All practice questions

3551 questions

Question 1261Question

An enterprise desktop administrator is responding to a malware incident on a Windows 11 workstation. The host has already been physically isolated from the local network, and System Restore has been disabled to prevent malicious persistence in volume shadow copies. Upon attempting to launch the installed anti-malware software to update definition files and clean the system, the malware actively terminates the security application processes and blocks network adapter configuration changes. Which action should the administrator take next to successfully proceed with system remediation?

Show answer & explanation

Answer: Boot the system into Safe Mode or an isolated Pre-installation Environment (PE) to update definitions via clean removable media and execute the remediation scan.

Answer

Boot the system into Safe Mode or an isolated Pre-installation Environment (PE) to update definitions via clean removable media and execute the remediation scan.
According to the CompTIA 7-step malware remediation process, after isolating the system and disabling System Restore, the technician must remediate the machine (Step 4). When active malware prevents normal operation or updates by killing security processes, booting into Safe Mode or using a Pre-installation Environment (PE) bypasses the malware's autostart mechanisms. Signatures can then be loaded from external media and full scans executed.

Step-by-Step Solution

1
Analyze current step in the CompTIA 7-step malware remediation process
System is isolated (Step 2) and System Restore is disabled (Step 3). The current objective is Remediation (Step 4).
Remediation requires updating anti-malware definitions and running scans/removal tools.
2
Address active malware self-defense mechanisms preventing normal scanner execution
Recognize that active malware blocking security executables must be suppressed.
Malware running with administrative privileges in standard boot mode can terminate security processes and block network sockets.
3
Select the appropriate boot environment and offline update method
Booting into Safe Mode or a WinPE environment restricts background startup items, enabling offline signature application via removable media and clean scan execution.
Safe Mode loads minimal drivers, preventing the malicious software from executing its defensive process-termination scripts.

Key Concept

CompTIA 7-Step Malware Remediation Process - Step 4: Remediate Infected Systems
Estimated Time:2m 30s
Question 1262Question

A tier-2 helpdesk technician is providing remote assistance to a user on a Windows 11 Enterprise workstation. Whenever an administrative command or application requiring privilege elevation is launched during the remote session, the technician's remote screen goes completely black, and control is temporarily lost until the local user interacts with the prompt. Corporate policy requires that User Account Control (UAC) remain active and continue prompting for elevation. Which Local Security Policy setting should the technician modify on the target workstation to allow remote management tools to display and interact with elevation prompts without turning off UAC?

Show answer & explanation

Answer: Disable the 'User Account Control: Switch to the secure desktop when prompting for elevation' policy setting.

Answer

Disable the 'User Account Control: Switch to the secure desktop when prompting for elevation' policy setting.
When UAC triggers an elevation prompt, Windows switches to the Secure Desktop by default to prevent malicious applications from intercepting user credentials. Because standard user-mode remote control software cannot capture the Secure Desktop, the remote session displays a black screen. Disabling the policy setting 'User Account Control: Switch to the secure desktop when prompting for elevation' via secpol.msc forces UAC prompts to appear on the standard user desktop, allowing remote support agents to view and handle prompts while maintaining active UAC elevation rules.

Step-by-Step Solution

1
Analyze the technical symptom described in the remote administration scenario.
Identified that the remote viewer goes black because Windows UAC switches context to the Secure Desktop (Winlogon desktop running at SYSTEM privileges), which non-system level remote software cannot screen-capture.
By default, UAC dims the desktop and isolates the credential prompt on a separate desktop to prevent software hooks or malware spoofing.
2
Evaluate the administrative requirement against possible UAC policy adjustments.
UAC notifications must remain enabled, ruling out solutions that bypass or turn off elevation prompts.
Corporate policy dictates that administrative privileges must still require explicit elevation approval.
3
Select the specific Local Security Policy (secpol.msc) setting that modifies desktop switching behavior while retaining prompts.
Disabling 'User Account Control: Switch to the secure desktop when prompting for elevation' presents UAC prompts on the interactive desktop.
This allows the remote support agent's application mirror to capture the prompt window and receive remote keyboard/mouse inputs.

Key Concept

Windows UAC Secure Desktop vs Interactive Desktop Isolation in Remote Administration
Question 1263Question

A desktop administrator is configuring Local Security Policy and User Account Control (UAC) settings on standalone Windows 11 Pro workstations to harden end-user systems. Which TWO configuration settings or UAC behaviors accurately describe proper administrative enforcement in this environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' prevents standard users from receiving a credential prompt when attempting administrative tasks.; Enabling 'User Account Control: Switch to the secure desktop when prompting for elevation' isolates the prompt by dimming the desktop and preventing software-based interaction from unprivileged processes.

Answer

The two correct answers are: setting the standard user elevation behavior policy to automatically deny requests, and enabling the secure desktop feature for elevation prompts.
Configuring the elevation prompt behavior for standard users to automatically deny elevation requests strictly enforces least privilege by blocking credential prompts for non-admin users. Additionally, enforcing the Secure Desktop for elevation prompts isolates the UAC dialog on a separate visual desktop layer, preventing malicious software from capturing or injecting user input during elevation.

Step-by-Step Solution

1
Analyze standard user elevation policies in Local Security Policy
Configuring UAC to 'Automatically deny elevation requests' ensures standard users cannot enter administrator credentials to elevate permissions.
This policy enforces strict least privilege by preventing standard accounts from initiating privilege escalation.
2
Evaluate Secure Desktop isolation settings
Enabling 'Switch to the secure desktop when prompting for elevation' runs prompts in an isolated desktop context.
Secure Desktop prevents malware or background applications from sending fake clicks or keystrokes to elevate privileges.

Key Concept

Windows User Account Control and Local Security Policy configuration
Question 1264Question

A Linux administrator is setting up an automated nightly maintenance script on a production server. The script must execute automatically every day at 2:00 AM, and its output must record the total available and used disk space across all mounted file systems in a human-readable format. Which of the following tools or utilities should the administrator configure or include in the script to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: crontab -e to open the job scheduler configuration and schedule the script execution time; df -h to display total, used, and available space on mounted file systems in human-readable units

Answer

The administrator must use crontab -e to schedule the automated daily execution at 2:00 AM and df -h to record file system disk availability in human-readable format.
The cron daemon handles task scheduling in Linux, and running crontab -e allows the user to define execution times (such as 2:00 AM). The df command with the -h flag reports file system disk space utilization in human-readable units (such as MB and GB), satisfying both requirements.

Step-by-Step Solution

1
Identify the proper tool for scheduling recurring tasks in Linux
Using crontab -e allows editing the cron schedule file to add the entry '0 2 * * * /path/to/script.sh'.
Cron is the native Linux daemon for running scheduled background tasks at designated times.
2
Identify the proper utility for displaying mounted file system storage space
Including the df -h command inside the maintenance script queries file system usage and formats sizes in megabytes or gigabytes.
The df utility specifically summarizes free and used disk space per mounted partition.

Key Concept

Linux task automation with cron and file system space monitoring with df
Estimated Time:2m 0s
Question 1265Question

A technician is dispatched to resolve a recurring ticket for an enterprise multifunction laser printer. Single-sided printing functions normally across all trays, but every double-sided print job results in a paper jam inside the internal return pathway immediately after the page is inverted. Which of the following components is most likely causing this failure?

Show answer & explanation

Answer: The duplexing assembly

Answer

The duplexing assembly is the most likely component causing paper jams during double-sided printing operations.
The duplexing assembly is specifically designed to reverse the paper motion and feed the page back through the printing pathway so that the second side can be printed. When single-sided printing works without error but double-sided printing consistently jams during the flip step, the issue lies directly with the rollers, gears, or switches within the duplexing assembly.

Step-by-Step Solution

1
Analyze the reported symptom and specific failure point.
Single-sided print jobs complete successfully, confirming that standard input trays, pickup rollers, and primary exit paths operate properly. Jams occur exclusively when double-sided printing is requested during the page inversion process.
Isolating the issue to double-sided printing eliminates general feeding components and focuses troubleshooting on the duplex unit path.
2
Identify the hardware component responsible for page reversal and secondary routing.
The duplexing assembly handles reversing paper direction and guiding the sheet back through the feed path for printing on the reverse side.
Worn rollers, damaged gears, or obstruction within the duplex pathway prevent the paper from re-entering correctly, causing paper jams specifically during inversion.
3
Determine the corrective action.
Inspect, clean, or replace the duplexing assembly rollers and feed mechanism.
Restoring mechanical integrity to the duplex unit allows the inverted pages to travel smoothly to complete two-sided print jobs.

Key Concept

Duplex Unit Troubleshooting
Question 1266Question

An organization is preparing to permanently decommission a batch of legacy storage media containing sensitive customer information in compliance with corporate security governance. Arrange the following steps of the hardware decommissioning and sanitization lifecycle in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps for the media decommissioning process is: 1) Record the serial numbers in the chain-of-custody log, 2) Perform a cryptographic wipe or logical purge, 3) Execute physical destruction of the storage media, and 4) Obtain and archive a signed Certificate of Destruction.
The correct lifecycle sequence begins by establishing a chain of custody through logging serial numbers. Next, a logical purge or cryptographic wipe is performed to protect data in transit or handling. After that, physical destruction permanently destroys the storage media. Finally, a Certificate of Destruction is acquired and archived to prove regulatory compliance.

Step-by-Step Solution

1
Identify initial asset tracking step
Record media serial numbers in the chain-of-custody documentation.
Chain of custody must be established immediately upon removing media from production to maintain asset accountability.
2
Perform preliminary sanitization
Perform a cryptographic erase or logical purge.
Erasing data logically mitigates risk during physical handling or transport prior to permanent physical destruction.
3
Destroy physical media
Execute physical destruction (shredding).
Physical destruction renders the physical sub-assembly permanently unusable.
4
Finalize compliance records
Obtain and archive the Certificate of Destruction.
Formal documentation confirms completion of the disposal process for regulatory compliance and audit purposes.

Key Concept

Chain of Custody and Data Destruction Lifecycle
Question 1267Question

A field technician is troubleshooting a newly assembled desktop workstation that fails to boot. When the power button is pressed, internal cooling fans spin up, but no video signal is sent to the monitor, and the motherboard speaker emits a repeating series of beep codes indicating a memory initialization failure. Which TWO of the following initial diagnostic actions should the technician take to resolve this failure?

Select all that apply

Show answer & explanation

Answer: Reseat the RAM modules and test each module individually in a single slot.; Verify that the memory modules are populated in the motherboard's designated primary slots for dual-channel operation.

Answer

The technician should reseat the RAM modules while testing each stick individually in a single slot, and verify that the modules are populated in the motherboard's designated primary slots for dual-channel operation.
POST beep codes pointing to memory errors indicate a problem with RAM hardware initialization. Reseating the modules, testing them individually, and ensuring they are populated in the motherboard's recommended dual-channel slot configuration directly address potential loose connections, bad slots, or incorrect channel population.

Step-by-Step Solution

1
Analyze the reported diagnostic symptoms
The continuous beep code indicates a failure during hardware initialization (POST), specifically related to physical memory recognition.
POST errors happen at the firmware/hardware level before video display or storage device handoff occurs.
2
Perform physical hardware isolation steps
Checking proper slot placement (per motherboard specifications) and testing memory modules one at a time isolates faulty slots, loose seatings, or bad modules.
Isolating individual components is the standard first step when diagnosing memory-related POST failures.

Key Concept

RAM Diagnostics and POST Error Isolation
Question 1268Question

A desktop technician is configuring Local Security Policy (secpol.msc) on a workstation running Windows 11 Pro in a shared lab environment. Management mandates that whenever a standard user account attempts an action requiring administrative privileges, Windows must automatically reject the elevation request without displaying a credential prompt. However, administrative users must retain the standard behavior of receiving a consent prompt on the Secure Desktop. Which Local Security Policy setting should the technician configure to meet the requirement for standard user accounts?

Show answer & explanation

Answer: Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'

Answer

Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'
The Local Security Policy setting 'User Account Control: Behavior of the elevation prompt for standard users' specifies how Windows handles privilege elevation requests initiated by standard user accounts. Setting this policy to 'Automatically deny elevation requests' prevents standard users from receiving a credential prompt when attempting administrative tasks, returning an access denied message immediately while leaving administrator prompt behaviors untouched.

Step-by-Step Solution

1
Identify the target user role and desired User Account Control (UAC) behavior
Standard users must have elevation requests automatically denied without seeing a credential prompt, while administrators keep consent prompts.
UAC policies distinguish between administrative accounts and standard user accounts.
2
Navigate to Local Security Policy (secpol.msc) under Security Settings > Local Policies > Security Options
Locate the granular UAC administrative policies.
Detailed UAC prompt behaviors for specific user account types are managed via Local Security Policy in Windows Pro/Enterprise editions.
3
Select the policy controlling standard user elevation prompt behavior
Configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This policy specifically forces Windows to return an access denied error whenever a standard user triggers an operation requiring elevation.

Key Concept

Windows Local Security Policy UAC Elevation Settings
Question 1269Question

A logistics coordinator receives an automated SMS text message on their company-issued smartphone requesting an immediate credential verification via an included short link to prevent account termination. Upon clicking the link, the user is brought to a fake corporate portal that captures their credentials. Which of the following social engineering threat types best describes this attack vector?

Show answer & explanation

Answer: Smishing

Answer

The attack vector described is smishing, which uses SMS text messaging to deliver fraudulent phishing links and collect sensitive credentials.
Smishing refers to phishing attacks that specifically utilize SMS text messaging to distribute deceptive links or urgent requests designed to harvest user credentials.

Step-by-Step Solution

1
Identify the delivery medium of the attack.
The attack was delivered via an SMS text message sent to a smartphone.
Determining the communication platform differentiates SMS-based attacks from voice-based or email-based attacks.
2
Analyze the goal of the deceptive message.
The message uses urgency to direct the victim to a fraudulent portal to harvest login credentials.
Phishing variants aim to trick users into handing over authentication data using counterfeit sites.
3
Classify the specific threat category based on medium and mechanism.
SMS + Phishing = Smishing.
Smishing is the precise CompTIA classification for phishing executed via text messages.

Key Concept

Identifying Social Engineering Delivery Vectors (Smishing)
Estimated Time:1m 0s
Question 1270Question

A Windows technician needs to manually prepare a newly installed secondary hard disk (Disk 1) from an elevated Command Prompt using the DiskPart utility. The objective is to select the target disk, create a primary partition, format it with the NTFS file system using a quick format, and assign it the drive letter 'E'. In what order should the technician execute the following commands within the DiskPart environment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: select disk 1, create partition primary, format fs=ntfs quick, and assign letter=E.
To properly prepare a new hard drive using DiskPart, a technician must first set focus to the physical disk (select disk 1), create the partition structure (create partition primary), format the partition with the designated file system (format fs=ntfs quick), and finally assign a drive letter (assign letter=E) to mount the volume.

Step-by-Step Solution

1
Select the target disk using 'select disk 1'.
Disk 1 is set as the active disk focus in DiskPart.
DiskPart requires explicit target selection before running disk management operations.
2
Create the primary partition using 'create partition primary'.
Unallocated space on Disk 1 is allocated into a primary partition.
A logical partition structure must exist on raw disk space prior to file system formatting.
3
Format the volume using 'format fs=ntfs quick'.
The primary partition is initialized with an NTFS file system structure.
Formatting establishes the file system required to store files on the partition.
4
Assign the drive letter using 'assign letter=E'.
Drive letter E: is mapped to the active volume in Windows.
Assigning a drive letter makes the formatted partition visible and accessible to applications and users.

Key Concept

DiskPart command sequence for initializing, partitioning, formatting, and mounting secondary drives.
Estimated Time:1m 30s
Question 1271Question

Match each storage data destruction or sanitization method on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Degaussing
Cryptographic Erase
Physical Shredding
Standard Overwriting

Matches

Show answer & explanation

Answer

Degaussing matches applying magnetic fields to magnetic drives; Cryptographic Erase matches deleting the encryption key on self-encrypting storage; Physical Shredding matches mechanically cutting media into fragments; Standard Overwriting matches replacing sectors with non-sensitive data for media reuse.
Each data disposal technique matches its specific media and operational mechanism: Degaussing disrupts magnetic domains on HDDs; Cryptographic Erase destroys decryption keys on self-encrypting solid-state drives; Physical Shredding mechanically pulverizes storage devices; and Standard Overwriting replaces readable sectors with non-sensitive patterns for device reuse.

Step-by-Step Solution

1
Identify magnetic-specific sanitization techniques
Degaussing relies on electromagnetic forces to sanitize magnetic HDDs and tapes.
Degaussing disrupts magnetic domains and is only effective on magnetic media, not solid-state storage.
2
Identify solid-state sanitization methods
Cryptographic Erase destroys the decryption key on self-encrypting SSDs.
Erasing the key instantly invalidates the encrypted ciphertext stored on flash chips.
3
Distinguish physical destruction from logical clearing
Physical shredding destroys hardware to prevent reuse, while standard overwriting replaces sector data so media can be reused.
Shredding is a physical disposal method, whereas overwriting is a logical clearing method.

Key Concept

Data Destruction and Disposal Methods
Question 1272Question

A desktop technician has quarantined a Windows workstation that was infected with malware. Before executing a full anti-malware scan to clean the system, which TWO steps of the CompTIA 7-step malware remediation process must be performed?

Select all that apply

Show answer & explanation

Answer: Disable System Restore in Windows; Update the anti-malware signature definitions

Answer

The technician must disable System Restore in Windows and update the anti-malware signature definitions before scanning and cleaning the machine.
According to the CompTIA 7-step malware remediation process, once a machine is isolated (quarantined), the technician must disable System Restore (Step 3) so that infected system states are not preserved. Next, as part of remediation (Step 4), the technician must update anti-malware signature files before initiating the scan to ensure detection signatures are up to date.

Step-by-Step Solution

1
Review the CompTIA 7-Step Malware Remediation Process order
Identify that Step 3 is Disable System Restore and Step 4 starts with updating anti-malware definitions prior to scanning.
Disabling System Restore prevents malware from preserving infected system files, and updating definitions ensures accurate detection.
2
Evaluate the prerequisite actions before running the scan
Select disabling System Restore and updating anti-malware definitions as required pre-scan tasks.
Pre-scan steps prepare the operating system and tools so the scan is effective and isolated.

Key Concept

CompTIA 7-Step Malware Remediation Process (Step 3: Disable System Restore; Step 4: Remediate infected systems by updating anti-malware and scanning)
Question 1273Question

A network technician is performing routine maintenance and connectivity troubleshooting on Windows 11 client workstations. Match each Windows networking command-line tool or applet shortcut on the left to its correct administrative function on the right.

Click a left item, then click its matching right item

Items

ipconfig /flushdns
netsh wlan show profiles
ncpa.cpl
ipconfig /release

Matches

Show answer & explanation

Answer

The correct pairings are: 'ipconfig /flushdns' matches clearing the local DNS client resolver cache; 'netsh wlan show profiles' matches listing saved wireless network profiles; 'ncpa.cpl' matches launching the Network Connections Control Panel applet; and 'ipconfig /release' matches sending a DHCPRELEASE message to forfeit the active IP address lease.
Each item corresponds to a specific Windows client network management feature: 'ipconfig /flushdns' purges cached DNS name resolutions; 'netsh wlan show profiles' displays configured wireless networks; 'ncpa.cpl' opens the legacy Network Connections applet directly; and 'ipconfig /release' informs the DHCP server that the client is relinquishing its active IPv4 lease.

Step-by-Step Solution

1
Analyze each Windows CLI switch and Control Panel applet name.
Identify the distinct networking sub-system targeted by each tool (DNS cache, Wi-Fi profiles, adapter GUI management, DHCP leasing).
Windows networking utilities serve specific, non-overlapping roles during configuration and diagnostics.
2
Pair each command with its administrative function.
Match ipconfig /flushdns to DNS clearing, netsh wlan show profiles to wireless profile enumeration, ncpa.cpl to Network Connections, and ipconfig /release to DHCP lease forfeiture.
Accurate tool identification is necessary for effective network troubleshooting and administration.

Key Concept

Windows Client Networking Diagnostic Tools and Command-Line Switches
Question 1274Question

A field technician is servicing a graphic designer's workstation that is currently executing a 32-bit edition of Windows 10 Professional. The workstation hardware was recently upgraded to 16 GB of RAM, but the operating system can only address approximately 3.7 GB. The designer asks the technician to upgrade the machine to 64-bit Windows 10 Professional while retaining all currently installed applications and user settings. Which of the following installation methods must the technician explain is required to complete this change?

Show answer & explanation

Answer: Perform a clean installation of the 64-bit operating system after backing up user data, as direct in-place upgrades between 32-bit and 64-bit architectures are unsupported.

Answer

A clean installation of the 64-bit operating system must be performed after backing up user data, because cross-architecture in-place upgrades are not supported by Windows.
Moving from a 32-bit OS to a 64-bit OS requires a complete change of system binaries, core kernel structures, and device driver models. Microsoft Windows does not support cross-architecture in-place upgrades. Therefore, a technician must back up user data and perform a clean installation from 64-bit installation media.

Step-by-Step Solution

1
Analyze the technical requirements and architecture constraints.
Recognize that the goal is moving from a 32-bit (x86) operating system to a 64-bit (x64) operating system to utilize 16 GB of system RAM.
32-bit operating systems are limited to a 4 GB address space, preventing full utilization of installed RAM above ~3.5–3.7 GB.
2
Evaluate supported Windows upgrade paths.
Determine that cross-architecture (32-bit to 64-bit) in-place upgrades are not supported by Microsoft Windows.
In-place upgrades preserve user files and installed applications only when staying within the same CPU architecture (e.g., 64-bit to 64-bit).
3
Identify the mandatory installation procedure.
Advise the user that user files must be backed up, a clean installation from 64-bit bootable media must be executed, and applications must be reinstalled.
A clean installation wipes or replaces the existing system files and registry structure, allowing the 64-bit kernel and HAL to be installed.

Key Concept

Windows Architecture Upgrade Requirements (32-bit vs 64-bit)
Question 1275Question

A desktop technician needs to change the User Account Control (UAC) settings on a Windows workstation to prevent notification prompts when software installation occurs. Place the following steps in the correct order to complete this configuration using the Graphical User Interface (GUI).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order is: Open the Windows Control Panel, navigate to User Accounts and click Change User Account Control settings, drag the slider down to the Never notify setting, and click OK to confirm the changes.
Configuring UAC via the GUI follows a logical administrative path: launching the Control Panel, selecting the User Accounts applet, opening the UAC settings dialog, adjusting the notification slider to the desired level, and committing the change by saving and confirming elevation.

Step-by-Step Solution

1
Open the Windows Control Panel
Displays all Control Panel management applets
Control Panel provides access to administrative account settings
2
Select User Accounts and click Change User Account Control settings
Opens the UAC adjustment slider dialog window
This applet houses the slider for user privilege elevation notifications
3
Move the slider to Never notify
Sets the UAC threshold to its lowest security level
This level prevents UAC prompts from appearing when applications make changes
4
Click OK and confirm the elevation prompt
Saves and applies the updated UAC policy
Administrative rights are required to alter system-wide UAC behavior

Key Concept

Windows User Account Control (UAC) GUI Configuration
Estimated Time:45s
Question 1276Question

An organization needs to secure the physical entrance of a sensitive server room to prevent tailgating, where an unauthorized person follows an authorized employee through a door. Which of the following physical security controls is designed specifically to enforce single-person entry and eliminate this risk?

Show answer & explanation

Answer: An access control vestibule

Answer

An access control vestibule is specifically designed with interlocking doors to allow only one person to pass through at a time, effectively preventing tailgating.
An access control vestibule (also known as a mantrap) features two interlocking doors that require the outer door to be completely closed and secured before the inner door opens. This physically restricts movement so only one individual can pass through at a time, eliminating tailgating.

Step-by-Step Solution

1
Identify the physical security threat in the scenario.
The primary risk identified is tailgating (piggybacking), where an unauthorized individual enters behind an authorized person through a single access point.
Understanding the specific physical security threat dictates which control mechanism is required.
2
Evaluate the mechanism of an access control vestibule.
An access control vestibule consists of two interlocking doors. The first door must close and lock before the second door unlocks, isolating the person entering.
This physical design enforces single-person entry and prevents unauthorized entry behind an authorized user.
3
Compare against non-optimal or improper controls.
Proximity readers, privacy filters, and bollards address authentication, visual eavesdropping, and vehicle impact respectively, but none physically block tailgating.
Selecting the correct physical barrier requires matching the specific protective function to the threat.

Key Concept

Physical Security Access Controls and Tailgating Prevention
Question 1277Question

A tier-2 desktop support technician is responding to an automated incident response alert on a Windows 11 domain-joined endpoint. The host machine is actively attempting unauthorized SMB connections to network shares and writing encrypted file headers across connected volumes. According to standard CompTIA malware remediation procedures, which of the following actions must the technician execute FIRST to properly contain the outbreak and prepare the operating system for remediation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disconnect all physical Ethernet cabling and disable active wireless network adapters on the endpoint.; Turn off System Protection and delete existing restore points on the infected system.

Answer

The technician must immediately quarantine the system by disabling all network interfaces and disable System Restore to purge infected restore points before initiating remediation.
Following symptom identification, the standard CompTIA malware remediation process dictates that technicians must first quarantine infected systems by disconnecting all network interfaces (Ethernet/Wi-Fi) to prevent lateral spread, and subsequently disable System Restore (System Protection) to clear volume shadow copies that may store malware files.

Step-by-Step Solution

1
Identify symptoms and verify active threat containment requirements
The host exhibits ransomware behavior, propagating across SMB and encrypting data.
Immediate action must follow the CompTIA 7-step remediation framework starting after identification.
2
Quarantine the infected system (Step 2)
Disconnecting Ethernet cables and disabling Wi-Fi cuts off command-and-control access and halts lateral spread across network shares.
Preventing lateral movement to corporate assets is the immediate priority during an active ransomware outbreak.
3
Disable System Restore (Step 3)
Turning off System Protection purges existing restore points containing infected files and prevents automatic reinfection.
If System Restore is left enabled, malware stored inside shadow volumes can reinstall itself post-remediation.

Key Concept

CompTIA 7-Step Malware Remediation Process (Step 2: Quarantine & Step 3: Disable System Restore)
Question 1278Question

A systems administrator needs to enforce an account lockout threshold and password complexity rules on a standalone Windows 11 Pro computer that is not connected to an Active Directory domain. Which administrative tool should the administrator open to configure these specific policies?

Show answer & explanation

Answer: Local Security Policy (secpol.msc)

Answer

Local Security Policy (secpol.msc) is the correct tool for defining local account lockout thresholds and password complexity requirements on standalone Windows workstations.
The Local Security Policy console (secpol.msc) allows administrators to configure security settings on a local machine, including Password Policy (complexity, minimum length) and Account Lockout Policy (lockout threshold, duration), making it the correct tool for non-domain-joined machines.

Step-by-Step Solution

1
Identify the administrative requirement
The administrator must set system-wide security policies (Account Lockout Policy and Password Policy) on a standalone workstation.
Security policies define system security behavior rather than individual user properties.
2
Select the proper Microsoft Management Console snap-in
Launch secpol.msc (Local Security Policy).
Local Security Policy contains Account Policies, including Password Policy and Account Lockout Policy, for systems not managed by Active Directory Group Policy Objects (GPOs).

Key Concept

Windows Administrative Snap-ins (Local Security Policy)
Estimated Time:1m 0s
Question 1279Question

A field service technician receives an urgent SMS text message on their corporate-managed smartphone stating that their Mobile Device Management (MDM) profile has expired and network access will be terminated within one hour. The message directs the technician to tap a shortened URL to re-authenticate with their Active Directory domain credentials. Which of the following social engineering threat types is best illustrated by this attack vector?

Show answer & explanation

Answer: Smishing

Answer

Smishing
Smishing (SMS Phishing) is a form of social engineering that uses SMS text messaging on mobile devices to trick victims into providing sensitive credentials or navigating to malicious websites. In this scenario, the attacker leveraged a fake MDM expiration notification sent via SMS to harvest Active Directory credentials.

Step-by-Step Solution

1
Analyze the delivery channel described in the security incident
Identified the primary delivery vector as an urgent SMS text message sent to a corporate mobile device.
Social engineering attacks are primarily categorized by their initial delivery medium and target scope.
2
Evaluate the objective and deceptive tactics used in the payload
The message creates artificial urgency (1-hour expiration) and includes a shortened hyperlink designed to steal domain credentials.
Creating urgency and incorporating fraudulent login links are hallmark features of phishing attacks.
3
Map the SMS delivery medium to the standard CompTIA threat classification
Concluded that SMS-based phishing is formally categorized as Smishing (Short Message Service phishing).
Phishing over SMS is specifically designated as smishing, distinguishing it from email phishing or voice phishing.

Key Concept

Social Engineering Threat Types - Smishing
Question 1280Question

A network security administrator is standardizing wireless security protocols and access controls across corporate offices, remote sites, and guest facilities. Match each wireless security protocol or access control mechanism on the left with its primary technical function on the right.

Click a left item, then click its matching right item

Items

EAP-TLS
SAE (Simultaneous Authentication of Equals)
RADIUS Server
Captive Portal

Matches

Show answer & explanation

Answer

EAP-TLS matches with enforcing mutual authentication via digital certificates on both client and server; SAE matches with replacing pre-shared key handshakes in WPA3 to protect against offline dictionary attacks; RADIUS Server matches with acting as the central authentication authority in an 802.1X enterprise framework; Captive Portal matches with intercepting unauthenticated web traffic on guest networks to present a web login or acceptance page.
Each protocol or mechanism directly corresponds to its core functional purpose: EAP-TLS leverages dual X.509 certificates for mutual authentication; SAE uses the Dragonfly protocol in WPA3-Personal to resist dictionary attacks; RADIUS provides backend authentication services in 802.1X deployment models; and a Captive Portal redirects unauthenticated browser traffic to a web landing page.

Step-by-Step Solution

1
Analyze enterprise EAP methods
Identify EAP-TLS as requiring digital certificates installed on both the client device and server for mutual authentication.
Unlike PEAP which only mandates server-side certificates, EAP-TLS strictly enforces dual-sided certificate validation.
2
Evaluate WPA3 personal authentication advancements
Map SAE (Simultaneous Authentication of Equals) to WPA3-Personal security enhancements.
SAE replaces the vulnerable WPA2 4-way PSK handshake with a zero-knowledge proof method that resists offline passphrase cracking.
3
Distinguish central AAA infrastructure from guest network access controls
Identify RADIUS as the central AAA backend for 802.1X user verification and Captive Portal as the web redirection control for guest access.
RADIUS handles centralized credential lookups, while Captive Portals isolate unauthenticated web sessions prior to internet access.

Key Concept

Wireless Authentication Protocols and Enterprise Security Controls
PreviousPage 64 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin