Examkin

All practice questions

3551 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 1581Question →

An IT technician in an engineering laboratory responds to a workstation flagged for suspicious file-encrypting worm activity. The technician has already quarantined the machine by disconnecting its network cable and disabling all wireless adapters. Which of the following actions should the technician perform NEXT before conducting a full system anti-malware scan? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable System Restore on the infected workstation to prevent malicious files from being cached in restore points.; Download the latest anti-malware signature updates on a clean machine and transfer them to the isolated system using removable media.

Answer

The technician must disable System Restore on the infected system and manually update anti-malware definitions using removable media before scanning.
Following the CompTIA 7-step malware remediation process, once a system is quarantined (Step 2), the technician must disable System Restore (Step 3) to prevent clean files from being overwritten by infected restore points. The technician must then update anti-malware signature definitions (Step 4a) out-of-band using removable media to keep the system isolated before initiating full scans (Step 4b).

Step-by-Step Solution

1
Review current remediation stage within the CompTIA 7-step process
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
Determining current progress identifies which prerequisite steps remain prior to active remediation.
2
Execute Step 3 of malware remediation (Disable System Restore)
System Restore is turned off, clearing existing restore points.
If System Restore remains enabled, Windows might back up infected system files or allow malware to restore itself after clean-up.
3
Execute Step 4a of malware remediation (Update anti-malware environment)
Anti-malware signatures are updated out-of-band via USB flash drive without reconnecting to the network.
Scanning with outdated definitions may miss new variants, while reconnecting to a network breaks quarantine.

Key Concept

CompTIA 7-Step Malware Remediation Process
Estimated Time:2m 0s
Question 1582Question →

An IT technician is decommissioning legacy corporate workstations that contain a mix of magnetic hard disk drives (HDDs) and solid-state drives (SSDs) containing confidential employee information. The drives must be sanitized prior to transferring the hardware to an external recycling facility. Which of the following actions represent valid data destruction methods for these storage media? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Physical shredding or disintegration of both HDDs and SSDs into tiny physical fragments; Exposing the magnetic hard disk drives to a high-capacity degausser

Answer

Physical shredding of both drive types and degaussing the magnetic hard disk drives are valid data destruction methods.
Physical shredding or disintegration destroys the physical structure of both HDDs and SSDs, rendering data recovery impossible regardless of storage architecture. Degaussing subjects magnetic storage to a powerful magnetic field that disrupts magnetic domains, permanently destroying data on HDDs.

Step-by-Step Solution

1
Identify the media types being decommissioned
The media consists of both magnetic HDDs (magnetic domain storage) and SSDs (flash memory electronic storage).
Different storage technologies require specific sanitization and destruction techniques.
2
Evaluate degaussing against magnetic vs solid-state media
Degaussing works on HDDs by destroying magnetic fields, but has no sanitization effect on non-magnetic SSD flash memory.
Degaussers disrupt magnetic domains; semiconductors do not store data magnetically.
3
Evaluate physical destruction across media types
Physical shredding or disintegration renders both magnetic platters and flash memory chips physically destroyed.
Physical destruction prevents raw data extraction from any storage medium.

Key Concept

Data Destruction and Sanitization Methods for HDDs vs. SSDs
Question 1583Question →

A system administrator is preparing to deploy an in-house developed software utility to corporate Windows 11 desktop workstations. During pre-deployment testing, the installer prompts for elevated credentials via User Account Control (UAC) and completes successfully under an administrator account. However, when standard domain users launch the installed application from their desktops, the application immediately crashes with a file access permission violation when attempting to write temporary working files. Which of the following configuration changes should be made to resolve this issue while adhering to security best practices?

Show answer & explanation

Answer: Modify the application configuration so that temporary files are written to the logged-in user's %LOCALAPPDATA% folder rather than the application's Program Files directory.

Answer

Modify the application configuration so that temporary files are written to the logged-in user's %LOCALAPPDATA% folder rather than the application's Program Files directory.
The correct answer addresses the root cause of the permission violation. In modern Windows operating systems, standard user accounts have read and execute rights in the Program Files directory but are blocked from creating or modifying files there. Applications designed for standard users should store temporary data, logs, and user settings inside the user's profile directory (such as %LOCALAPPDATA%), where standard users naturally hold write permissions.

Step-by-Step Solution

1
Analyze the file permission model in Windows operating systems.
Identified that Program Files and Program Files (x86) are restricted system directories where standard users possess read/execute permissions but lack write permissions.
Windows uses default access control lists (ACLs) on system directories to prevent unprivileged users or malware from altering executable files.
2
Evaluate storage locations intended for user-specific dynamic data.
Determined that standard users have full write permissions within their personal profile paths (e.g., %USERPROFILE%\AppData\Local or %LOCALAPPDATA%).
Applications must separate global read-only binaries from per-user writable data to function under standard user privileges.
3
Select the resolution that aligns with security best practices.
Reconfiguring the application to direct temporary working files to %LOCALAPPDATA% solves the crash without relaxing system directory security controls.
Maintaining default NTFS permissions on system directories prevents security risks while enabling proper application execution.

Key Concept

Application Data Storage Locations and User Access Permissions
Question 1584Question →

An IT security administrator is establishing mobile endpoint and embedded system security policies for an enterprise organization. Match each operational security goal on the left with the correct policy control or technical implementation on the right.

Click a left item, then click its matching right item

Items

Restricting mobile application functionality automatically when a device physically exits an authorized corporate facility campus.
Encapsulating corporate apps and data on employee-owned (BYOD) devices to allow targeted removal without touching personal content.
Preventing unauthorized execution of unverified binaries on embedded industrial sensors that lack traditional antivirus software.
Verifying device OS patch state, encryption status, and root/jailbreak integrity before permitting a remote VPN connection.

Matches

Show answer & explanation

Answer

1. Restricting mobile application functionality based on physical perimeter location matches with Geofencing.
2. Encapsulating corporate apps and data on BYOD devices matches with Containerization.
3. Preventing unauthorized binary execution on embedded devices matches with Application Whitelisting.
4. Verifying device security health before granting VPN access matches with Posture Assessment.
Each requirement directly aligns with its specific technical implementation:
- Location-driven security enforcement uses Geofencing.
- Segmenting corporate data from personal storage on BYOD endpoints utilizes Containerization.
- Restricting execution on resource-constrained embedded systems relies on Application Whitelisting.
- Evaluating endpoint health before establishing connection tunnels requires Posture Assessment.

Step-by-Step Solution

1
Analyze location-based policy enforcement requirements for mobile devices.
Identify that using location services (GPS/cellular/Wi-Fi) to restrict app capabilities outside a physical boundary defines geofencing.
Geofencing dynamically alters device posture or application availability based on real-time location metrics.
2
Evaluate BYOD data isolation and selective wipe controls.
Identify containerization (MAM) as the technology designed to sandbox corporate assets from personal user storage.
Containerization ensures corporate privacy control while maintaining personal user privacy on non-corporate-owned hardware.
3
Determine execution control methods for embedded IoT hardware.
Match application whitelisting with embedded system binary execution control.
Embedded systems frequently lack compute resources for real-time signature antivirus scanning, making strict whitelisting the optimal default-deny mitigation.
4
Examine pre-connection health validation controls.
Associate checking patch levels and root status before VPN access with posture assessment.
Posture assessment ensures endpoints satisfy baseline health requirements prior to network connection authorization.

Key Concept

Mobile Device and Embedded System Security Controls
Question 1585Question →

A shipping warehouse technician replaces the media roll on a direct thermal barcode printer used for generating shipping labels. Following the roll replacement, the printer correctly feeds the paper and operates without error lights during print jobs, but all output labels come out completely blank. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: Standard thermal-transfer or plain paper label stock was installed instead of direct thermal paper.

Answer

Standard thermal-transfer or plain paper label stock was installed instead of direct thermal paper.
Direct thermal printers utilize a thermal printhead to apply heat directly to specially treated heat-sensitive media. If standard paper or thermal-transfer labels (which require an ink ribbon) are installed by mistake, the heat applied by the printhead produces no chemical reaction, resulting in completely blank labels.

Step-by-Step Solution

1
Analyze the printer technology and reported symptom
The printer uses direct thermal technology (which uses heat-sensitive media without ink or toner ribbon) and feeds paper normally but leaves no visible marks.
Direct thermal printers do not use ribbons; heat applied by the printhead triggers a chemical reaction on special direct thermal paper to create images.
2
Evaluate the recent change
The issue immediately followed the replacement of the label media roll.
Replacing direct thermal labels with standard thermal-transfer paper or plain labels prevents any image formation because standard paper has no heat-reactive coating.
3
Select the correct root cause
Confirming incorrect media stock as the root cause.
Verifying media compatibility is the primary step when blank pages follow a media replacement on a thermal printer.

Key Concept

Direct thermal printing media requirements
Estimated Time:1m 15s
Question 1586Question →

An IT security technician is updating baseline security policies for workstations deployed across an enterprise network. Match each workstation hardening control on the left with the specific risk or attack vector it is primarily designed to mitigate on the right.

Click a left item, then click its matching right item

Items

Restricting 'Allow log on locally' rights via Local Group Policy
Enforcing screensaver timeout with password protection
Disabling the built-in Guest account and renaming the default Administrator account
Disabling AutoPlay and AutoRun policies across all storage volumes

Matches

Show answer & explanation

Answer

Restricting local logon rights matches with preventing non-authorized user accounts from establishing interactive physical console sessions. Enforcing screensaver timeout with password protection matches with preventing unauthorized physical access to an active desktop session when left unattended. Disabling the built-in Guest account and renaming the Administrator account matches with mitigating automated dictionary attacks targeting standard accounts. Disabling AutoPlay and AutoRun policies matches with preventing automatic execution of untrusted payloads when removable media is inserted.
Each workstation hardening control addresses a specific vulnerability vector. Restricting local logon permissions prevents unauthorized accounts from initiating physical console sessions. Password-protected screen locks prevent physical exposure of unattended active sessions. Disabling or renaming built-in accounts thwarts automated credential guessing against default account identifiers. Disabling AutoPlay/AutoRun stops drive-by code execution from connected removable storage.

Step-by-Step Solution

1
Analyze local user rights policies for interactive logon control.
Determined that 'Allow log on locally' controls physical console logon capability.
Restricting this permission ensures that only authorized personnel can log into the local workstation console.
2
Evaluate inactivity screen locking mechanisms.
Identified that password-protected screen saver timeouts lock active sessions automatically.
When a technician or user steps away, the lock prevents passerby tampering and shoulder surfing.
3
Examine account obfuscation and disabling policies.
Identified that default accounts like Guest and Administrator are predictable targets.
Renaming or disabling default accounts blocks automated scripts relying on standard account names.
4
Assess removable media execution controls.
Determined that AutoPlay/AutoRun policies govern media file auto-execution.
Disabling these features stops rogue USB flash drives or external drives from launching malicious code automatically.

Key Concept

Workstation Hardening and Threat Mitigation Controls
Estimated Time:2m 0s
Question 1587Question →

A technician is troubleshooting a Windows workstation that fails to boot, displaying error code 0xc000014c with a message indicating that the Boot Configuration Data (BCD) file is missing or contains errors. The technician boots the computer into the Windows Recovery Environment (WinRE) and opens the Command Prompt. Which of the following commands should the technician execute to scan for installed operating systems and rebuild the BCD repository?

Show answer & explanation

Answer: bootrec /rebuildbcd

Answer

The command bootrec /rebuildbcd scans all connected storage drives for installed Windows operating systems and allows the technician to rebuild the Boot Configuration Data (BCD) store.
Executing bootrec /rebuildbcd searches all mounted storage volumes for Windows installations and allows the user to rebuild the Boot Configuration Data store, directly resolving BCD corruption errors such as 0xc000014c.

Step-by-Step Solution

1
Analyze the boot error symptom code 0xc000014c.
Identified that the system cannot locate or read the Boot Configuration Data (BCD) file.
Error 0xc000014c specifically indicates missing or corrupted BCD information.
2
Boot into the Windows Recovery Environment (WinRE) Command Prompt.
Opened an offline command line interface with administrative recovery utilities.
Boot environment files cannot be modified while the standard operating system is active or failing to load.
3
Execute the utility command bootrec /rebuildbcd.
The utility scans the disk partitions for Windows installations and prompts to re-add them to the BCD repository.
This process constructs a clean BCD store, enabling Windows Boot Manager to start the operating system.

Key Concept

Rebuilding Windows Boot Configuration Data (BCD)
Question 1588Question →

A systems administrator needs to configure a network firewall to allow remote command-line administration of a headless Linux web server over an untrusted external network. The management session must ensure that login credentials and command outputs are fully encrypted in transit. Which of the following default protocol and port combinations should the administrator permit through the firewall?

Show answer & explanation

Answer: SSH over TCP port 22

Answer

SSH over TCP port 22 is the correct choice because it provides secure, encrypted command-line access for remote administration over untrusted networks.
SSH (Secure Shell) operating on default TCP port 22 is designed specifically to establish secure, encrypted shell/command-line sessions over unsecure public networks, ensuring confidentiality of administrator credentials and transmitted data.

Step-by-Step Solution

1
Identify the remote management interface requirement.
The scenario specifies command-line (terminal) administration of a Linux server.
Choosing between command-line and graphical interface tools narrows down protocol candidates (SSH/Telnet vs RDP/VNC).
2
Evaluate security and encryption requirements.
The network connection passes through an untrusted external network, requiring end-to-end transport encryption.
Unencrypted protocols such as Telnet expose credentials to packet sniffing.
3
Select the correct protocol and default network port.
SSH encrypts all traffic and listens on TCP port 22 by default.
Permitting TCP port 22 on the firewall satisfies both the security encryption requirement and the command-line interface requirement.

Key Concept

SSH vs Telnet and default port assignments for secure remote command-line administration
Estimated Time:1m 0s
Question 1589Question →

A Windows workstation running an internal financial reporting tool becomes unresponsive and freezes periodically during data sync operations. A technician needs to determine why the application is hanging and identify the specific executable or system file causing the failure. Which of the following actions should the technician perform to isolate the issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use the Analyze Wait Chain feature on the reporting tool process within Resource Monitor.; Examine the Event Viewer Application log for Event ID 1000 or Event ID 1002 fault entries.

Answer

The technician should inspect the process threads using Analyze Wait Chain in Resource Monitor and review Event ID 1000/1002 crash records in the Event Viewer Application log.
Analyzing the wait chain in Resource Monitor isolates locked or waiting process threads when an application freezes, while reviewing Event ID 1000 (Application Error) and Event ID 1002 (Application Hang) in Event Viewer provides concrete logs regarding faulting modules and crash codes.

Step-by-Step Solution

1
Inspect active process dependencies during the hang.
Opening Resource Monitor and selecting 'Analyze Wait Chain' on the unresponsive process reveals if it is waiting on another locked thread or secondary executable.
Process hangs often occur when one thread is blocked by a non-responsive dependency.
2
Check system event logs for failure details.
Reviewing Event Viewer under Windows Logs > Application yields Event ID 1000 (Application Error) or 1002 (Application Hang) logs.
Event log entries provide explicit faulting module filenames, exception codes, and timestamps essential for root cause isolation.

Key Concept

Application Crash and Hang Diagnostics
Estimated Time:1m 30s
Question 1590Question →

Match each Windows administration task or system configuration requirement on the left with its corresponding Control Panel utility on the right.

Click a left item, then click its matching right item

Items

Manage offline files and set up synchronization schedules for network shared folders
Add a multi-function office printer and adjust its default paper tray preferences
Enable optional Windows components such as Internet Information Services (IIS) or Hyper-V
Modify the computer host name and adjust performance settings for virtual memory pagefile size

Matches

Show answer & explanation

Answer

Offline files and network folder synchronization match Sync Center; adding printers and setting default paper tray preferences match Devices and Printers; enabling optional OS components like IIS or Hyper-V matches Programs and Features; modifying the host name and adjusting virtual memory pagefile size match System.
Each administrative task aligns directly with its primary Windows Control Panel utility: Sync Center manages offline network files and schedules; Devices and Printers handles peripheral configuration and default printer properties; Programs and Features allows technicians to enable or disable optional OS components like IIS or Hyper-V; System provides access to basic system specifications, computer identity, and virtual memory (paging file) configuration.

Step-by-Step Solution

1
Identify the tool for managing offline network folders and sync schedules.
Determine that Sync Center handles offline files, synchronization status, and conflict resolution.
Windows routes file caching and sync rules through the Sync Center applet.
2
Identify the tool for managing user-facing printer settings and default properties.
Determine that Devices and Printers manages installed peripherals, printing defaults, and print queues.
Higher-level device preferences and default selections are configured in Devices and Printers.
3
Identify the location for turning Windows features on or off.
Determine that Programs and Features houses the option to enable optional components such as IIS or Hyper-V.
Built-in OS features and optional roles are managed from within Programs and Features.
4
Identify the applet controlling system host identity and performance options.
Determine that the System utility provides access to System Properties for computer renaming and virtual memory paging configuration.
Host name, domain membership, and advanced performance settings (such as pagefile sizing) reside under System settings.

Key Concept

Windows Control Panel Utilities Functionality
Estimated Time:1m 30s
Question 1591Question →

A network administrator is deploying a new wireless network for corporate laptops at a financial services firm. Corporate policy requires that every employee authenticate individually using their corporate domain credentials and that the network use the highest available encryption standard without relying on a shared passphrase. Which TWO of the following configurations should the administrator implement?

Select all that apply

Show answer & explanation

Answer: WPA3-Enterprise security mode; 802.1X authentication backed by a RADIUS server

Answer

WPA3-Enterprise security mode and 802.1X authentication backed by a RADIUS server
Selecting WPA3-Enterprise security mode alongside 802.1X authentication backed by a RADIUS server fulfills all corporate requirements. WPA3-Enterprise provides modern enterprise-class encryption, while 802.1X with RADIUS passes authentication requests to centralized identity stores like Active Directory so each user logs in with unique individual credentials.

Step-by-Step Solution

1
Analyze the user authentication requirement
Individual user authentication using network domain credentials requires an enterprise authentication framework (802.1X) integrated with an authentication server such as RADIUS.
Personal wireless modes rely on a single shared passphrase across all clients, failing the requirement for unique individual user logins.
2
Determine the required wireless security standard
The highest modern encryption standard that supports 802.1X enterprise authentication without pre-shared keys is WPA3-Enterprise.
WPA3-Enterprise utilizes robust encryption suites and enforces centralized 802.1X authentication.

Key Concept

WPA3-Enterprise and 802.1X/RADIUS authentication for corporate wireless networks
Question 1592Question →

A technician is troubleshooting a mobile device experiencing severe thermal throttling and rapid battery drain caused by a misbehaving geolocation-tracking module within a third-party application. Arrange the following troubleshooting procedures in the correct sequence from least invasive to most invasive according to standard mobile operating system maintenance methodology.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of troubleshooting steps from least invasive to most invasive is: 1) Force close the application, 2) Soft restart the mobile device, 3) Revoke location access and background refresh permissions, 4) Uninstall and reinstall the application, 5) Perform a full factory reset.
CompTIA A+ troubleshooting standard dictates proceeding from the least invasive action to the most invasive action. Force stopping the application operates purely in active volatile memory. A soft device restart clears broader system memory leaks. Adjusting specific app permissions alters persistent feature settings while keeping user data intact. Reinstalling the application clears application data and requires re-setup. Finally, a full factory reset wipes all operating system data and represents the ultimate escalation step.

Step-by-Step Solution

1
Terminate volatile memory process
Force closing the application immediately halts the CPU/GPS resource drain without altering any device settings.
Troubleshooting should always start by stopping the running process directly in RAM.
2
Reboot the mobile platform
A soft reset clears system-wide runtime caches and unmanaged background threads.
Restarting the hardware addresses potential OS-level memory leaks without destroying persistent user data.
3
Adjust OS-level application permissions
Disabling background refresh and location services stops the application from initiating high-power hardware states.
Configuration adjustments reconfigure feature access to resolve performance drain while retaining user data.
4
Rebuild application installation
Deleting and reinstalling the package eliminates corrupted local storage files and corrupted binary packages.
Reinstallation forces the user to log in again and reconfigure preferences, making it more disruptive than permission adjustments.
5
Execute OS factory wipe
Factory resetting clears all storage partitions, restoring the OS image to defaults.
This is the final escalation step used only when all application-level and configuration-level remedies fail.

Key Concept

Least-Invasive-First Mobile OS Troubleshooting Methodology
Question 1593Question →

A helpdesk technician receives an incoming call from a remote user experiencing an issue with their email client. Place the technician's professional communication and user interaction steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order is: 1) Greet the user and introduce yourself, 2) Actively listen to the issue without interrupting, 3) Explain the fix and ask for remote session permission, 4) Verify complete resolution with the user and document the ticket.
The standard CompTIA workflow for professional communication begins with establishing greeting and rapport, actively listening to gather details without interruption, communicating proposed actions and securing consent, and concluding with user verification of the fix followed by ticket documentation.

Step-by-Step Solution

1
Initiate the interaction professionally
Establishes technician identity and positive customer rapport
CompTIA standards dictate introducing yourself and your organization immediately upon answering a support call.
2
Gather issue details via active listening
Captures complete technical context without making the user feel dismissed
Allowing the user to finish explaining their situation prevents misunderstandings and demonstrates professional respect.
3
Set expectations and obtain user consent
Ensures user awareness and privacy compliance before taking remote control
Technicians must avoid taking control of a workstation without explaining the procedure and securing explicit permission.
4
Confirm resolution and complete administrative documentation
Ensures full customer satisfaction and accurate ticketing history
A ticket should only be closed after verifying full functionality directly with the user and logging the technical resolution.

Key Concept

Professional Customer Interaction Workflow
Question 1594Question →

A Windows 11 workstation fails to start critical operating system services following a corrupted third-party driver installation during a forced reboot. When booting into the Windows Recovery Environment (WinRE), running `sfc /scannow` fails with a message indicating that Windows Resource Protection found corrupt files but was unable to repair them due to damage within the local Windows Component Store (WinSxS). An offline Windows installation ISO has been mounted to drive letter `E:`. Which TWO of the following command-line operations must the technician execute to repair the component store and successfully recover the system files?

Select all that apply

Show answer & explanation

Answer: Execute DISM specifying `/Image:C:\` and `/Cleanup-Image /RestoreHealth` along with `/Source:E:\sources\install.wim` to repair the WinSxS store from the mounted media.; Execute `sfc /scannow` with `/offbootdir=C:\` and `/offwindir=C:\Windows` after the DISM restoration completes to replace corrupt system files.

Answer

The technician must execute DISM pointing to the offline Windows installation path while supplying an explicit installation media source file to restore the WinSxS component store, and subsequently run the SFC utility configured with offline boot and Windows directory parameters.
When repairing corrupted Windows system files from WinRE where the local component store (WinSxS) is damaged, DISM must first be executed using the `/Image` path to target the offline system drive and the `/Source` parameter pointing to a known good `install.wim` image. Following a successful DISM restoration of the component store, `sfc /scannow` must be targeted at the offline installation using `/offbootdir` and `/offwindir` parameters to successfully scan and repair corrupted protected system files.

Step-by-Step Solution

1
Identify the dependency between DISM and SFC when repairing corrupted operating system files.
Recognize that System File Checker (SFC) relies on a healthy WinSxS component store; if WinSxS is corrupted, DISM must be run first.
SFC uses the local WinSxS store as its source for replacing corrupted protected files. If the store itself is damaged, SFC repairs will fail until DISM fixes the store.
2
Configure the DISM repair command for an offline image inside WinRE.
Run DISM with the `/Image:C:\` parameter and set `/Source:E:\sources\install.wim` combined with `/Cleanup-Image /RestoreHealth`.
Because WinRE is active, using `/online` targets WinRE instead of the target system. The command requires explicit target and repair source paths.
3
Execute System File Checker against the offline system drive post-DISM repair.
Run `sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows`.
Now that the WinSxS store is healthy, SFC can extract clean system binaries and repair corrupt files on the offline volume.

Key Concept

Offline System File and Component Store Repair Sequence
Question 1595Question →

A technician is troubleshooting a Windows 11 workstation where a critical desktop publishing application intermittently freezes during high-resolution graphics export. The technician needs to isolate the specific thread deadlock causing the freeze, restore application responsiveness without terminating the main application process if possible, and gather historical crash logs for post-incident reporting. In what order should the technician execute these troubleshooting steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The technician should first locate the application process in Task Manager's Details tab, use Analyze Wait Chain to pinpoint the blocking thread, end the blocking thread to restore responsiveness, and finally inspect Event Viewer Application logs for Event ID 1002 entries.
The correct troubleshooting sequence begins by targeting the process in Task Manager's Details tab, running Analyze Wait Chain to identify the specific thread lock, terminating the blocking child thread to safely unfreeze the application, and lastly querying Event Viewer (Event ID 1002) for root-cause diagnostic information.

Step-by-Step Solution

1
Navigate to Task Manager Details tab
Identify the target application executable name and associated PID.
Process management utilities like Analyze Wait Chain are accessible from the Details tab.
2
Execute Analyze Wait Chain
Examine the dependency tree to find which thread or secondary process is holding a resource lock.
Analyze Wait Chain pinpoints thread contention causing the application to stop responding.
3
End the blocking child process
Unfreeze the main application window without killing the primary process tree.
Selective termination releases locked memory handles while preserving unsaved work in the parent process.
4
Review Event Viewer Application logs
Filter for Event ID 1002 (Application Hang) to capture faulting DLLs, timestamps, and error codes.
Log analysis provides empirical data for persistent bug resolution or software updates.

Key Concept

Isolating Windows application hangs using Task Manager Analyze Wait Chain and Event Viewer logging
Question 1596Question →

A Windows 11 workstation experienced an improper shutdown during a power outage and now frequently crashes with Stop errors referencing system file corruption. A technician opens an elevated Command Prompt and executes `sfc /scannow`, but the process halts with the error: "Windows Resource Protection found corrupt files but was unable to fix some of them." The technician suspects that the local Windows Component Store (WinSxS) used for file repair is itself corrupted. Which of the following command-line procedures should the technician execute NEXT to successfully restore system file integrity?

Show answer & explanation

Answer: Execute `dism /online /cleanup-image /restorehealth` to repair the local Component Store, and then re-run `sfc /scannow`.

Answer

The technician should execute `dism /online /cleanup-image /restorehealth` to repair the Windows Component Store, followed by re-running `sfc /scannow`.
When System File Checker (`sfc /scannow`) reports that it found corrupt files but could not repair them, it means the local source repository (the WinSxS folder) lacks healthy replacement copies. Running `dism /online /cleanup-image /restorehealth` repairs the Windows Component Store image using Windows Update. Once DISM finishes repairing the store, running `sfc /scannow` again will successfully restore damaged protected operating system files.

Step-by-Step Solution

1
Identify the cause of the System File Checker failure
The message 'unable to fix some of them' indicates that SFC's source repository (the WinSxS component store) is damaged or missing required clean files.
SFC relies on the local Component Store to replace corrupted OS binaries.
2
Repair the Component Store using DISM
Running `dism /online /cleanup-image /restorehealth` downloads and repairs damaged payload files in the WinSxS store from Windows Update.
DISM must restore health to the component payload store before SFC can function properly.
3
Re-run System File Checker
Executing `sfc /scannow` now finds the corrupted system files and successfully replaces them using the newly restored Component Store files.
SFC can now successfully retrieve uncorrupted files.

Key Concept

DISM and SFC Repair Workflow Sequence
Question 1597Question →

Match each remote access technology or tool with its characteristic operating requirement, protocol, or default port configuration.

Click a left item, then click its matching right item

Items

Remote Desktop Host (RDP)
Microsoft Remote Assistance (MSRA)
Secure Shell (SSH)
Virtual Network Computing (VNC)

Matches

Show answer & explanation

Answer

Remote Desktop Host (RDP) matches the requirement for Windows Pro/Enterprise/Education on TCP port 3389. Microsoft Remote Assistance (MSRA) matches helper invitation sessions across all Windows editions. Secure Shell (SSH) matches encrypted command-line access on TCP port 22. Virtual Network Computing (VNC) matches RFB protocol usage on TCP port 5900.
Each remote access technology correctly maps to its core operational parameter: RDP host capabilities require Windows Pro/Enterprise/Education on TCP 3389; MSRA enables interactive helper sessions via invitation tokens across all editions; SSH supplies encrypted terminal administration over TCP 22; and VNC delivers cross-platform screen sharing via the RFB protocol over TCP 5900.

Step-by-Step Solution

1
Identify operating system edition restrictions for incoming GUI remote desktop sessions.
Confirm that Windows Home editions lack the RDP host listener component, requiring Pro, Enterprise, or Education editions on TCP port 3389.
CompTIA A+ objectives specifically contrast RDP host availability between Windows client editions.
2
Differentiate MSRA functionality from standard RDP session behaviors.
Determine that MSRA allows assisted remote support sessions across all Windows editions via user invitation tokens.
Technicians use MSRA to assist remote users on Home edition machines where RDP host mode is disabled.
3
Associate command-line and cross-platform tools with their default network ports and protocols.
Link SSH to encrypted CLI administration on TCP port 22, and VNC to RFB protocol administration on TCP port 5900.
Network firewalls and routers must be configured with correct default listening ports for SSH and VNC connectivity.

Key Concept

Remote Access Technologies, Port Assignments, and Windows Edition Capabilities
Question 1598Question →

An IT support technician arrives at a user's workstation to resolve a local printing issue. The user is visibly frustrated, complaining that recent system slowness has caused severe project delays, and begins venting about past IT support experiences. Which of the following is the most professional response for the technician to take first?

Show answer & explanation

Answer: Actively listen without interrupting, clarify the user's concerns, and acknowledge their frustration while maintaining a professional demeanor.

Answer

Actively listen without interrupting, clarify the user's concerns, and acknowledge their frustration while maintaining a professional demeanor.
The correct response prioritizes active listening, emotional de-escalation, and clear communication. When interacting with a frustrated user, a technician must first allow the user to express their concerns fully without interruption, validate their situation professionally, and avoid arguing or shifting blame.

Step-by-Step Solution

1
De-escalate the user's frustration through active listening
The user feels heard and respected, reducing tension in the support interaction.
Before addressing technical issues, establishing rapport and professional empathy is required to build trust.
2
Clarify and document the reported symptoms
Accurate information gathering regarding both the printer and performance issues.
Ensures all aspects of the user's operational disruption are understood before diagnostic steps begin.

Key Concept

Professional Interpersonal Communication and Active Listening
Question 1599Question →

A smartphone user reports that a specific line-of-business mobile application frequently freezes and crashes immediately upon launch. Following standard mobile troubleshooting methodology, which of the following actions should a technician perform FIRST?

Show answer & explanation

Answer: Force stop the application and clear the application cache

Answer

Force stop the application and clear the application cache.
Force stopping the application and clearing its cached data directly addresses corrupted temporary files or hanging process states, which are the most common causes of single-app crashes. This represents the least invasive initial step in mobile OS troubleshooting.

Step-by-Step Solution

1
Identify the troubleshooting scope
The issue is limited to a single application crashing on a mobile device.
Isolating the issue ensures targeted troubleshooting rather than system-wide changes.
2
Apply the least invasive troubleshooting method
Force stopping the application terminates stuck background processes, and clearing the app cache removes corrupted temporary files without deleting user data.
Standard CompTIA troubleshooting methodology requires performing least invasive actions before resorting to app reinstallation or device resets.

Key Concept

Least Invasive Mobile App Troubleshooting Methodology
Question 1600Question →

A help desk technician receives a ticket reporting an unrecognized suspicious process continuously executing on an executive assistant's workstation. According to standard enterprise IT service management and ticketing system workflows, in what order should the technician execute the following ticket lifecycle and documentation steps from initial receipt to final resolution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the ticketing workflow is: (1) Categorize the ticket as a high-priority security incident and document initial symptoms, (2) Reassign and escalate the ticket to the Cybersecurity Operations team with attached logs, (3) Log specific remediation steps and diagnostic actions in work notes, (4) Obtain explicit end-user confirmation that normal operation is restored, and (5) Record final root cause analysis code, update internal knowledge base, and set ticket status to Closed.
The standard ITSM incident lifecycle dictates that incoming issues are first triaged and categorized to establish priority and scope. Once identified as an out-of-scope security incident, the ticket is formally escalated with initial findings. Following successful technical remediation by specialized staff, all resolution actions are logged. Explicit end-user verification must be gathered next to ensure system stability. Finally, administrative closure—including root cause coding and knowledge base updates—completes the process.

Step-by-Step Solution

1
Perform ticket triage, initial documentation, and impact/urgency categorization.
The ticket is properly classified in the IT Service Management (ITSM) system with an accurate severity rating.
Accurate categorization determines routing, escalation rules, and SLA tracking.
2
Escalate the incident to specialized Tier 2 / Security Operations with diagnostic notes.
The ticket is assigned to qualified personnel with necessary investigative context.
Security incidents exceeding Tier 1 operational scope must be formally transferred following escalation protocols.
3
Execute technical remediation and log detailed actions taken.
The system threat is neutralized, and a detailed audit trail of changes is maintained in the ticket history.
Detailed resolution logs are mandatory for compliance, audit trails, and technical history.
4
Verify complete functionality with the affected end user.
Confirmation is received that the user can perform work duties without issue.
Tickets must never be closed unilaterally without validating that the user's workflow is restored.
5
Complete root cause documentation, knowledge base entries, and formal ticket closure.
The ticket lifecycle completes, and institutional knowledge is updated for future reference.
Formal closure and knowledge management prevent recurring incidents and document historical fixes.

Key Concept

IT service management ticket lifecycle stages (Intake/Triage -> Escalation -> Remediation/Logging -> User Verification -> Final Closure/KB Update).
Estimated Time:2m 30s
PreviousPage 80 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin