Examkin

All practice questions

3551 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 1881Question →

A user reports that after installing a third-party toolbar, their web browser continuously displays unsolicited pop-up advertisements and redirects search queries to an unknown search engine. A technician inspects the browser and discovers an unrecognized add-on. Which of the following is the best initial action to resolve this issue?

Show answer & explanation

Answer: Remove the suspicious browser add-on and reset the browser to default settings.

Answer

Remove the suspicious browser add-on and reset the browser to default settings.
Removing the suspicious browser add-on directly eliminates the software component responsible for pop-ups and redirects, and resetting browser settings restores the legitimate default search engine and home page.

Step-by-Step Solution

1
Identify the cause of the redirect and pop-up behavior.
The unfamiliar browser add-on and modified search settings are confirmed as the source of the browser hijacking.
Unsolicited redirects and persistent pop-up windows following a toolbar installation typically stem from rogue extensions.
2
Remove the extension and restore default browser settings.
The unwanted add-on is uninstalled, and the default search provider and homepages are restored.
This directly remediates the browser hijacker at the application level.

Key Concept

Web Browser Security and Extension Remediation
Question 1882Question →

A network technician is updating documentation for a company's wireless infrastructure. Match each IEEE 802.11 wireless standard to its defining frequency band, maximum theoretical throughput, and core technical feature.

Click a left item, then click its matching right item

Items

IEEE 802.11a
IEEE 802.11g
IEEE 802.11ac
IEEE 802.11ax

Matches

Show answer & explanation

Answer

IEEE 802.11a matches 5 GHz operation at 54 Mbps using OFDM; IEEE 802.11g matches 2.4 GHz operation at 54 Mbps with 802.11b compatibility; IEEE 802.11ac matches 5 GHz-only operation with downlink MU-MIMO and 160 MHz channel bonding; IEEE 802.11ax matches multi-band operation (2.4/5/6 GHz) utilizing OFDMA.
Each standard is accurately paired based on its operating frequencies, maximum theoretical data rates, and characteristic features such as OFDM, MU-MIMO, or OFDMA.

Step-by-Step Solution

1
Differentiate legacy 54 Mbps standards by frequency band and compatibility
IEEE 802.11a uses 5 GHz exclusively with OFDM, while IEEE 802.11g operates on 2.4 GHz and supports legacy 802.11b devices.
Identifying frequency constraints isolates 802.11a from 802.11g.
2
Compare modern high-performance Wi-Fi standards and key modulation technologies
IEEE 802.11ac is restricted to 5 GHz with downlink MU-MIMO, whereas IEEE 802.11ax operates across 2.4 GHz, 5 GHz, and 6 GHz using OFDMA.
Wi-Fi 5 (802.11ac) is exclusively 5 GHz, whereas Wi-Fi 6 (802.11ax) brings multi-band capabilities and subcarrier channel allocation via OFDMA.

Key Concept

Operating frequencies, maximum speeds, and core technologies of IEEE 802.11 wireless networking standards.
Question 1883Question →

A systems administrator is writing a Bash shell script (.sh) on a Linux workstation to parse log files located in a specific directory. The script must define a variable holding the target path /var/log/audit and reference that variable within a loop construct. Which TWO of the following scripting statements and syntax rules must the administrator follow for this Bash script to execute successfully? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the variable using the syntax LOG_DIR="/var/log/audit" with no whitespace surrounding the assignment operator.; Reference the stored variable value using LOGDIRorLOG_DIR or {LOG_DIR} syntax when building script constructs.

Answer

Defining the variable without spaces around the equals sign (LOG_DIR="/var/log/audit") and referencing its value using a dollar sign prefix (LOGDIRorLOG_DIR or {LOG_DIR}).
In Bash shell scripting, variables are declared without whitespace surrounding the assignment operator (e.g., LOG_DIR="/var/log/audit"). To expand and evaluate the variable's value in loops or commands, the variable name must be prefixed with a dollar sign (LOGDIRorLOG_DIR or {LOG_DIR}).

Step-by-Step Solution

1
Analyze Bash variable assignment requirements
Bash syntax strictly enforces no whitespace around the assignment operator (=) when declaring user variables.
Including spaces causes the shell to misinterpret the variable name as an executable command.
2
Analyze Bash variable expansion syntax
Accessing the stored value of LOG_DIR requires referencing it as LOGDIRorLOG_DIR or {LOG_DIR}.
The dollar sign indicates to the shell interpreter that the variable name should be replaced with its assigned literal value.
3
Evaluate distractor syntax rules
The 'set' keyword with spaces and the 'for %f in (...) do' structure belong to Windows Command Prompt Batch scripting.
Mixing Windows CMD syntax into a Bash script causes execution and syntax errors.

Key Concept

Bash Environment Variable Assignment and Expansion Syntax
Estimated Time:1m 30s
Question 1884Question →

Match each remote access technology or protocol on the left with its correct network specification and operational characteristic on the right.

Click a left item, then click its matching right item

Items

SSH (Secure Shell)
RDP (Remote Desktop Protocol)
Telnet
MSRA (Microsoft Remote Assistance)

Matches

Show answer & explanation

Answer

SSH matches with encrypted command-line administration on TCP port 22. RDP matches with graphical desktop access over TCP port 3389 requiring Windows Pro/Enterprise to host. Telnet matches with unencrypted cleartext management over TCP port 23. MSRA matches with interactive user-invited support sessions supported on Windows Home.
SSH provides encrypted CLI management on TCP port 22. RDP provides graphical access on TCP port 3389 and requires Windows Pro, Enterprise, or Server editions to accept inbound connections. Telnet uses TCP port 23 and sends data in cleartext. MSRA facilitates interactive remote assistance via user invitations and works on Windows Home edition.

Step-by-Step Solution

1
Identify the protocol transport ports for each tool.
SSH uses TCP 22, RDP uses TCP 3389, Telnet uses TCP 23, and MSRA uses dynamic ports with TCP 3389/PNRP for invitation handshakes.
Port numbers distinguish network communication channels for remote management tools.
2
Evaluate transport security and encryption levels.
SSH provides encrypted shell traffic; Telnet transmits data in unencrypted plain text.
Understanding security implications prevents cleartext credential exposure on untrusted networks.
3
Differentiate Windows edition hosting capabilities for RDP and MSRA.
Windows Home cannot host inbound RDP connections, but it supports MSRA session sharing when invited by an active user.
RDP host functionality is restricted to business and server editions of Windows, whereas MSRA is available across consumer and business editions.

Key Concept

Remote Access Technologies, Network Ports, and OS Edition Capabilities
Question 1885Question →

During a routine physical security audit of a remote branch office, a systems administrator discovers an unauthorized hardware keylogger connected between a workstation keyboard and the computer tower. To adhere to proper incident response and evidence preservation procedures, which of the following actions should the administrator take FIRST?

Show answer & explanation

Answer: Photograph the device in place and document its physical configuration before reporting the incident.

Answer

Photograph the device in place and document its physical configuration before reporting the incident.
Photographing the keylogger in place and recording its exact physical configuration preserves evidence context before physical removal. This action fulfills first-responder requirements for evidence preservation under CompTIA incident response standards.

Step-by-Step Solution

1
Identify the security incident and secure the physical area without altering potential evidence.
The physical scene remains undisturbed.
First responders must avoid altering physical or digital evidence states before documentation occurs.
2
Photograph the device in place and record all physical connections and environmental details.
Documentary and visual proof of the original evidence configuration is established.
Photographic evidence proves the original state of the device prior to removal or transport.
3
Report the incident to designated security personnel and initiate chain of custody logs.
Proper escalation takes place with documented custody tracking.
Escalation ensures qualified forensic analysts take possession of evidence under unbroken chain of custody.

Key Concept

First Responder Evidence Preservation and Initial Response Sequence
Question 1886Question →

A systems administrator at a multinational e-commerce company is auditing network architecture and storage policies for an online store that processes credit card transactions and maintains profile details for customers residing in the European Union. Which TWO of the following operational controls must the administrator implement to satisfy PCI-DSS and GDPR requirements?

Select all that apply

Show answer & explanation

Answer: Segment the network hosting the cardholder data environment (CDE) from non-payment web application systems.; Establish a documented workflow to process customer requests for the complete deletion of their personal data.

Answer

The administrator must segment the cardholder data environment (CDE) from other non-payment web infrastructure to satisfy PCI-DSS standards and establish a procedure for handling customer requests for complete personal data erasure to comply with GDPR.
Segmenting the cardholder data environment (CDE) limits the scope of PCI-DSS audits and prevents unauthorized access across web segments. Implementing a data deletion request process satisfies the GDPR 'Right to Erasure' (Right to be Forgotten) requirement for EU citizens.

Step-by-Step Solution

1
Analyze PCI-DSS requirements for handling payment card transactions.
Identified that cardholder data environment (CDE) network segmentation is required and that storing CVV codes post-authorization is strictly forbidden.
PCI-DSS governs payment card security controls and limits post-authorization storage of sensitive verification data.
2
Analyze GDPR requirements for processing European Union customer personal data.
Identified that data subjects have the right to request deletion of their personal data (Right to Erasure).
GDPR grants EU citizens explicit rights over their personal identifiable information (PII).
3
Evaluate and reject improper regulation applications.
Determined that FERPA applies only to educational institutions and student records, making it irrelevant to e-commerce customer data.
Selecting the incorrect regulatory framework leads to misconfigured security controls and non-compliance.

Key Concept

Identifying operational scope and technical compliance controls for PCI-DSS and GDPR
Question 1887Question →

An IT technician is handling a data privacy request from a European Union resident who requested the complete erasure of their account details under the General Data Protection Regulation (GDPR) right to be forgotten. Which of the following actions should the technician take to properly comply with this regulation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Permanently delete the user's personally identifiable information (PII) from active production databases.; Purge or anonymize the user's personal records stored within secondary backup archives.

Answer

The correct actions are permanently deleting the user's personally identifiable information (PII) from active production databases and purging or anonymizing the user's personal records stored within secondary backup archives.
The General Data Protection Regulation (GDPR) mandates that when an individual exercises their right to be forgotten, the organization must remove their personally identifiable information (PII) from active production environments as well as sanitize or remove it from backup media.

Step-by-Step Solution

1
Identify the relevant privacy regulation and requirement.
The request is governed by GDPR under the 'right to be forgotten' (data erasure).
GDPR grants EU data subjects the right to request erasure of their personal data.
2
Select technical actions aligned with the erasure requirement.
Remove or sanitize PII across both active databases and secondary backup environments.
Complete compliance requires eliminating identifiable records from live systems and backup archives.

Key Concept

GDPR Data Erasure and PII Handling
Question 1888Question →

An IT technician is servicing an offline Windows workstation in a secure facility that cannot boot into the desktop environment after a corrupted system update. Working from the Windows Recovery Environment (WinRE) Command Prompt with an attached USB drive containing valid installation media (`D:\sources\install.wim`), the technician needs to repair the corrupt offline Windows installation located on drive C:. Which TWO of the following command-line operations must the technician perform to properly repair the component store and fix corrupted system files?

Select all that apply

Show answer & explanation

Answer: Run `dism /image:C:\ /cleanup-image /restorehealth /source:wim:D:\sources\install.wim:1 /limitaccess` to repair the offline component store from local media.; Run `sfc /scannow /offbootdir=C:\ /offwindir=C:\windows` after component store repair to verify and replace corrupted system files.

Answer

The technician must execute the DISM command specifying the offline image directory along with a local WIM source and limitaccess switch, followed by running the System File Checker with offbootdir and offwindir switches targeting the offline Windows path.
When servicing an offline Windows installation that cannot connect to Windows Update, DISM must be pointed to the target Windows partition (/image:C:\) and a valid local installation image (/source:wim:...) with /limitaccess. After restoring the Component Store's integrity, System File Checker must be invoked with /offbootdir and /offwindir to scan and restore protected system files on the offline drive.

Step-by-Step Solution

1
Repair the offline servicing image using DISM
The Windows Component Store (WinSxS) on the target system drive is successfully repaired using the verified install.wim file from the local USB media.
SFC relies on a healthy Component Store to restore damaged protected system files. Without internet access, DISM requires a local source WIM and the limitaccess switch.
2
Run SFC with offline parameters targeting the OS directory
SFC scans system integrity and replaces damaged OS binaries using the newly repaired component store.
Standard sfc /scannow targets the active running OS; offline WinRE repair requires explicitly defining /offbootdir and /offwindir.

Key Concept

Resolving System File Corruption and Driver Issues using DISM and SFC in Offline Environments
Question 1889Question →

A storage administrator is preparing to perform a major firmware upgrade on an enterprise Storage Area Network (SAN) controller. Place the following standard change management lifecycle steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the change management steps is: (1) Perform a comprehensive risk analysis to evaluate potential business impact and service dependencies -> (2) Formulate a detailed implementation procedure accompanied by a verified backout strategy -> (3) Submit the change request to the Change Advisory Board (CAB) for review and authorization -> (4) Issue an advance maintenance window notification to affected end users and business units -> (5) Conduct post-implementation testing to confirm array performance and close the change ticket.
Standard enterprise change management follows a strict progression: initial risk analysis and scope definition, development of technical deployment and rollback plans, formal review and authorization by the Change Advisory Board (CAB), user/stakeholder notification of the scheduled maintenance window, and post-implementation testing prior to ticket closure.

Step-by-Step Solution

1
Define scope and conduct risk assessment.
Potential downtime and affected infrastructure dependencies identified.
Evaluating potential impact is required before creating technical deployment and recovery plans.
2
Draft implementation details and backout procedures.
Complete change proposal documentation created.
CAB reviewers require step-by-step installation instructions and rollback plans to evaluate the request.
3
Present proposal to the Change Advisory Board (CAB).
Formal authorization granted.
Organizational governance requires CAB approval before scheduling maintenance windows or executing system modifications.
4
Distribute maintenance window notices.
Impacted users informed of expected downtime.
User notification must happen after authorization is secured so accurate window details are communicated.
5
Execute post-implementation testing and record documentation.
Verified system functionality and closed ticket.
Final validation ensures system stability before the change management process is formally completed.

Key Concept

Sequential IT Change Management Lifecycle
Question 1890Question →

A financial analyst reports that a stock market monitoring application on a company-managed Android smartphone becomes progressively slow and unresponsive after rendering live charts throughout the day. The mobile device has 45% remaining battery life and over 30 GB of available internal storage space. Following the least-invasive troubleshooting methodology, which of the following actions should the IT support technician perform FIRST?

Show answer & explanation

Answer: Clear the application cache through the Android storage settings.

Answer

Clearing the application cache through the Android storage settings is the correct initial troubleshooting step.
Clearing the application cache is the least-invasive troubleshooting step for resolving application-specific performance degradation caused by cached data build-up. It clears temporary memory without deleting account details or requiring device re-enrollment.

Step-by-Step Solution

1
Identify the reported symptom and scope.
The issue is localized to a single application accumulating data during daily operation on a device with adequate storage and battery power.
Determines whether the root cause is system-wide hardware/OS failure or application-specific temporary resource consumption.
2
Apply the least-invasive troubleshooting methodology.
Clear the application's cached data via OS Settings > Apps > Storage.
Removes temporary files that cause memory lag while preserving application settings and user data.

Key Concept

Least-invasive mobile application troubleshooting sequence
Estimated Time:1m 0s
Question 1891Question →

An IT technician is removing a spare PCI Express network expansion card from a desktop computer and needs to store it for future use. Which of the following packaging materials should be used to protect the card from electrostatic discharge (ESD) during storage?

Show answer & explanation

Answer: An anti-static bag

Answer

An anti-static bag should be used to store sensitive internal expansion cards because it shields components against electrostatic charges.
An anti-static bag provides Faraday cage protection or static dissipative properties, safeguarding sensitive electronic components from static buildup and high-voltage discharges during storage or transportation.

Step-by-Step Solution

1
Identify the risk factor
Internal expansion cards contain sensitive integrated circuits that can be destroyed by subtle static charges.
Electrostatic discharge can degrade or destroy semiconductor components even at voltages too low for humans to feel.
2
Select appropriate ESD protection material
Choose an anti-static bag designed specifically for storing computer components.
Anti-static bags (ESD bags) prevent static buildup on the outer surface and create a Faraday cage effect to protect internal circuits.

Key Concept

ESD Safe Storage Practices
Estimated Time:45s
Question 1892Question →

A system administrator discovers that an off-site corporate laptop belonging to an executive was compromised during a business trip. Upon the executive's return to the office, the administrator immediately isolates the laptop from the network, removes the internal NVMe solid-state drive, and prepares it for handoff to a third-party digital forensics contractor. Which of the following actions is essential to establish a legally defensible chain of custody during this physical evidence transfer?

Show answer & explanation

Answer: Documenting the exact date, time, hardware serial number, and obtaining signatures from both the releasing administrator and receiving contractor on the evidence log.

Answer

Documenting the exact date, time, hardware serial number, and obtaining signatures from both the releasing administrator and receiving contractor on the evidence log.
The correct response highlights the core objective of chain of custody: maintaining an unbroken, verifiable log of physical possession. Recording the precise date, time, item serial number, and acquiring signatures from both the individual relinquishing evidence and the recipient ensures complete accountability.

Step-by-Step Solution

1
Identify the primary requirement for chain of custody during evidence transfer.
Chain of custody requires continuous, verifiable tracking of physical evidence possession from collection through legal proceedings.
Any untracked gap or unverified handler invalidates the evidence in legal contexts.
2
Evaluate the necessary fields on an evidence transfer form.
Essential entries include the item description/serial number, date and time of transfer, reason for transfer, and signatures of both the releasing party and receiving party.
Dual signatures and accurate timestamps prove who maintained physical control of the item at every point in time.
3
Differentiate improper evidence handling practices.
Mounting drives alters timestamps, unmonitored storage creates custody gaps, and logging speculative threat classifications misrepresents factual physical control.
First responders must focus on evidence preservation and strict record-keeping without altering the media or guessing forensic outcomes.

Key Concept

Chain of Custody and Evidence Transfer Protocols
Estimated Time:1m 30s
Question 1893Question →

A technician is writing a simple PowerShell script to automate a routine maintenance task. Place the following script constructs in the correct order to initialize a path variable, evaluate whether the path exists, execute an automated action, and close the execution block.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence initializes the target variable (LogPath="C:\Logs\system.log"),openstheconditionalevaluation(if(Test−PathLogPath = "C:\Logs\system.log"), opens the conditional evaluation (if (Test-Path LogPath) {), runs the file deletion command within the block (Remove-Item -Path $LogPath), and closes the control structure (}).
In standard procedural scripting logic, environment variables must be declared and assigned before they can be evaluated by control constructs such as conditional 'if' statements. Once the condition opens, nested tasks run within the block before the enclosing block is terminated.

Step-by-Step Solution

1
Initialize variable
$LogPath variable is set with string value
Scripting constructs require variable assignment prior to evaluation.
2
Open conditional statement
if (Test-Path $LogPath) { is evaluated
Conditional branching checks environmental state before executing reliant actions.
3
Perform action inside block
Remove-Item -Path $LogPath executes
Actions governed by conditional checks reside within the construct body.
4
Terminate block
} closes the block
Closing braces signal the end of the conditional execution scope.

Key Concept

Execution sequence of basic scripting variables and conditional control constructs
Question 1894Question →

A network technician is cataloging newly purchased corporate smartphones into an asset management database. The technician must record the unique 15-digit identifier that permanently distinguishes the physical mobile handset itself on cellular networks, allowing carriers to blacklist the hardware if stolen regardless of which SIM card is installed. Which identifier should the technician record?

Show answer & explanation

Answer: IMEI

Answer

The technician should record the IMEI (International Mobile Equipment Identity).
The IMEI (International Mobile Equipment Identity) is a 15-digit code unique to every physical mobile device handset. Cellular network carriers use the IMEI to identify valid devices and block stolen hardware from accessing cellular networks globally, regardless of which SIM card is inserted.

Step-by-Step Solution

1
Identify the primary requirement from the scenario.
The scenario requires identifying the physical mobile handset's unique hardware serial number used by cellular carriers for tracking and hardware blacklisting.
Tracking hardware independently of subscriber identity requires a physical device identifier rather than a SIM identifier.
2
Differentiate cellular identification numbers.
IMEI (International Mobile Equipment Identity) uniquely identifies the physical phone hardware, whereas IMSI identifies the subscriber and SIM card account.
If a phone is stolen, the carrier blocks the IMEI so the handset cannot register on cellular networks even if a new SIM card is inserted.

Key Concept

Cellular Network Hardware Identifiers (IMEI vs. IMSI)
Estimated Time:1m 0s
Question 1895Question →

A tier 1 service desk technician resolves an issue where an account manager cannot print to a newly installed network printer. After identifying that the workstation was configured with an incorrect IP port address, the technician updates the port configuration and successfully prints a test page. According to standard ticketing system workflows, which of the following actions should the technician perform next before closing the ticket?

Show answer & explanation

Answer: Document the root cause, specific configuration changes made, and obtain user confirmation that printing functionality is verified.

Answer

Document the root cause, specific configuration changes made, and obtain user confirmation that printing functionality is verified.
Complete ticketing workflows require recording the root cause, specific remediation actions taken, and confirming with the end user that the issue is resolved to their satisfaction before officially closing the ticket.

Step-by-Step Solution

1
Identify the remaining documentation requirements following technical resolution.
Recognize that technical repair (printing test page) is complete, but administrative ticket closure workflow steps remain.
Standard operational procedures require complete documentation entries before ticket closure.
2
Record resolution details and contact the user for verification.
The ticket contains clear notes regarding the root cause (incorrect IP port) and confirmed fix, and the user validates that the printer works for their needs.
User verification ensures customer satisfaction and prevents premature ticket closure if secondary issues exist.

Key Concept

Incident Ticket Closure and Documentation Requirements
Question 1896Question →

An IT technician is connected to a user's workstation via a remote chat and support session to troubleshoot a software application error. The technician determines that resolving the issue requires restarting a core background service, which will temporarily disrupt the user's active session and require a system reboot. Which of the following is the most professional communication practice for the technician to follow before proceeding?

Show answer & explanation

Answer: Clearly explain the necessary step, ask the user to save all open work, and obtain explicit permission before initiating the restart.

Answer

Clearly explain the necessary step, ask the user to save all open work, and obtain explicit permission before initiating the restart.
The correct action prioritizes user transparency, data protection, and proper consent. Technicians should always explain the impact of intrusive actions (like reboots), give users time to save open files, and verify consent before proceeding.

Step-by-Step Solution

1
Identify the operational impact of the technical troubleshooting action.
Recognize that restarting services or rebooting will interrupt active user tasks and potentially cause loss of unsaved data.
Technicians must evaluate how troubleshooting steps impact end-user productivity and data integrity.
2
Communicate the situation clearly in non-technical terms.
The user understands why a reboot is required and what to expect during the process.
Clear communication helps manage customer expectations and prevents confusion.
3
Request permission and allow time for preparation.
The user saves ongoing work and provides consent to proceed with the restart.
CompTIA best practices dictate respecting customer data and maintaining user control over their workstation during a support session.

Key Concept

Professional Communication Practices and Setting Expectations
Estimated Time:1m 0s
Question 1897Question →

An IT specialist is configuring an internal network host to automatically assign IPv4 network configuration parameters—including IP addresses, subnet masks, and default gateways—to client computers on a local subnet. Which of the following port and transport protocol combinations must be permitted on the server to receive incoming request broadcasts from client workstations?

Show answer & explanation

Answer: UDP port 67

Answer

UDP port 67 is required on the server to receive incoming DHCP requests.
Dynamic Host Configuration Protocol (DHCP) operates using UDP port 67 on the server side to receive incoming client broadcasts for IP address assignment. Clients listen for responses on UDP port 68.

Step-by-Step Solution

1
Identify the required network service based on the scenario description.
The service that dynamically assigns IP addresses, subnet masks, and default gateways to workstations is the Dynamic Host Configuration Protocol (DHCP).
DHCP automates network configuration parameters for client endpoints.
2
Determine the transport protocol and listening port used by the server side of this service.
DHCP server listens on UDP port 67 for DISCOVER and REQUEST messages broadcast by clients.
DHCP relies on Connectionless User Datagram Protocol (UDP) broadcasting during initial client lease negotiation.

Key Concept

DHCP Port and Transport Layer Protocol Operations
Estimated Time:1m 0s
Question 1898Question →

A systems administrator is drafting a formal change request to upgrade the firmware on the organization's primary email security gateway. Which of the following components MUST be documented in the proposal before submitting it to the Change Advisory Board (CAB) for review? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A defined scope of change detailing affected systems and the planned schedule; A risk assessment outlining potential business impacts and severity levels

Answer

The required documentation components prior to CAB submission are a defined scope of change and a risk assessment.
A formal change request submitted for CAB approval must include a clear scope of change (defining affected systems, schedule, and boundaries) and a comprehensive risk assessment (evaluating potential operational downtime and business impact). These components ensure the CAB has necessary context to approve or modify the request.

Step-by-Step Solution

1
Identify the mandatory components of a formal change management request prior to submission.
A standard change proposal requires documenting the scope of change, risk assessment, rollback plan, and purpose.
Providing scope and risk analysis allows the Change Advisory Board to evaluate the safety, timing, and necessity of the proposed change.
2
Distinguish initial documentation requirements from post-execution tasks and unrelated operational procedures.
Scope and risk assessments are completed beforehand, whereas post-implementation testing occurs after deployment and chain of custody belongs to digital forensics.
Adheres strictly to standard CompTIA A+ Core 2 change management lifecycle phases.

Key Concept

Change Management Request Documentation
Question 1899Question →

A help desk technician is responding to a ticket where a user's web browser consistently opens to a rogue search engine upon startup, and intrusive advertisement pop-ups appear periodically. The technician suspects a browser hijacker that modified shortcut parameters and installed a malicious extension. In what sequence should the technician perform the following steps to remediate the browser redirect and pop-up issue?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Disconnect the workstation from the local network; 2) Inspect browser shortcut properties to remove injected URL arguments and uninstall unauthorized extensions; 3) Reset browser security settings to default configurations and clear all cached web content and cookies; 4) Execute a full anti-malware scan of the local system; 5) Reconnect the workstation to the network and verify proper browser operation.
The correct order follows standard CompTIA malware and browser troubleshooting protocols: first isolate the system from the network to contain the threat; second, remove active browser hijacker components (shortcut target overrides and rogue extensions); third, reset browser settings and clear residual cached data and unauthorized notification permissions; fourth, run a comprehensive system anti-malware scan to clean OS-level artifacts; and fifth, restore network connectivity and verify resolution.

Step-by-Step Solution

1
Isolate the infected machine from the network.
Prevents active malicious extensions or scripts from transmitting data or downloading additional payloads.
Following malware remediation procedures, isolation is always the immediate first step upon identifying a compromise.
2
Remove malicious shortcut parameters and rogue extensions.
Eliminates the immediate cause of forced URL redirects and unwanted pop-up behavior.
Directly targets the active injection vectors within the browser environment while disconnected.
3
Reset browser settings and clear browser data/cache.
Restores original security defaults, removes unauthorized push notification permissions, and clears malicious cookies/cache.
Ensures no residual persistent browser state or pop-up permissions remain.
4
Run a full system anti-malware scan.
Detects and removes any OS-level malware components, scheduled tasks, or persistent registry keys.
Guarantees the system is clean beyond just the browser profile before restoring network access.
5
Reconnect to the network and verify functionality.
Confirms that redirects are gone and browser security settings remain intact during live web browsing.
Final verification step ensures successful remediation under normal operating conditions.

Key Concept

Browser Hijacker Remediation and Malware Best Practices
Question 1900Question →

A field technician is troubleshooting a network issue where users on a local subnet can access an internal portal using its direct IP address 192.168.50.25192.168.50.25, but receive a web browser error when attempting to navigate to intranet.localintranet.local. The technician confirms that the workstation's IP address, subnet mask, and default gateway are correctly assigned. Which of the following actions should the technician take to resolve the issue?

Show answer & explanation

Answer: Reconfigure the DNS server IP address on the workstation to point to a valid host resolution server.

Answer

Reconfigure the DNS server IP address on the workstation to point to a valid host resolution server.
Successful connectivity via raw IP address (192.168.50.25192.168.50.25) combined with failure via domain name (intranet.localintranet.local) demonstrates that basic IP configuration and physical routing are working, but domain name resolution is failing. Correcting the DNS server IP address allows the client to successfully query for and resolve the domain name.

Step-by-Step Solution

1
Analyze host connectivity diagnostic results
Successful IP connection confirms physical Layer 1-3 connectivity and correct local IP/gateway setup.
Direct IP communication proves the network interface, subnet mask, and default gateway are functioning.
2
Identify the failing protocol tier
Failure when accessing by domain name (intranet.localintranet.local) indicates an issue with Name Resolution (DNS).
Domain Name System (DNS) translates human-readable hostnames into numeric IP addresses.
3
Determine corrective action
Configure the workstation with the correct DNS server address.
Assigning a valid DNS server enables the host to query and obtain the correct IP address for intranet.localintranet.local.

Key Concept

DNS vs. DHCP Service Roles and Troubleshooting
PreviousPage 95 / 178Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin