Examkin

All practice questions

3551 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 1241Question →

A security administrator needs to harden a standalone Windows 11 Enterprise computer by ensuring that only digitally signed executables can request privilege elevation, while requiring administrators to re-enter credentials on a dimmed, isolated desktop. Place the administrative configuration and verification steps in the correct chronological order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with launching secpol.msc, navigating to Security Options under Local Policies, enabling the policy to only elevate signed and validated executables, configuring administrator prompt behavior to require credentials on the secure desktop, and finally testing the policy by executing an unsigned application.
The correct procedural order requires launching the Local Security Policy console (secpol.msc), navigating to Local Policies -> Security Options, enabling digital signature enforcement for elevated binaries, setting administrative prompt behavior to require credentials on the secure desktop, and finally executing a verification test using an unsigned binary.

Step-by-Step Solution

1
Launch the Local Security Policy snap-in console (secpol.msc).
The Local Security Policy window opens.
Administrative security options for UAC cannot be set in standard user applets; secpol.msc must be initialized first.
2
Navigate to Security Settings -> Local Policies -> Security Options.
The list of Windows UAC and security policy settings is displayed.
UAC security policies are located specifically within the Security Options subfolder of Local Policies.
3
Enable 'User Account Control: Only elevate executables that are signed and validated'.
Unsigned applications are prohibited from raising UAC privilege elevation prompts.
This policy forces PKI signature validation prior to granting elevation tokens to executables.
4
Configure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Administrators must re-enter password credentials on an isolated secure desktop session during elevation.
The Secure Desktop prevents unprivileged background software on the interactive desktop from intercepting credentials or injecting synthetic click events.
5
Execute an unsigned application binary to confirm enforcement.
The elevation request fails or is refused without presenting an elevation prompt.
Verification confirms that the active security policy blocks unsigned executables in accordance with the security baseline.

Key Concept

Windows Local Security Policy configuration for User Account Control (UAC) code signing enforcement and secure desktop privilege elevation behavior
Estimated Time:2m 0s
Question 1242Question →

An IT administrator upgrades the CPU on a media editing station. The system powers on successfully and loads the operating system, but completely powers off without warning after 10 minutes of high-load video rendering. The system cannot be turned back on immediately, but will boot normally if allowed to sit powered off for several minutes. Which of the following is the most likely cause of this behavior?

Show answer & explanation

Answer: Thermal protection shutdown due to unremoved protective plastic film on the heatsink base

Answer

Thermal protection shutdown due to unremoved protective plastic film on the heatsink base
Modern CPUs include built-in thermal logic designed to instantly cut power when temperatures exceed safe operating limits (typically ~100°C) to prevent permanent hardware damage. Failing to remove the protective plastic film from the bottom of a heatsink blocks effective heat dissipation into the cooling fins, causing temperatures to spike under heavy processing tasks like rendering. The delay before the computer can be powered back on occurs because thermal protection sensors prevent start-up until core temperatures return to safe baseline levels.

Step-by-Step Solution

1
Analyze the observed system failure pattern
The machine powers on, boots cleanly, operates normally during low load, but abruptly powers off under sustained CPU load and requires a cooling-off period before rebooting.
This behavior specifically points to thermal safety mechanisms (thermal throttling followed by hard thermal shutdown) triggered by heat saturation.
2
Evaluate heat transfer breakdown causes related to recent component installation
A common oversight during CPU cooler installation is failing to peel off the protective plastic film on the thermal baseplate.
The plastic barrier acts as an insulator, blocking thermal paste conductivity and causing the processor to reach critical junction temperatures under load.

Key Concept

CPU thermal cooling mechanics and thermal protection shutdown
Estimated Time:1m 30s
Question 1243Question →

An IT security technician is implementing a hardened security baseline on Windows 11 Pro workstations for a finance company. The compliance policy mandates two specific behaviors: local administrators must be required to explicitly approve administrative privileges on an isolated secure desktop, and standard users must be completely restricted from seeing credential elevation prompts when attempting administrative operations. Which TWO configuration actions in the Local Security Policy snap-in (secpol.msc) under Security Options should be implemented to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop".; Configure "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".

Answer

The correct configurations are setting administrator prompt behavior to prompt for consent on the secure desktop and setting standard user elevation requests to automatically deny.
The combination of prompting for consent on the secure desktop for administrators and automatically denying elevation requests for standard users directly satisfies both audit requirements using Windows Local Security Policy settings.

Step-by-Step Solution

1
Identify the Local Security Policy location
Navigate to Local Policies -> Security Options within secpol.msc on supported Windows Pro/Enterprise editions.
UAC elevation prompt policies are located centrally under Local Security Policy security options.
2
Configure Administrator Prompt Behavior
Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop'.
This satisfies the requirement for administrators to explicitly approve privilege requests on a secure dimming desktop.
3
Configure Standard User Elevation Policy
Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This satisfies the requirement to suppress credential prompts for standard users, automatically rejecting unauthorized elevation attempts.

Key Concept

Windows User Account Control (UAC) Local Security Policies
Question 1244Question →

A Linux technician is resolving permission issues on a web server. A web service running under the `www-data` group requires read and write access to all existing files and subdirectories within `/var/www/html/uploads`. Currently, files inside the directory are owned by `ubuntu:ubuntu` with permissions set to `-rw-r--r--` (`644`), and subdirectories have permissions `drwxr-xr-x` (`755`). The technician must grant group write access to `www-data` across all nested files and subdirectories without altering file user ownership, breaking directory traversal capabilities, or granting world-write permissions. Which of the following command combinations should the technician execute?

Show answer & explanation

Answer: chown -R :www-data /var/www/html/uploads && chmod -R g+w /var/www/html/uploads

Answer

The technician should run `chown -R :www-data /var/www/html/uploads && chmod -R g+w /var/www/html/uploads`.
The correct command combination uses `chown -R :www-data` to recursively update group ownership to `www-data` while preserving user ownership (`ubuntu`). It then uses `chmod -R g+w` to recursively append write permissions for the group, turning existing `644` files into `664` and `755` directories into `775`. This grants the web service read and write privileges without removing the directory execute (`x`) bit necessary for file traversal.

Step-by-Step Solution

1
Identify group ownership requirements
Group ownership must be changed to `www-data` across all files and subdirectories recursively.
Using `chown -R :www-data` modifies the group owner without changing the existing user owner (`ubuntu`).
2
Identify access permission requirements
Write access (`+w`) must be added for the group across all files and subdirectories recursively.
Symbolic notation `chmod -R g+w` adds group write privileges without removing existing execute (`+x`) permissions on directories.
3
Validate security and directory traversal boundaries
Files become `664` (`rw-rw-r--`) and directories become `775` (`rwxrwxr-x`).
This preserves directory execution/traversal for the group while preventing world-write (`777`) security risks.

Key Concept

Linux File Ownership and Symbolic/Absolute Permissions Management
Question 1245Question →

A systems administrator needs to migrate a large departmental folder structure from a local workstation drive (`C:\Data`) to a network backup destination (`D:\Backup`). The migration must clone all subdirectories—including empty ones—and retain all original file attributes, owner details, and NTFS Access Control Lists (ACLs). Which of the following command-line utilities and switch combinations will accomplish this task efficiently?

Show answer & explanation

Answer: robocopy C:\Data D:\Backup /e /copyall

Answer

robocopy C:\Data D:\Backup /e /copyall
The command specifying `robocopy C:\Data D:\Backup /e /copyall` is correct because `robocopy` is built into Windows for high-performance file replication. The `/e` flag ensures all subdirectories, including empty ones, are copied, while `/copyall` duplicates all file data, attributes, timestamps, NTFS security ACLs, owner information, and auditing flags.

Step-by-Step Solution

1
Identify key file copy requirements
The command must include empty subdirectories and copy complete NTFS security credentials (ACLs, owner info, audit details).
Standard copy commands omit empty directories or file permissions unless explicitly commanded via parameters.
2
Evaluate Windows command-line copy tools
Robocopy (Robust File Copy) is designed for robust directory cloning and supports full attribute and ACL replication.
Robocopy is preferred over copy and xcopy for complex directory migrations.
3
Verify switch parameters
/e includes empty subdirectories; /copyall is equivalent to /copy:DATSOU (Data, Attributes, Timestamps, Security ACLs, Owner, Auditing).
This satisfies all operational requirements in a single command execution.

Key Concept

Windows Robocopy Utility and Advanced Copy Flags
Question 1246Question →

A IT technician needs to sanitize several high-performance NVMe solid-state drives (SSDs) that contain confidential financial data. The company plans to reassign these drives to non-sensitive internal workstations. Which of the following is the most appropriate data destruction method to render the data unrecoverable while leaving the drives fully operational for reuse?

Show answer & explanation

Answer: Execute a manufacturer drive purge utility or perform a cryptographic erase.

Answer

Executing a manufacturer drive purge utility or performing a cryptographic erase is the most appropriate method.
Executing a drive purge utility or cryptographic erase specifically targets flash-based media (SSDs/NVMe). It resets or destroys the encryption keys and clears all NAND flash blocks (including over-provisioned space), rendering data unrecoverable while leaving the drive hardware functional for future deployment.

Step-by-Step Solution

1
Identify the media type and organizational requirement
The target drives are solid-state drives (SSDs/NVMe) and must be sanitized for reuse.
Different storage technologies (flash memory vs. magnetic platters) require distinct sanitization techniques.
2
Evaluate sanitization methods against hardware compatibility and reuse requirements
Degaussing is ineffective on flash storage. Physical destruction (shredding/drilling) renders the drives unusable. High-level formatting or partition deletion leaves data recoverable.
Solid-state drives wear-level data across NAND blocks, requiring firmware-level commands (Purge/Cryptographic Erase) to properly wipe all blocks including wear-leveled and reserved space.
3
Select the correct sanitization procedure
A cryptographic erase or manufacturer-provided ATA/NVMe Secure Erase utility sanitizes all flash memory while preserving drive functionality.
This meets security standards for sanitizing SSDs intended for reuse.

Key Concept

SSD Sanitization and Data Disposal Methods
Question 1247Question →

An IT technician is troubleshooting a departmental laser printer that is producing output with two distinct problems: printed text leaves faint repeat ghost images at regular vertical intervals down the page, and the toner smudges easily when handled immediately after printing. Which TWO of the following components are most likely responsible for these defects?

Select all that apply

Show answer & explanation

Answer: Imaging drum unit; Fuser assembly

Answer

The imaging drum unit and the fuser assembly are the two defective components requiring inspection or replacement.
Ghost images recurring at fixed intervals stem from a failing imaging drum or wiper blade, while smudging toner points directly to a malfunctioning fuser assembly that fails to apply adequate heat and pressure.

Step-by-Step Solution

1
Analyze the ghosting symptom.
Identify that repeating ghost images at uniform vertical intervals indicate a defective imaging drum or cleaning blade failing to clear residual charge and toner.
The drum rotates continuously during printing; defective discharge lamps or worn drum coatings repeat image artifacts with every rotation.
2
Analyze the smudging symptom.
Identify that easily smudged toner indicates an issue with the fuser heating element or fuser rollers failing to melt toner into paper fibers.
Toner requires specific heat and pressure from the fuser assembly to bond permanently to media.

Key Concept

Laser Printer Component Failure Symptoms (Imaging Drum vs. Fuser Assembly)
Question 1248Question →

Match each security incident description on the left with the corresponding social engineering or threat type on the right.

Click a left item, then click its matching right item

Items

An unauthorized individual carrying heavy equipment boxes asks an authorized employee to hold open a secure badge-access entrance.
A technician receives an email directing them to a malicious administrative portal featuring a domain name with a transposed character.
A remote worker receives a phone call from an attacker impersonating internal IT helpdesk staff requesting credential verification to resolve a pending ticket.
A malicious script installed on a database server is configured to execute and wipe records if a specific employee user account remains inactive for 30 days.

Matches

Show answer & explanation

Answer

Holding a door open with permission describes Piggybacking. A spoofed URL with a transposed character describes Typosquatting. Impersonating IT personnel over the phone describes Pretexting. Code triggered by account inactivity describes a Logic bomb.
Each attack scenario matches its specific threat classification based on method and vector: Piggybacking relies on social courtesy for physical access, Typosquatting exploits web address spelling mistakes, Pretexting creates a fake persona/scenario to manipulate targets, and a Logic bomb executes malicious payloads when specific logical conditions occur.

Step-by-Step Solution

1
Analyze physical entry vectors.
Identified physical entry where the attacker uses a fake reason (holding heavy boxes) to obtain consent to enter past a badge reader as Piggybacking.
Unlike tailgating, piggybacking relies on the explicit cooperation or courtesy of an authorized user.
2
Analyze domain-based attack vectors.
Identified domain misspelling intended to deceive users into visiting a fake login page as Typosquatting.
Typosquatting relies on user typographical mistakes when typing web addresses.
3
Analyze phone-based social engineering scenarios.
Identified credential solicitation under the guise of an IT support technician resolving a ticket as Pretexting.
Pretexting involves establishing a believable pretext or fake identity to elicit confidential data.
4
Analyze programmatic threat execution conditions.
Identified dormant malicious code set to execute under specific logical conditions as a Logic bomb.
Logic bombs execute payload actions only when predetermined criteria (e.g., time elapsed, missing account activity) are met.

Key Concept

Social Engineering Tactics and Threat Vectors
Question 1249Question →

An IT support specialist is establishing a standard operating procedure (SOP) for managing incident ticket lifecycles within an enterprise ticketing platform. In what order should the technician perform the following steps during the ticket lifecycle, from initial customer interaction to final incident sign-off?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for managing the ticket lifecycle is: 1) Record user contact details, asset ID, and problem description, 2) Assign category/severity and perform initial Tier 1 diagnostics, 3) Document attempted steps and escalate to Tier 2 support, 4) Implement the resolution, record the root cause, and obtain user verification, and 5) Formally close the ticket and update the knowledge base.
The correct order follows established standard operating procedures for incident management: ticket creation and identification, initial triage and preliminary diagnostics, documented escalation, resolution deployment paired with user verification, and formal ticket closure paired with knowledge base creation.

Step-by-Step Solution

1
Intake and Logging
The incident is created with user identity, affected hardware asset ID, and primary symptoms documented.
Establishing accurate baseline details ensures compliance with service level tracking and inventory management.
2
Triage and Categorization
The ticket is classified by impact and urgency, and Tier 1 preliminary checks are run.
Proper classification determines response times and routes the ticket to appropriate initial support workflows.
3
Documentation and Escalation
All diagnostic findings and unsuccessful troubleshooting attempts are documented before reassigning to Tier 2.
Detailed documentation prevents duplicate effort and provides context for specialized escalation technicians.
4
Resolution and User Verification
The core issue is remediated, root cause is entered into resolution notes, and the user confirms functionality.
An incident cannot be considered resolved until the technical fix is verified by the affected user.
5
Closure and Knowledge Archival
The ticket is formally closed and successful resolution steps are converted into a reusable KB article.
Closing finalizes administrative workflows, while KB documentation assists in future incident resolution.

Key Concept

Incident Management Lifecycle and Documentation Workflows
Question 1250Question →

A corporate IT technician is reviewing several recent security incident logs and employee reports across different departments. Match each security incident scenario on the left with its corresponding social engineering or threat classification on the right.

Click a left item, then click its matching right item

Items

A targeted email sent specifically to the Chief Financial Officer containing personalized information to trick them into approving an urgent wire transfer.
An attacker compromises a niche industry news portal regularly visited by the company's software engineers to quietly infect their systems with malware.
A fake company-wide alert email claiming a severe zero-day vulnerability exists and instructing employees to manually delete a vital operating system file.
Infected USB flash drives labeled 'Executive Compensation Review' left in the company breakroom to entice curious employees to plug them into workstation computers.

Matches

Show answer & explanation

Answer

The targeted email to the CFO matches Whaling; the compromised industry portal matches Watering hole attack; the fake alert urging deletion of system files matches Security hoax; and leaving labeled USB drives in the breakroom matches Baiting.
Each attack vector relies on distinct delivery mechanisms and victim targets. Whaling targets high-profile executives like the CFO. Watering hole attacks infect popular third-party sites used by target employees. Security hoaxes trick users into taking self-destructive actions via false alarms. Baiting uses physical objects like flash drives to entice user interaction.

Step-by-Step Solution

1
Analyze the target and vector of the first scenario involving the CFO.
Identified high-level executive targeting for financial wire transfer fraud.
Whaling specifically describes phishing aimed at high-ranking executives (C-level officers).
2
Examine the compromised third-party news portal scenario.
Identified strategic web compromise of a site frequently visited by target staff.
Watering hole attacks infect trusted websites commonly frequented by a target group rather than attacking the company network directly.
3
Evaluate the fake security email instructing file deletion.
Identified psychological manipulation leading to intentional user self-harm.
Security hoaxes create false sense of urgency to trick users into harming their own systems.
4
Review the physical USB flash drive scenario in the breakroom.
Identified physical media baiting attempting to exploit curiosity.
Baiting involves leaving malware-laden physical media in accessible places to lure targets into connecting them.

Key Concept

Social Engineering Tactics and Threat Classifications
Question 1251Question →

A system administrator needs to configure a new workstation to dual-boot Windows 11 and Linux on a single internal NVMe drive using UEFI mode. In what sequence should the administrator execute the required steps to set up this multiboot system without losing existing Windows data?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for configuring a UEFI multiboot system is: first back up existing data, shrink the Windows volume in Disk Management to free up unallocated space, boot the secondary OS installer in UEFI mode, and complete the installation into the unallocated space while registering the bootloader in the EFI System Partition.
Establishing a stable dual-boot environment requires protecting current data first with a full backup, shrinking the existing volume in Windows Disk Management to produce unallocated space, booting the secondary OS media in UEFI mode to match the system firmware architecture, and deploying the second OS into the unallocated space while adding the bootloader entry to the EFI System Partition.

Step-by-Step Solution

1
Back up user data and system state.
Existing files are safely backed up to external media or network storage.
Partition changes carry inherent risk of filesystem errors or data loss.
2
Shrink the Windows filesystem in Disk Management.
A block of unallocated space is freed on the internal NVMe drive.
The secondary operating system requires unassigned disk space to form its native root and swap partitions.
3
Boot the secondary OS media in UEFI mode.
The installer runs with access to UEFI environment variables and the ESP.
Both operating systems must share the same boot architecture (UEFI/GPT) for dual-boot integration.
4
Install the secondary OS into unallocated space and write the GRUB bootloader to the ESP.
The GRUB bootloader integrates with the motherboard's EFI boot entries.
Registering GRUB in the EFI partition provides a boot selection menu at system startup.

Key Concept

Multiboot Installation and Partitioning Workflows
Question 1252Question →

An IT technician has just finished resolving a network configuration issue on a workstation. The user expresses frustration and asks for an explanation of what went wrong, noting that they do not understand complex computer terms. Which of the following actions demonstrates the most professional communication practice?

Show answer & explanation

Answer: Summarize the issue and resolution using plain, non-technical language while avoiding IT acronyms.

Answer

Summarize the issue and resolution using plain, non-technical language while avoiding IT acronyms.
When communicating with users who have limited technical knowledge, technicians should explain problems and solutions in plain language, avoiding acronyms and technical jargon. This ensures the user understands the outcome and feels respected.

Step-by-Step Solution

1
Assess the user's communication needs
Identify that the user explicitly stated they do not understand complex technical terminology.
Effective communication requires tailoring the explanation to the audience's level of technical knowledge.
2
Select the appropriate communication approach
Choose plain language, clear explanations, and avoid unnecessary jargon or acronyms.
CompTIA professional standards emphasize active listening, maintaining proper tone, avoiding jargon, and treating customers with respect.

Key Concept

Professional Communication and User Interaction
Question 1253Question →

An employee contacts the IT help desk reporting that their corporate desktop is displaying continuous pop-up advertisements and experiencing unusual performance delays. A support technician inspects the computer and identifies symptoms of an active adware infection. According to the CompTIA 7-step malware remediation process, which of the following actions should the technician take NEXT?

Show answer & explanation

Answer: Quarantine the compromised desktop by disconnecting its network connection.

Answer

Quarantine the compromised desktop by disconnecting its network connection.
Following the standard CompTIA 7-step malware remediation process, once malware symptoms are identified (Step 1), the immediate next step is to quarantine the infected system (Step 2). Disconnecting the network interface isolates the system and prevents potential lateral movement of the infection.

Step-by-Step Solution

1
Identify the current step in the CompTIA 7-step malware remediation process.
The technician has completed Step 1 (Identify malware symptoms).
Recognizing rogue pop-ups and performance issues confirms the presence of malware.
2
Determine the mandatory next step in the standard sequence.
Step 2 is to quarantine the infected system.
Quarantining (disconnecting network/Wi-Fi) prevents the malware from spreading to other systems on the network or communicating with remote command-and-control servers.

Key Concept

CompTIA 7-Step Malware Remediation Process (Step 2: Quarantine infected systems)
Question 1254Question →

A technician is preparing to dispose of several retired solid-state drives (SSDs) that previously stored confidential company files. Which of the following methods will ensure that the data on these flash-based drives is completely unrecoverable?

Show answer & explanation

Answer: Physical shredding of the solid-state drives

Answer

Physical shredding of the solid-state drives is the correct method to ensure data on flash-based media is completely destroyed.
Physical shredding pulverizes the drive assembly and internal flash memory chips, physically destroying the storage media and ensuring data cannot be recovered.

Step-by-Step Solution

1
Identify the storage media technology.
The media consists of solid-state drives (SSDs), which store data electronically on NAND flash memory chips rather than magnetically on spinning platters.
Data destruction techniques depend heavily on whether media is magnetic or flash-based.
2
Evaluate disposal methods against SSD architecture.
Degaussing relies on magnetic fields and fails on SSDs. High-level formatting and deleting partitions leave underlying data recoverable.
Only physical destruction (like shredding or pulverizing) guarantees destruction of non-magnetic flash chips when cryptographic erase or specialized drive sanitization tools are not utilized.
3
Select the proper sanitization/disposal protocol.
Shredding physically destroys the storage chips, ensuring permanent data destruction.
Destruction of physical IC chips renders data retrieval completely impossible.

Key Concept

Disposal and Sanitization Methods for Solid-State Storage
Estimated Time:45s
Question 1255Question →

A field technician is troubleshooting a Windows 11 Enterprise workstation that failed to update its Host (A) resource record on the domain DNS server after changing its static IPv4 configuration. The technician needs to manually initiate dynamic registration of the computer's name and newly assigned IPv4 address with the DNS server using the Command Prompt. Which of the following commands should the technician execute to accomplish this task?

Show answer & explanation

Answer: ipconfig /registerdns

Answer

The command 'ipconfig /registerdns' forces the Windows client to re-register its host name and IPv4 address with the configured DNS server.
Executing 'ipconfig /registerdns' refreshes all DHCP leases and re-registers DNS names for the workstation. It is the specific administrative command used in Windows to force dynamic update registration with a DNS server without rebooting the system.

Step-by-Step Solution

1
Identify the troubleshooting goal
The target action is to refresh dynamic DNS registration of the client's host name and static IP address.
When static IP changes occur, Windows automatically attempts registration, but manual triggering is needed if domain DNS updates fail.
2
Select the correct ipconfig command switch
The '/registerdns' parameter initiates immediate dynamic registration of all configured IP addresses and host names.
This switch flushes the DNS cache and sends registration requests directly to the configured DNS server.

Key Concept

Windows Client Dynamic DNS Registration via ipconfig
Estimated Time:1m 0s
Question 1256Question →

Match each physical security control mechanism on the left with its primary protective function or implementation objective on the right.

Click a left item, then click its matching right item

Items

Air gap
Security guard
Bollard
Smart card reader with PIN pad

Matches

Show answer & explanation

Answer

Air gap matches physical isolation from network connections; Security guard matches providing real-time human discretion against tailgating; Bollard matches preventing vehicular impact; Smart card reader with PIN pad matches multi-factor physical entry authentication.
Air gaps enforce absolute physical network isolation; security guards offer dynamic human judgment to stop tailgating and monitor entry points; bollards physically obstruct vehicle ramming attempts; and smart card readers combined with PIN pads enforce multi-factor authentication (something you have plus something you know) for secure area access.

Step-by-Step Solution

1
Identify the primary threat vector or physical barrier mechanism for each mechanism on the left.
Air gap deals with network isolation; Security guard provides human monitoring; Bollards address vehicle threats; Smart card + PIN provides two-factor access control.
Each physical security control target matches a distinct physical or operational vulnerability.
2
Match each physical control to its exact protective function.
Pair Air gap to total network disconnection, Security guard to active human anti-tailgating enforcement, Bollard to vehicle defense, and Smart card with PIN pad to multi-factor entry control.
Accurate pairing ensures correct mapping of physical controls to enterprise security goals.

Key Concept

Physical Security Controls
Question 1257Question →

A user contacts the help desk stating that whenever they attempt to run a software installer on their Windows workstation, the screen dims and a pop-up prompt asks for permission to allow the app to make changes to the device. Which Windows security feature generates this prompt to restrict unauthorized system modifications?

Show answer & explanation

Answer: User Account Control

Answer

User Account Control is the feature that prompts users for permission before executing applications that require administrative rights.
User Account Control (UAC) is the Windows feature designed to prevent potentially harmful program changes by requiring administrative confirmation or credentials on a dimmed Secure Desktop before administrative commands execute.

Step-by-Step Solution

1
Identify the reported symptom
The screen dims and a notification requests permission to allow an application to make changes to the operating system.
This behavior (the Secure Desktop dimming and popping up a consent/credential dialog) is a hallmark of administrative privilege checks in Windows.
2
Map the behavior to the corresponding Windows security tool
User Account Control (UAC) manages administrative token elevation and alerts users when software attempts system-level modifications.
UAC ensures applications run in the security context of a standard user account unless elevated by an administrator.

Key Concept

Windows User Account Control (UAC) privilege elevation prompts
Question 1258Question →

A desktop technician is configuring a video editing workstation equipped with a modern dedicated graphics card supporting HDMI 2.1 and DisplayPort 1.4. When the external 4K display is configured to 3840×21603840 \times 2160 resolution at a 120 Hz refresh rate, the monitor frequently flickers, loses signal briefly, and automatically drops back down to a 30 Hz refresh rate. Reducing the display resolution to 1920×10801920 \times 1080 completely resolves the instability. Which of the following is the MOST likely cause of this behavior?

Show answer & explanation

Answer: The video interface cable connecting the graphics card to the display lacks the required bandwidth specification.

Answer

The video interface cable connecting the graphics card to the display lacks the required bandwidth specification.
The correct option correctly identifies that running a monitor at 3840×21603840 \times 2160 at 120 Hz requires significant throughput. If the connected video cable is older or uncertified for high bit rates, the display engine will drop frames, lose signal, or automatically negotiate down to a lower refresh rate (such as 30 Hz) to maintain link stability. Replacing the cable with one rated for high bandwidth resolves the issue.

Step-by-Step Solution

1
Analyze the reported symptoms and hardware parameters
The display experiences signal loss and refresh rate downgrades specifically at high resolution (3840×21603840 \times 2160 at 120 Hz), while operating stably at lower resolutions (1920×10801920 \times 1080).
High resolution and high refresh rates require significantly higher data bitrates over the physical video cable.
2
Evaluate physical layer vs controller capabilities
Both the GPU and monitor support high bandwidth specifications, ruling out hardware processing limitations.
If host and display endpoints support the resolution, the intermediary link cable is the limiting component causing handshake failures.
3
Identify the corrective physical action
Replacing the current display cable with an Ultra High Speed HDMI (HDMI 2.1) or DisplayPort 1.4/2.0 rated cable resolves the bandwidth bottleneck.
Cables certified for higher data rates maintain signal integrity without signal dropouts or automatic bandwidth throttling.

Key Concept

Display Cable Bandwidth and Signal Integrity Throttling
Question 1259Question →

A systems technician is deploying a wireless network across several retail store locations. Management mandates that store associates log in using their individual Active Directory credentials. To protect against rogue access points, client handhelds must validate the RADIUS server's identity using a digital certificate. However, management explicitly prohibits the deployment and maintenance of individual client-side digital certificates due to administrative overhead. Which of the following wireless authentication configurations should the technician implement?

Show answer & explanation

Answer: PEAP (Protected Extensible Authentication Protocol)

Answer

PEAP (Protected Extensible Authentication Protocol) provides centralized Active Directory user authentication while requiring a digital certificate only on the RADIUS server.
The selection specifying PEAP (Protected Extensible Authentication Protocol) is correct because PEAP establishes an encrypted TLS tunnel using a digital certificate hosted strictly on the RADIUS authentication server. This allows client devices to verify the server's identity to prevent rogue access point attacks, while enabling employees to authenticate using their standard Active Directory credentials (via MS-CHAPv2 inside the tunnel) without requiring client-side certificates.

Step-by-Step Solution

1
Analyze authentication account requirements.
The requirement for individual Active Directory user accounts necessitates an enterprise 802.1X authentication framework integrated with RADIUS.
Personal authentication modes (PSK or SAE) rely on shared passphrases rather than domain user credentials.
2
Evaluate certificate requirements for server and client endpoints.
The client must authenticate the server (requiring a server certificate), but clients must not require individual certificates.
This constraint eliminates EAP-TLS, which mandates dual-sided (server and client) digital certificate deployment.
3
Select the EAP type matching the certificate and user authentication criteria.
PEAP establishes a secure TLS tunnel using only the server's certificate, through which internal password-based methods (such as MS-CHAPv2) carry the domain credentials.
PEAP satisfies both requirements: server validation via certificate and zero client-certificate overhead.

Key Concept

EAP Protocol Differences in 802.1X Enterprise Wireless Security
Estimated Time:2m 0s
Question 1260Question →

A systems administrator needs to record long-term performance metrics for CPU and RAM usage over a 24-hour period on a Windows workstation. Arrange the steps required to manually create and start a custom Data Collector Set in Performance Monitor in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins by launching Performance Monitor and expanding User Defined Data Collector Sets, creating a new manual collector set, selecting Performance counter data type and adding CPU/RAM counters, specifying the log file directory and completing the wizard, and finally right-clicking the created collector set to start logging.
To capture performance logs over an extended duration, an administrator opens Performance Monitor (perfmon.msc) and navigates to Data Collector Sets > User Defined. Next, a new collector set is created manually, where Performance counter is selected as the log type and the CPU and Memory counters are added. After specifying the output file location and completing the wizard, the administrator must right-click the created set and select Start to initiate data collection.

Step-by-Step Solution

1
Launch perfmon.msc and locate User Defined Data Collector Sets.
Accesses the administrative container for custom monitoring.
Performance Monitor must be open to configure log collection settings.
2
Initiate the New Data Collector Set wizard using advanced manual settings.
Opens the customization workflow.
Manual setup permits individual selection of counters rather than using standardized templates.
3
Choose Performance counter as data type and add Processor (% Processor Time) and Memory (Available MBytes) counters.
Specifies the hardware metrics to log.
Fulfills the scenario requirement to monitor CPU and Memory usage.
4
Set the log file output directory path and complete the wizard.
Saves the configured collector set to disk.
The operating system requires a file path destination before data can be written.
5
Start the Data Collector Set.
Begins recording performance counters to the designated log file.
Data collection does not start automatically upon wizard completion.

Key Concept

Creating and starting custom Data Collector Sets in Windows Performance Monitor (perfmon.msc)
PreviousPage 63 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin