.
Executing DISM with the RestoreHealth switch repairs the Windows Component Store image using online or local repair sources, ensuring System File Checker has valid file payloads available. Additionally, booting into Safe Mode allows the technician to bypass active driver crashes and use Device Manager to roll back to a known-working device driver.

Step-by-Step Solution

1
Repair the local Component Store using DISM
Executes 'dism /online /cleanup-image /restorehealth' to fix payload files in WinSxS using Windows Update as a reference source.
SFC relies on the WinSxS store to copy healthy replacements of corrupted system files. If the store itself is corrupt, DISM must fix it first.
2
Run System File Checker (SFC)
Executes 'sfc /scannow' to verify system integrity and repair damaged OS files using the newly validated component store.
With a healthy component store, SFC can successfully repair missing or corrupted system files.
3
Resolve driver instability via Safe Mode
Boots into Windows Safe Mode and uses Device Manager to perform a driver rollback on the graphics adapter.
Safe Mode prevents problematic third-party drivers from loading, allowing the technician to restore the previously working driver version safely.

Key Concept

Windows Repair Sequence and Driver Recovery
Question 1235Question →

A systems administrator is troubleshooting a Windows 11 workstation that experiences severe performance degradation and random crashes caused by an unknown third-party startup program. The administrator needs to temporarily start the system with all non-Microsoft background services disabled at boot time without individually changing the startup type of each service in the Services console. Which administrative tool should the administrator use to achieve this task?

Show answer & explanation

Answer: System Configuration (msconfig.exe)

Answer

System Configuration (msconfig.exe) is the correct tool to use because it provides an easy way to hide all Microsoft services and disable remaining third-party services in bulk for diagnostic troubleshooting.
The System Configuration utility (msconfig.exe) is designed specifically for troubleshooting boot and startup issues. Under its Services tab, administrators can select 'Hide all Microsoft services' and click 'Disable all' to easily initiate a selective startup environment without permanently modifying service configurations.

Step-by-Step Solution

1
Identify the diagnostic requirement.
The requirement is to isolate third-party background services by performing a selective startup without altering individual service startup configurations permanently.
Manually changing service configurations in services.msc is prone to error and time-consuming.
2
Evaluate Windows Administrative tools.
System Configuration (msconfig.exe) features a 'Services' tab with a 'Hide all Microsoft services' checkbox and a 'Disable all' option, specifically designed for clean boot troubleshooting.
This tool simplifies diagnostic startup procedures by temporarily disabling third-party components.

Key Concept

Using System Configuration (msconfig) for Selective Boot and Service Isolation
Question 1236Question →

A network technician is assigned to physically secure desktop computers located in a publicly accessible library area. Recent audits revealed that unauthorized users have been plugging hardware keyloggers into open USB ports on the back of the computer towers. The technician needs to prevent unauthorized physical connections to these ports without replacing the existing computer cases or restricting user access to connected peripherals. Which of the following physical security controls should the technician implement?

Show answer & explanation

Answer: Install physical USB port locks in all empty USB ports.

Answer

Install physical USB port locks in all empty USB ports.
Installing physical USB port locks (or port blockers) directly prevents unauthorized insertion of hardware keyloggers and rogue USB storage devices into empty interface ports on the workstation.

Step-by-Step Solution

1
Identify the physical security threat in the scenario.
The primary threat is unauthorized physical access to open hardware interfaces (USB ports) on computer towers in a public space.
An attacker can insert rogue hardware keyloggers or flash drives into exposed ports to compromise systems.
2
Evaluate the control options against the specific requirement to block port access without altering computer cases.
USB port locks directly block empty USB slots using a specialized key mechanism, effectively disabling physical hardware insertions.
This target-specific control prevents unauthorized device insertion while allowing existing keyboard and mouse connections to function.

Key Concept

Physical USB Port Blockers and Interface Security
Question 1237Question →

A security technician is configuring group policies for Windows 11 Pro workstations in a finance department. To prevent background malware from interacting with or capturing keystrokes during privilege escalation requests, the technician must enforce a policy that dims the screen and isolates the elevation prompt from the interactive user desktop. Which User Account Control (UAC) security policy setting directly controls this behavior?

Show answer & explanation

Answer: User Account Control: Switch to the secure desktop when prompting for elevation

Answer

The setting 'User Account Control: Switch to the secure desktop when prompting for elevation' is responsible for dimming the screen and displaying elevation requests in an isolated session protected from background software.
Enabling 'User Account Control: Switch to the secure desktop when prompting for elevation' transfers control to a separate desktop context running as SYSTEM. This dims the screen and prevents untrusted user-mode applications or malware from taking screenshots, capturing input, or clicking buttons automatically on the UAC prompt.

Step-by-Step Solution

1
Identify the security requirement described in the scenario
The requirement is to isolate elevation prompts from background processes and malware to prevent keystroke logging or UI spoofing during escalation.
UAC provides a feature called the Secure Desktop, which runs under system privileges and blocks unauthorized process interaction.
2
Evaluate the Local Security Policy settings related to UAC prompt rendering
The policy 'User Account Control: Switch to the secure desktop when prompting for elevation' specifically governs whether the desktop transitions to this protected display mode.
Disabling this policy allows prompts to appear on the standard interactive desktop without screen dimming, increasing vulnerability to malicious background scripts.

Key Concept

Windows UAC Secure Desktop Isolation
Estimated Time:1m 0s
Question 1238Question →

A desktop technician is reviewing Windows User Account Control (UAC) settings across company workstations. Which TWO of the following statements correctly describe default UAC prompt behaviors for user accounts on Windows systems? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Standard user accounts are required to enter administrator credentials when attempting actions that require elevated rights.; Administrator accounts operating under the default UAC notification level are prompted on the Secure Desktop when programs attempt to make changes.

Answer

Standard user accounts must enter administrative credentials to perform elevated actions, and administrative accounts under default UAC settings receive confirmation prompts on the Secure Desktop when applications request system changes.
Under Windows User Account Control (UAC), standard user accounts are required to provide administrator credentials to elevate privileges. Additionally, accounts in the local Administrators group operate with a split access token by default, meaning software elevation requests trigger a prompt on the dimmed Secure Desktop requiring user confirmation.

Step-by-Step Solution

1
Analyze standard user UAC behavior in Windows.
Standard users lack elevated access tokens; UAC enforces Over-the-Shoulder (OTS) authentication requiring an administrator password.
Prevents unauthorized standard users from making administrative system changes.
2
Analyze administrator account default UAC behavior in Windows.
Administrators log in with a filtered standard user token; UAC prompts on the Secure Desktop (Admin Approval Mode) when software requests full administrative rights.
Prevents unauthorized background scripts or malware from elevating silently without user awareness.

Key Concept

Windows User Account Control (UAC) Account Elevation Behaviors
Question 1239Question →

A cybersecurity support technician is dispatched to remediate a corporate desktop that is actively displaying unauthorized ransomware warnings and generating rogue outbound connections. In what sequence should the technician perform the following incident response steps to ensure complete malware eradication according to standard CompTIA guidelines?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the CompTIA 7-step malware removal process: (1) Quarantine the system by disconnecting network cables/Wi-Fi, (2) Disable System Restore, (3) Remediate the system by updating signatures and scanning in Safe Mode, (4) Schedule updates and recurring scans, (5) Re-enable System Restore and create a restore point, and (6) Educate the end user.
The CompTIA 7-step malware remediation process specifies an exact operational sequence: 1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan/remove), 5. Schedule updates and recurring scans, 6. Enable System Restore and create restore point, and 7. Educate end user.

Step-by-Step Solution

1
Isolate the workstation (Quarantine)
Network communication is terminated, stopping malware propagation and command-and-control communication.
Step 2 of the CompTIA process dictates quarantining the system immediately after symptom identification.
2
Disable System Restore
System Restore points are cleared, eliminating stored copies of the malware.
Step 3 prevents infected files from being cached or restored later.
3
Remediate the system
Anti-malware definitions are updated and malicious files/registry keys are detected and removed.
Step 4 involves updating security tools and running deep scans to clean the operating system.
4
Schedule updates and scans
Automated security maintenance tasks are established.
Step 5 ensures ongoing preventative maintenance.
5
Enable System Restore and create a clean restore point
System recovery capabilities are restored using a known-clean baseline state.
Step 6 re-establishes OS backup functionality only after confirming system health.
6
Educate the user
The end user learns risk mitigation techniques to avoid future infections.
Step 7 finishes the remediation lifecycle by addressing human vulnerabilities.

Key Concept

CompTIA 7-Step Best-Practice Malware Removal Process
Question 1240Question →

An IT administrator is configuring a high-security corporate wireless network for a firm's mobile workforce. Corporate policy mandates mutual authentication using client and server digital certificates integrated with a central RADIUS server. Additionally, legacy non-domain mobile devices that only support shared passphrases must be accommodated on a segregated network segment using current security standards. Which TWO of the following configuration choices must the administrator implement to satisfy all policy requirements?

Select all that apply

Show answer & explanation

Answer: Configure WPA3-Enterprise utilizing EAP-TLS authentication for the corporate wireless network; Deploy a dedicated SSID for legacy devices utilizing WPA3-Personal with Simultaneous Authentication of Equals (SAE) assigned to an isolated VLAN

Answer

The administrator must implement WPA3-Enterprise utilizing EAP-TLS authentication for corporate clients, and deploy a dedicated SSID using WPA3-Personal (SAE) on an isolated VLAN for non-domain passphrase devices.
WPA3-Enterprise configured with EAP-TLS satisfies the mutual certificate authentication requirement because EAP-TLS explicitly requires both server-side and client-side digital certificates. WPA3-Personal with SAE on an isolated VLAN provides modern passphrase security and logical traffic separation for non-domain devices without resorting to deprecated encryption algorithms.

Step-by-Step Solution

1
Evaluate enterprise authentication protocols against the requirement for mutual certificate authentication.
Select EAP-TLS under WPA3-Enterprise.
EAP-TLS is the standard EAP type that mandates digital certificates on both the RADIUS server and the client machine for mutual authentication.
2
Evaluate options for passphrase-based clients needing network isolation.
Select WPA3-Personal (SAE) on a separate VLAN.
SAE provides strong key exchange for passphrase-authenticated clients while VLAN isolation ensures non-domain devices remain segregated from corporate assets without relying on weak legacy ciphers like TKIP.

Key Concept

Wireless Security Protocols and Enterprise Authentication Mechanisms
Estimated Time:2m 0s
PreviousPage 62 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin