Examkin

All practice questions

3551 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 1301Question →

A systems support technician is troubleshooting a legacy 32-bit line-of-business application installed on standalone Windows 11 Pro workstations. When standard domain users run the application, it crashes upon attempting to write log data to its installation directory under C:\Program Files (x86)\VendorApp. Running the application as an administrator allows it to function, but corporate security policy strictly prohibits granting local administrative rights or disabling User Account Control (UAC). Which policy under Local Security Policy (secpol.msc) should be enabled to resolve the application errors while adhering to security mandates?

Show answer & explanation

Answer: User Account Control: Virtualize file and registry write failures to per-user locations

Answer

Enable 'User Account Control: Virtualize file and registry write failures to per-user locations' in Local Security Policy.
Enabling 'User Account Control: Virtualize file and registry write failures to per-user locations' allows Windows to transparently redirect failed write operations targeted at protected system locations (such as Program Files or HKEY_LOCAL_MACHINE) to a per-user location (%LOCALAPPDATA%\VirtualStore). This resolves compatibility issues for legacy 32-bit software without violating security baselines or requiring administrative rights.

Step-by-Step Solution

1
Identify the root cause of the application crash.
Legacy 32-bit software designed before UAC often attempts to write runtime state or log files directly to its install directory within C:\Program Files (x86).
Standard user accounts lack write permissions to system directories, causing permission denied errors.
2
Evaluate technical and security constraints.
Granting administrator privileges or disabling UAC is explicitly forbidden by security policy.
Least privilege principles must be maintained while enabling legacy application compatibility.
3
Configure UAC file and registry virtualization via Local Security Policy (secpol.msc).
Enabling 'User Account Control: Virtualize file and registry write failures to per-user locations' redirects unprivileged write operations to %LOCALAPPDATA%\VirtualStore.
Virtualization provides transparent backward compatibility for 32-bit legacy applications without altering NTFS permissions or granting administrative rights.

Key Concept

UAC File and Registry Virtualization
Question 1302Question →

A desktop support technician is reviewing default User Account Control (UAC) settings and behaviors on a Windows 11 Pro workstation. Which TWO of the following statements accurately describe how UAC functions to safeguard the operating system?

Select all that apply

Show answer & explanation

Answer: Standard user accounts are prompted to enter administrator credentials whenever an operation requires elevated privileges.; Administrative accounts operating in Admin Approval Mode are prompted to grant consent before high-privilege system modifications take effect.

Answer

Standard user accounts are prompted to enter administrator credentials whenever an operation requires elevated privileges, and administrative accounts operating in Admin Approval Mode are prompted to grant consent before high-privilege system modifications take effect.
User Account Control operates by restricting applications to standard user permissions even when logged in as an administrator. When a standard user attempts an action requiring administrative privileges, UAC requests valid admin credentials. When an administrator performs such an action, UAC prompts for consent to elevate the process token.

Step-by-Step Solution

1
Analyze standard user UAC elevation requirements.
Standard accounts cannot execute administrative tasks without authorization from an administrator account via credential entry.
UAC isolates system-level permissions from standard users to prevent unauthorized installation or configuration changes.
2
Analyze administrator account UAC elevation requirements.
Administrators run with standard access tokens until an operation requests elevation, triggering a consent prompt on the Secure Desktop.
This prevents background applications or malware from silently making system modifications using administrator rights.

Key Concept

User Account Control (UAC) Elevation and Prompt Behaviors
Question 1303Question →

A security technician is preparing to decommission server rack disk arrays containing retired magnetic Hard Disk Drives (HDDs) that stored unencrypted sensitive employee data. According to organizational security policy and CompTIA A+ guidelines, which TWO of the following sanitization and disposal methods are appropriate for destroying the data on these magnetic HDDs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Exposing the magnetic hard drives to a high-density electromagnetic field generator (degaussing); Passing the magnetic disk units through an industrial physical drive shredder

Answer

The correct procedures are degaussing the magnetic hard drives using a high-density electromagnetic field generator and physically destroying the drives using an industrial drive shredder.
For magnetic hard disk drives (HDDs), both degaussing (exposing magnetic platters to strong electromagnetic fields) and physical destruction (such as industrial drive shredding) ensure that confidential data cannot be retrieved forensically.

Step-by-Step Solution

1
Identify the media type and compliance sensitivity level.
The target media consists of magnetic Hard Disk Drives (HDDs) containing sensitive unencrypted corporate employee records.
Selecting the correct disposal method requires matching media physical construction (magnetic vs. flash memory) to required security thresholds.
2
Evaluate degaussing as a destruction method.
Degaussing neutralizes magnetic domains on disk platters, effectively rendering magnetic media blank and unreadable.
Degaussing is an industry-standard method for sanitizing magnetic media prior to disposal.
3
Evaluate physical shredding as a destruction method.
Industrial mechanical shredding destroys physical platters completely.
Physical destruction prevents any possibility of drive re-use or forensic data extraction.

Key Concept

Data Sanitization and Media Disposal Methods for Magnetic Drives
Question 1304Question →

A technician is troubleshooting a desktop workstation that powers on for two seconds—illuminating internal LEDs and spinning fans—before immediately shutting down without displaying video or emitting POST beep codes. Arrange the following diagnostic steps in the correct chronological order from the initial least-invasive check to the final advanced isolation step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The diagnostic process begins by disconnecting non-essential peripherals and internal hardware to eliminate short circuits, followed by verifying main motherboard power connections (24-pin ATX and 8-pin EPS12V). Next, the power supply's output rails should be checked with a PSU tester, and finally, the motherboard is removed from the enclosure to conduct a bench test to check for chassis shorts.
CompTIA hardware troubleshooting principles dictate moving from the simplest, least invasive actions to complex hardware teardowns. First, non-essential internal and external hardware is disconnected to eliminate short circuits. Second, primary motherboard power cables are verified. Third, the power supply is independently tested. Finally, complete disassembly and bench testing are performed to isolate chassis-grounding shorts.

Step-by-Step Solution

1
Isolate secondary peripherals and expansion hardware
Identifies if a failed SATA drive, PCIe card, or external USB device is shorting a power rail.
Always start with the least invasive step by removing optional hardware.
2
Verify primary motherboard power cable connections
Ensures the system board receives stable power and sense signals.
Loose 24-pin ATX or 8-pin CPU power connectors cause immediate shutdown under initial load.
3
Test PSU power rails independently
Verifies whether +12V, +5V, and +3.3V rails stay within acceptable voltage tolerances.
A failing PSU under internal load will trigger protection circuits and shut down power.
4
Perform out-of-case bench testing (breadboarding)
Determines if a metallic short between the chassis and motherboard standoffs is causing the shutdown.
This is the most invasive teardown step and is reserved for isolating grounding and structural motherboard shorts.

Key Concept

Methodological Hardware Isolation and Power Troubleshooting
Question 1305Question →

A financial controller at a manufacturing company receives an urgent telephone call from an individual claiming to be a senior network technician from the firm's internet service provider (ISP). The caller states that an impending line outage will disrupt business operations unless the controller immediately verifies their administrative portal login credentials and provides a one-time multi-factor authentication passcode. Which of the following social engineering threat types is described in this scenario?

Show answer & explanation

Answer: Vishing

Answer

Vishing
The scenario describes vishing (voice phishing), which occurs when an attacker uses telephone calls or voice technology to manipulate individuals into disclosing sensitive data, such as login credentials or passcodes.

Step-by-Step Solution

1
Identify the communication vector used by the threat actor
The attack takes place via an interactive telephone voice call.
Determining the medium (voice, electronic message, physical access) narrows down the social engineering threat classification.
2
Analyze the pretext and requested action
The attacker creates false urgency (impending network outage) to trick the user into revealing portal credentials and a multi-factor passcode.
Social engineering attacks create artificial urgency to bypass logical security controls and standard operational procedures.
3
Match the observed attack characteristics to standard CompTIA security taxonomy
Voice-based phishing attacks are classified specifically as vishing.
Vishing explicitly refers to voice phishing scenarios using telecommunication networks.

Key Concept

Vishing (Voice Phishing)
Estimated Time:1m 0s
Question 1306Question →

A desktop support technician is troubleshooting a Windows 11 workstation that cannot access internal corporate shares following an infrastructure migration. The local DHCP server has been updated with new DNS server addresses, but the workstation is still attempting to query the old DNS servers and retains an outdated lease. In what correct sequence should the technician execute the following ipconfig switches in an elevated Command Prompt to clear stale records, obtain the new network settings, and re-register the client with DNS?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of command-line operations is: first, flush the local DNS cache using 'ipconfig /flushdns'; second, release the current DHCP IP configuration using 'ipconfig /release'; third, request a new DHCP configuration with updated DNS server settings using 'ipconfig /renew'; and fourth, manually trigger DNS dynamic update registration using 'ipconfig /registerdns'.
The proper sequence begins by clearing outdated local name resolution entries via 'ipconfig /flushdns'. Next, releasing the old IP configuration with 'ipconfig /release' drops the existing lease parameters. Acquiring the updated network profile and new DNS server IPs requires running 'ipconfig /renew'. Finally, registering the workstation's Host (A) record with the new DNS infrastructure is accomplished with 'ipconfig /registerdns'.

Step-by-Step Solution

1
Execute 'ipconfig /flushdns'
Clears all cached DNS lookup entries from local memory so the client stops querying obsolete IP addresses.
Existing stale resolver entries must be purged prior to requesting new leases to prevent cached name resolution failures.
2
Execute 'ipconfig /release'
Discards the active dynamic IPv4 address and unbinds the TCP/IP stack from the existing lease configuration.
Releasing the address forces the network adapter to surrender stale IP assignments and server options.
3
Execute 'ipconfig /renew'
Negotiates a new lease with the DHCP server, pulling the newly configured primary and secondary DNS server IP addresses.
The client requires an updated DHCP lease to acquire the modified network scope options.
4
Execute 'ipconfig /registerdns'
Initiates a dynamic DNS registration request to update the host's A and PTR records on the domain DNS server.
Once new network parameters are acquired, explicitly registering DNS ensures surrounding network clients and servers can locate the workstation.

Key Concept

Sequential CLI Network Troubleshooting and IP/DNS State Refresh
Estimated Time:1m 30s
Question 1307Question →

A technician has successfully remediated an infected Windows workstation by running updated anti-malware scans and removing the detected threats. Which TWO of the following steps should the technician perform NEXT to complete the standard CompTIA malware remediation process?

Select all that apply

Show answer & explanation

Answer: Schedule automatic anti-malware updates and periodic system scans; Enable System Restore and create a fresh restore point

Answer

The technician should schedule automatic updates and periodic scans, and enable System Restore while creating a clean restore point.
Following malware removal (Step 4), the proper sequence requires scheduling ongoing scans and updates (Step 5), followed by re-enabling System Restore and creating a clean restore point (Step 6) to establish a safe baseline.

Step-by-Step Solution

1
Review the current step in the CompTIA 7-step malware remediation process.
The technician has completed Step 4 (Remediate infected systems).
Determines which steps sequentially follow threat removal.
2
Identify the next mandatory steps in the process.
Step 5 is scheduling updates and scans, followed by Step 6: enabling System Restore and creating a new restore point.
Ensures preventive measures and safe system recovery baselines are restored.

Key Concept

CompTIA 7-step Malware Remediation Process
Question 1308Question →

An IT technician is updating the company's storage media disposition policy to ensure compliance with NIST data security standards across different drive types and physical conditions. Match each data destruction method on the left with its appropriate operational description on the right.

Click a left item, then click its matching right item

Items

Degaussing
Cryptographic Erase
Industrial Shredding
Overwriting (Zero-Fill)

Matches

Show answer & explanation

Answer

Degaussing matches exposing magnetic media to electromagnetic fields. Cryptographic Erase matches deleting the media encryption key on self-encrypting SSDs/NVMe drives. Industrial Shredding matches mechanically cutting storage media into minute particles. Overwriting matches writing continuous patterns of zeroes across addressable sectors for safe drive redeployment.
Each data destruction method directly corresponds to its target mechanism: Degaussing disrupts magnetic domain alignment on magnetic drives; Cryptographic Erase destroys internal decryption keys on encrypted flash storage; Industrial Shredding physically pulverizes media; and Overwriting replaces data blocks with zeroes on working drives intended for reuse.

Step-by-Step Solution

1
Identify the underlying technology of the storage media (magnetic vs. flash storage).
Recognize that magnetic drives (HDDs, tapes) respond to electromagnetic fields, whereas flash drives (SSDs, NVMe) utilize semiconductor transistors unaffected by magnetic force.
Matching degaussing specifically to magnetic media and cryptographic erase to encrypted flash storage prevents invalid sanitization selections.
2
Evaluate hardware lifecycle goals (device reuse versus physical destruction).
Determine that functional drives intended for redeployment require non-destructive sanitization such as zero-fill overwriting or cryptographic erase, while defective drives require physical shredding.
Ensures data security compliance while optimizing hardware asset disposal policies.
3
Pair each destruction technique with its primary operational mechanism.
Link Degaussing to electromagnetic domain neutralization, Cryptographic Erase to key purging, Shredding to particle disintegration, and Overwriting to sector zero-filling.
Establishes accurate alignment with CompTIA A+ guidelines for data destruction and disposal.

Key Concept

Selecting proper data sanitization and physical disposal methods based on media architecture (magnetic vs. solid-state) and functional state.
Question 1309Question →

A network administrator is hardening a financial institution's wireless infrastructure to comply with updated security policies. The requirements state that all connecting wireless clients must authenticate individually using client-side digital certificates against a central RADIUS server, and the access points must completely eliminate susceptibility to wireless protocol downgrade attacks. Which TWO of the following configurations should the administrator implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) on the RADIUS server and access points.; Disable WPA2/WPA3 Transition (Mixed) Mode on the wireless access points.

Answer

The administrator must configure EAP-TLS as the authentication protocol and disable WPA2/WPA3 Transition Mode on the access points.
Implementing EAP-TLS ensures mutual authentication via digital certificates (requiring both client and RADIUS server certificates). Disabling WPA2/WPA3 Transition Mode forces all connecting devices to negotiate pure WPA3 security mechanisms, effectively mitigating potential protocol downgrade vulnerabilities.

Step-by-Step Solution

1
Analyze authentication protocol requirements for client certificates.
Identify EAP-TLS as the standard 802.1X protocol that mandates client-side and server-side digital certificates for mutual authentication.
PEAP and EAP-TTLS typically use password-based inner authentication (such as MSCHAPv2) with only server certificates, failing the mandatory client certificate policy.
2
Evaluate access point operational modes to prevent downgrade vectors.
Select disabling WPA2/WPA3 Transition Mode to enforce exclusive WPA3 Enterprise operation.
Transition mode permits legacy WPA2 client associations, leaving the network exposed to protocol downgrade attacks.

Key Concept

WPA3 Enterprise authentication architecture using EAP-TLS and 802.1X/RADIUS controls.
Estimated Time:2m 0s
Question 1310Question →

An IT technician is conducting a remote chat support session with a remote employee who is struggling to complete a mandatory workstation security setup. The user expresses frustration, stating that previous instructions contained overwhelming technical acronyms such as RADIUS, MFA, and SSO. Which of the following is the most appropriate communication practice for the technician to follow?

Show answer & explanation

Answer: Explain the troubleshooting steps using clear, plain language while avoiding technical jargon and acronyms.

Answer

Explain the troubleshooting steps using clear, plain language while avoiding technical jargon and acronyms.
CompTIA standards for professional communication require technicians to avoid using obscure jargon, abbreviations, and acronyms when assisting non-technical users. Communicating in plain language helps avoid confusion, alleviates customer frustration, and facilitates a smooth resolution.

Step-by-Step Solution

1
Analyze the customer's frustration and communication barriers reported in the chat.
Identify that complex jargon and technical acronyms (RADIUS, MFA, SSO) are preventing the user from successfully completing the configuration.
CompTIA professional communication guidelines specify that technicians must adapt their language to match the end-user's technical comprehension level.
2
Determine the appropriate communication strategy to resolve the issue effectively.
Translate complex technical concepts into plain, accessible language and guide the user step by step without using acronyms.
Avoiding jargon fosters rapport, builds user trust, and ensures clear instruction during support interactions.

Key Concept

Professional Communication: Avoiding Technical Jargon and Acronyms
Question 1311Question →

A tier 2 IT support technician is reviewing an incident report from a regional office. A visitor wearing a high-visibility utility vest approached the front reception desk, presented a printed fake work order for emergency electrical maintenance, and convinced the receptionist to grant access to restricted communications closets without standard badge verification. Once inside, the intruder installed a rogue hardware keylogger on an unmonitored workstation. Which of the following social engineering techniques was primarily used to gain initial unauthorized physical entry to the facility?

Show answer & explanation

Answer: Pretexting

Answer

The correct threat classification is Pretexting.
Pretexting is the social engineering technique where an attacker crafts a fictitious story or scenario (the pretext), often adopting a persona such as a repair technician or auditor, to trick individuals into granting physical or logical access they should not have.

Step-by-Step Solution

1
Analyze the attack vector and scenario details.
The attacker physically interacted with staff, posed as a maintenance worker, used a fake work order, and established a plausible narrative to bypass credential checks.
Identifying the method of interaction helps differentiate physical social engineering vectors from digital vectors.
2
Evaluate the definition of Pretexting.
Pretexting is defined by inventing a scenario (a pretext) to persuade a target to perform actions or release sensitive access.
The use of a fake work order and utility uniform directly constitutes creating a fake pretext to gain entry.
3
Distinguish Pretexting from alternative physical and digital threats.
Tailgating relies on physically following someone through a door; spear phishing relies on targeted emails; baiting relies on enticing physical media.
Eliminating misclassified threats ensures accurate identification of the social engineering tactic.

Key Concept

Pretexting in Social Engineering
Question 1312Question →

A IT support technician is tasked with upgrading a workstation currently running a 32-bit edition of Windows 7 Home Premium to 64-bit Windows 10 Pro. The user requests an in-place upgrade so that all existing applications and user settings are preserved without needing a reinstall. Which of the following statements accurately describes the required installation procedure?

Show answer & explanation

Answer: An in-place upgrade across different processor architectures is unsupported, requiring a backup of user data followed by a clean installation of 64-bit Windows 10 Pro.

Answer

An in-place upgrade across different processor architectures (32-bit to 64-bit) is not supported by Microsoft Windows. The technician must back up user data and applications, reformat or repartition the drive, and perform a clean installation of 64-bit Windows 10 Pro.
Microsoft Windows does not support in-place upgrades between 32-bit (x86) and 64-bit (x64) architectures. To transition from a 32-bit operating system to a 64-bit operating system, a clean installation must be performed, requiring backups of files and reinstallation of applications.

Step-by-Step Solution

1
Analyze the source and target OS architectures and editions
Source OS is 32-bit Windows 7 Home Premium; Target OS is 64-bit Windows 10 Pro.
Determining processor architecture (32-bit vs. 64-bit) dictates whether an in-place upgrade path exists.
2
Evaluate Windows upgrade path limitations
In-place upgrades require matching architecture (32-bit to 32-bit or 64-bit to 64-bit). Cross-architecture upgrades are unsupported.
System files, hardware drivers, and registry structures differ fundamentally between 32-bit and 64-bit architectures.
3
Determine the necessary installation method
Select a clean installation procedure.
A clean installation reinitializes system files and allows boot-level setup of the 64-bit operating system.

Key Concept

Windows OS Architecture Upgrade Constraints
Estimated Time:1m 15s
Question 1313Question →

A corporate workstation on a secure network segment has triggered automated endpoint alerts for an active file-encrypting ransomware outbreak. Place the following remediation tasks in the correct sequence according to the official CompTIA 7-step malware removal procedure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the CompTIA 7-step malware removal process starting from isolation: Quarantine infected system -> Disable System Restore -> Remediate infected system -> Schedule scans and run updates -> Enable System Restore and create a restore point -> Educate the end user.
The CompTIA standard 7-step malware removal process follows a strict order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate end user. In this scenario, symptoms have been identified by the automated alert, making quarantining the host via physical/logical network disconnection the immediate mandatory step, followed consecutively by disabling restore functions, scanning/cleaning, scheduling/updating, re-enabling restore points, and finally user education.

Step-by-Step Solution

1
Isolate the endpoint from the local network environment.
Network interfaces disabled, satisfying Step 2 (Quarantine the infected system) as symptoms are already identified in the scenario.
Prevents ransomware from spreading laterally to corporate network shares and adjacent systems.
2
Disable System Restore / System Protection on the infected endpoint.
Shadow copies and System Restore points are disabled/cleared, satisfying Step 3.
Prevents malware files stored within restore points from persisting or reinfecting the system post-remediation.
3
Perform malware scan and eradication using updated security tools.
Malicious ransomware binaries and registry entries are purged, satisfying Step 4 (Remediate infected systems).
Removes active malware threats in an isolated boot environment such as Safe Mode.
4
Configure recurring scan schedules and install latest operating system patches.
Automatic scans are scheduled and OS updates applied, satisfying Step 5.
Protects against re-infection and closes vulnerabilities exploited by malware.
5
Re-enable System Protection and create a fresh system baseline snapshot.
System Restore is re-enabled and a clean restore point created, satisfying Step 6.
Establishes a known good configuration baseline for future rollback if necessary.
6
Provide security awareness guidance to the user.
User completes training, satisfying Step 7 (Educate the end user).
Mitigates human risk factors that allowed initial malware entry.

Key Concept

CompTIA 7-Step Malware Removal Process
Question 1314Question →

A field technician is troubleshooting a laptop equipped with an organic light-emitting diode (OLED) display screen. The laptop powers on and successfully displays video on an external projector, but the internal OLED screen remains completely dark. Which of the following statements correctly evaluate the system symptoms and diagnostic steps for this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The graphics processing unit is operating correctly because it successfully renders and outputs video to the external projector.; The failure is localized to the internal panel, screen ribbon cable, or system board connection rather than a backlight inverter.

Answer

The graphics processing unit is operating correctly because video is output to the external projector, and the failure is localized to the internal panel, ribbon cable, or connection rather than an inverter board.
The correct options recognize that a functional external video signal proves the GPU is operational, and that OLED screens lack traditional backlight inverters, isolating the issue to the internal OLED panel, ribbon cabling, or motherboard display headers.

Step-by-Step Solution

1
Isolate the video generation subsystem using an external display device.
Since the external projector displays the operating system interface properly, the GPU and video controller are validated as functional.
Eliminates GPU hardware failure and driver corruption as primary causes of the black screen.
2
Analyze the underlying display technology of the internal laptop screen.
Identify that the screen is an OLED panel, which uses self-emitting pixels without a separate backlight or inverter board.
Prevents misdiagnosing the issue as a backlight inverter failure and narrows focus to the internal display cable, panel power, or panel assembly.

Key Concept

Display Hardware Isolation and OLED Panel Troubleshooting
Question 1315Question →

A system administrator is configuring a Windows 11 laptop for a field user who frequently travels. The user needs to maintain offline access to corporate network share files and store persistent domain authentication details for remote file servers without re-entering credentials. Which TWO Windows Control Panel utilities should the technician use to configure these features? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Sync Center; Credential Manager

Answer

The technician should use Sync Center to manage offline file synchronization and Credential Manager to store network share authentication details.
Sync Center enables users to configure Offline Files so network folder contents remain available offline, while Credential Manager holds persistent Windows Credentials for seamless network share access.

Step-by-Step Solution

1
Identify the requirement for maintaining offline access to network share files.
Open the Sync Center Control Panel applet to manage Offline Files partnerships and synchronization schedules.
Sync Center is the dedicated Control Panel applet for managing local offline access to shared network files.
2
Identify the requirement for saving persistent domain credentials for remote shares.
Open Credential Manager in Control Panel and add Windows Credentials for the target network resources.
Credential Manager securely stores user credentials for network shares and domain resources so the user does not need to re-authenticate.

Key Concept

Windows Control Panel Applet Functions
Question 1316Question →

An IT security analyst is tasked with decommissioning a storage array that contains self-encrypting enterprise NVMe solid-state drives (SSDs) holding sensitive customer financial data. The company plans to reuse the SSDs in an internal, non-sensitive testing laboratory. According to NIST SP 800-88 guidelines for media sanitization (Purge level), which of the following actions will securely sanitize the flash storage while keeping the drives operational for reuse?

Show answer & explanation

Answer: Execute a cryptographic erase (CE) command utilizing the drive firmware and Physical Security ID (PSID).

Answer

Execute a cryptographic erase (CE) command utilizing the drive firmware and Physical Security ID (PSID).
Executing a cryptographic erase (CE) via drive firmware and PSID deletes or overwrites the internal Media Encryption Key (MEK) stored on self-encrypting drives (SEDs). Without this key, all stored data becomes permanently unrecoverable cipher text, satisfying security compliance while keeping the physical NVMe SSD functional for redeployment.

Step-by-Step Solution

1
Identify media type and disposition goals
The target drives are flash-based solid-state drives (NVMe SSDs) with built-in hardware encryption (SEDs) intended for hardware reuse.
Selection of data destruction techniques depends directly on physical storage architecture and whether the hardware will be destroyed or redeployed.
2
Evaluate sanitization methods for solid-state drive reuse
Physical destruction prevents reuse. Degaussing is ineffective on flash memory. OS formatting and basic logical overwriting leave inaccessible data remnants due to SSD wear-leveling and over-provisioning.
SSD controllers abstract physical flash blocks, requiring firmware-level sanitization methods.
3
Select the appropriate NIST SP 800-88 Purge method
Cryptographic erase (CE) / Sanitize Block Erase securely destroys the Media Encryption Key (MEK), rendering all stored data permanently unreadable while leaving the drive usable.
Cryptographic Erase fulfills Purge-level sanitization requirements for self-encrypting SSDs prior to redeployment.

Key Concept

Cryptographic Erase and Solid-State Drive (SSD) Sanitization
Estimated Time:1m 30s
Question 1317Question →

An IT administrator is deploying automated maintenance scripts on a Windows 11 Pro system. When these scripts execute operations requiring elevated privileges while an administrative user is logged in, execution halts due to an interactive elevation prompt appearing on the dimmed desktop. The administrator needs to adjust the Local Security Policy (secpol.msc) so that elevation requests for administrative users in Admin Approval Mode proceed automatically without user interaction or desktop dimming. Which policy setting should the administrator configure?

Show answer & explanation

Answer: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode -> Elevate without prompting

Answer

Configure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Elevate without prompting' in Local Security Policy.
In Windows Local Security Policy (secpol.msc), configuring 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Elevate without prompting' allows applications and scripts launched by administrative accounts to automatically acquire administrative privilege tokens without halting for user consent or dimming the display.

Step-by-Step Solution

1
Open Local Security Policy console by running secpol.msc.
Navigates to the local security management snap-in.
Security policies governing UAC prompts for local accounts are managed under Security Settings.
2
Navigate to Security Settings -> Local Policies -> Security Options.
Displays all granular User Account Control policy options.
UAC policies are configured under the Local Policies Security Options node.
3
Locate 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' and set its value to 'Elevate without prompting'.
Administrative elevation requests bypass consent prompts automatically.
This configuration allows background tasks and administrative scripts to execute elevated tasks seamlessly without halting for interactive confirmation.

Key Concept

User Account Control Security Policy Elevation Behavior
Estimated Time:1m 15s
Question 1318Question →

An IT forensic technician is preparing to transport a confiscated smartphone containing critical evidence to a secure testing facility. To ensure the device cannot be wiped remotely or altered via cellular or wireless networks while in transit, which of the following physical security controls should be used?

Show answer & explanation

Answer: A Faraday bag

Answer

A Faraday bag is the appropriate physical control to isolate the mobile device from all wireless communication signals during transit.
A Faraday bag provides electromagnetic shielding that blocks all incoming and outgoing wireless signals (cellular, Wi-Fi, Bluetooth, GPS). This physically prevents remote wipe commands or unauthorized network connectivity while the mobile phone is transported.

Step-by-Step Solution

1
Identify the threat presented in the scenario.
The main threat is unauthorized remote access or remote wiping of the device over cellular, Wi-Fi, or Bluetooth networks.
Securing physical evidence requires maintaining digital chain of custody and preventing data destruction.
2
Evaluate physical security controls for electromagnetic shielding capability.
Faraday bags create a metallic enclosure (Faraday cage effect) that prevents radio frequency (RF) signals from penetrating.
Without RF signals, the device cannot receive remote wipe commands or connect to outside networks.
3
Distinguish from non-shielding physical controls.
Tamper-evident seals, cable locks, and RFID tags serve physical anti-theft, inventory, or anti-tampering functions but lack electromagnetic shielding capabilities.
Selecting a control designed for physical theft or tracking will not mitigate the network-based threat of a remote wipe.

Key Concept

Faraday Enclosure / Signal Shielding
Question 1319Question →

A security administrator is hardening a standalone Windows 11 workstation. The organization requires that administrators must re-enter credentials on a secure desktop when elevating privileges, standard users must be automatically denied elevation without a prompt, and the changes must take effect immediately without a reboot. Arrange the following administrative steps in the correct logical sequence to accomplish this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: Open the Local Security Policy console (secpol.msc) with elevated privileges, navigate to Security Settings > Local Policies > Security Options, configure the administrator elevation prompt behavior to prompt for credentials on the secure desktop, configure the standard user elevation prompt behavior to automatically deny elevation requests, and execute gpupdate /force from an elevated Command Prompt.
To achieve granular security control over UAC prompt behaviors, the administrator must first open secpol.msc with administrative privileges and navigate to Security Settings > Local Policies > Security Options. Next, the administrator configures the prompt behavior for administrators to require credentials on the secure desktop. Then, the prompt behavior for standard users is set to automatically deny elevation requests. Finally, running gpupdate /force in an elevated Command Prompt forces the operating system to re-read and enforce the local security baseline immediately without restarting.

Step-by-Step Solution

1
Launch Local Security Policy console
The Local Security Policy snap-in (secpol.msc) opens with full administrative access.
Administrative rights are required to view and modify security settings across the system.
2
Locate UAC policy settings
Expand Security Settings > Local Policies > Security Options in the navigation pane.
User Account Control behavior policies are maintained specifically under the Security Options subfolder.
3
Set Administrator UAC prompt behavior
Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
This satisfies the explicit requirement for administrative users to re-enter credentials on a secure desktop during privilege elevation.
4
Set Standard User UAC prompt behavior
Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This satisfies the requirement to suppress credentials prompts and automatically reject elevation requests initiated by non-admin accounts.
5
Apply policy updates without rebooting
Execute gpupdate /force in an elevated Command Prompt window.
This forces the operating system to immediately update and enforce local policy changes without restarting the workstation.

Key Concept

Windows Local Security Policy (secpol.msc) User Account Control Policy Hardening
Question 1320Question →

A helpdesk technician has confirmed that a company laptop is infected with a trojan that is generating unauthorized network traffic. Following the standard CompTIA malware remediation process, which action should the technician take NEXT?

Show answer & explanation

Answer: Isolate the computer by disconnecting its wired network cable and disabling Wi-Fi.

Answer

Isolate the computer by disconnecting its wired network cable and disabling Wi-Fi.
According to the standard CompTIA 7-step malware remediation workflow (1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected system, 5. Schedule updates/scans, 6. Enable System Restore/create restore point, 7. Educate user), the immediate step following symptom identification is quarantining the system. Disconnecting network connections isolates the system to contain the threat.

Step-by-Step Solution

1
Identify the current step in the CompTIA 7-step malware removal process.
The technician has already identified and verified the malware infection (Step 1).
Recognizing the starting stage determines the proper sequential response.
2
Determine Step 2 of the 7-step malware removal process.
Step 2 is to quarantine the infected system.
Quarantining/isolating the host prevents malware from spreading to other network assets or communicating with external command-and-control servers.

Key Concept

CompTIA 7-Step Malware Remediation Process - Quarantine
Estimated Time:1m 0s
PreviousPage 66 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin