Security

442 questions

Question 161Question

A network security administrator is standardizing wireless security protocols and access controls across corporate offices, remote sites, and guest facilities. Match each wireless security protocol or access control mechanism on the left with its primary technical function on the right.

Click a left item, then click its matching right item

Items

EAP-TLS
SAE (Simultaneous Authentication of Equals)
RADIUS Server
Captive Portal

Matches

Show answer & explanation

Answer

EAP-TLS matches with enforcing mutual authentication via digital certificates on both client and server; SAE matches with replacing pre-shared key handshakes in WPA3 to protect against offline dictionary attacks; RADIUS Server matches with acting as the central authentication authority in an 802.1X enterprise framework; Captive Portal matches with intercepting unauthenticated web traffic on guest networks to present a web login or acceptance page.
Each protocol or mechanism directly corresponds to its core functional purpose: EAP-TLS leverages dual X.509 certificates for mutual authentication; SAE uses the Dragonfly protocol in WPA3-Personal to resist dictionary attacks; RADIUS provides backend authentication services in 802.1X deployment models; and a Captive Portal redirects unauthenticated browser traffic to a web landing page.

Step-by-Step Solution

1
Analyze enterprise EAP methods
Identify EAP-TLS as requiring digital certificates installed on both the client device and server for mutual authentication.
Unlike PEAP which only mandates server-side certificates, EAP-TLS strictly enforces dual-sided certificate validation.
2
Evaluate WPA3 personal authentication advancements
Map SAE (Simultaneous Authentication of Equals) to WPA3-Personal security enhancements.
SAE replaces the vulnerable WPA2 4-way PSK handshake with a zero-knowledge proof method that resists offline passphrase cracking.
3
Distinguish central AAA infrastructure from guest network access controls
Identify RADIUS as the central AAA backend for 802.1X user verification and Captive Portal as the web redirection control for guest access.
RADIUS handles centralized credential lookups, while Captive Portals isolate unauthenticated web sessions prior to internet access.

Key Concept

Wireless Authentication Protocols and Enterprise Security Controls
Question 162Question

A security administrator must harden standalone Windows 11 Pro workstations in a financial audit unit. Company compliance mandates two specific User Account Control (UAC) security controls: standard user accounts must be completely blocked from receiving elevation credential prompts (automatically denying elevation attempts), and administrative accounts operating in Admin Approval Mode must be forced to re-enter their administrative passwords on an isolated screen during any privilege elevation attempt rather than clicking a simple consent prompt. Which TWO configuration settings in Local Security Policy (secpol.msc) under Security Options must the administrator implement to satisfy these mandates?

Select all that apply

Show answer & explanation

Answer: Set "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests"; Set "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for credentials on the secure desktop"

Answer

The administrator must set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
To satisfy both compliance mandates, the administrator must configure two specific Local Security Policy (`secpol.msc`) options under `Local Policies -> Security Options`. Setting 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' prevents non-admin accounts from seeing or using credential prompts. Setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop' forces administrators to explicitly type password credentials on an isolated screen during elevation requests.

Step-by-Step Solution

1
Identify the policy controlling elevation behavior for standard user accounts.
Locate 'User Account Control: Behavior of the elevation prompt for standard users' in secpol.msc under Security Options and set its value to 'Automatically deny elevation requests'.
This prevents standard users from being prompted for administrative credentials and automatically stops unapproved privilege elevation.
2
Identify the policy controlling elevation behavior for administrator accounts in Admin Approval Mode.
Locate 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' and set its value to 'Prompt for credentials on the secure desktop'.
This requires administrators to prove their identity by typing credentials on the dim side-channel Secure Desktop instead of allowing a simple click-through consent dialog.

Key Concept

Windows Local Security Policy UAC Privilege Elevation Controls
Question 163Question

A system administrator is configuring security baselines on standalone Windows 11 Pro workstations. Company policy dictates that standard users must never be prompted to enter administrator credentials when attempting tasks that require elevated privileges; instead, any privilege elevation attempt by a standard user must be silently rejected by default. Which Local Security Policy setting under Security Options should the administrator modify to meet this requirement?

Show answer & explanation

Answer: User Account Control: Behavior of the elevation prompt for standard users

Answer

Modify 'User Account Control: Behavior of the elevation prompt for standard users' to automatically deny elevation requests.
The policy setting 'User Account Control: Behavior of the elevation prompt for standard users' specifically controls how Windows handles privilege escalation attempts by non-administrative users. Setting this to 'Automatically deny elevation requests' ensures that standard users are blocked immediately without presenting a credential prompt.

Step-by-Step Solution

1
Identify the goal
Prevent standard users from seeing credential elevation prompts and automatically deny administrative tasks.
Security policy requires silent auto-denial for standard users attempting elevated operations.
2
Locate the relevant Windows Security policy
Navigate to Local Security Policy (secpol.msc) > Security Settings > Local Policies > Security Options.
UAC behavior settings are managed via Security Options in the Local Security Policy snap-in.
3
Select the specific UAC policy setting
Configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This policy explicitly handles standard user privilege elevation behavior.

Key Concept

Windows User Account Control (UAC) Elevation Prompt Behaviors
Question 164Question

Following a severe hardware malfunction in a storage array, a technician receives three magnetic hard disk drives (HDDs) with physically broken read/write head assemblies. Corporate policy requires that all drive platters be sanitized of sensitive corporate data before the physical chassis components are submitted for scrap recycling. Because software-based sanitization tools cannot communicate with the non-functional drive controllers, which method will effectively purge the data from these magnetic drives?

Show answer & explanation

Answer: Exposing the drives to a high-power degaussing field

Answer

Exposing the drives to a high-power degaussing field
Degaussing uses an intense magnetic field to disrupt and randomize the magnetic domains on disk platters. It is effective for magnetic media (such as HDDs and magnetic tapes) even when the drive has suffered mechanical or controller failure and cannot be powered on.

Step-by-Step Solution

1
Analyze the operational condition of the media
The HDDs have broken read/write head assemblies and cannot be detected or written to by software utilities.
Selecting an appropriate sanitization method depends on whether the storage media is functional and accessible via software.
2
Evaluate sanitization methods against media failure state
Logical methods like zero-fill overwriting, formatting, and cryptographic erase require working drive electronics and heads.
When drive hardware fails mechanically, software-based sanitization tools cannot interface with the media.
3
Select physical/magnetic purging technique suitable for non-functional magnetic media
Degaussing applies a strong external magnetic field that neutralizes the alignment of magnetic particles on the platters without needing the drive mechanism to function.
Degaussing is the standard CompTIA A+ approved method for purging non-operational magnetic media.

Key Concept

Data Purging on Non-Functional Magnetic Media
Estimated Time:1m 0s
Question 165Question

An IT security technician is investigating a multi-stage security incident at a corporate facility. The investigation reveals that an attacker contacted a junior financial accountant via a phone call, posing as an internal IT service desk engineer to trick the accountant into verifying their credentials and approving an unauthorized multi-factor authentication (MFA) push notification. Additionally, physical security footage indicates that the attacker entered the restricted server room by closely following an authorized employee through a badge-protected security door before it latched. Which of the following social engineering threat types were executed during this incident? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Vishing; Tailgating

Answer

The social engineering threat types executed during the incident are Vishing and Tailgating.
Vishing and Tailgating are correct. Vishing is voice-based phishing where attackers use phone calls to manipulate victims into exposing sensitive access controls or MFA prompts. Tailgating is an unauthorized physical entry tactic where an attacker closely follows an authorized person into a secured building or room.

Step-by-Step Solution

1
Analyze the phone call attack vector
The attacker impersonated IT support over a telephone call to trick the user into granting MFA approval, which matches the definition of vishing (voice phishing).
Social engineering attacks conducted via telephone calls are classified specifically as vishing.
2
Analyze the physical breach vector
The attacker physically followed an authorized badge holder through a restricted door without credentials, which matches the definition of tailgating.
Gaining physical entry by walking in right behind an authorized person taking advantage of an opened door is tailgating.

Key Concept

Identifying social engineering threat types based on digital communication vectors and physical security breaches.
Estimated Time:1m 15s
Question 166Question

A technician needs to sanitize several retired magnetic hard disk drives (HDDs) containing sensitive company data. The technician wants to completely disrupt and neutralize the magnetic domains on the drive platters so the data cannot be recovered. Which of the following methods should the technician use?

Show answer & explanation

Answer: Degaussing

Answer

Degaussing is the correct method because it exposes magnetic storage media to a powerful magnetic field, rendering the data on magnetic HDDs unrecoverable.
Degaussing subjects magnetic storage devices (such as traditional HDDs and magnetic tapes) to a powerful magnetic field. This process neutralizes the magnetic domains on the drive platters, making all stored data permanently unrecoverable.

Step-by-Step Solution

1
Identify the media type and destruction objective.
The media consists of magnetic hard disk drives (HDDs), and the objective is to neutralize magnetic platter domains.
Sanitization requirements depend on whether the storage medium uses flash memory or magnetic platters.
2
Select the proper sanitization technique.
Degaussing applies a strong electromagnetic pulse that aligns magnetic particles to a uniform state, eliminating all stored data and timing tracks.
Degaussing is the standard non-destructive physical method for sanitizing magnetic drives prior to disposal or recycling.

Key Concept

Data Destruction and Disposal Methods - Degaussing Magnetic Media
Question 167Question

A security administrator needs to harden a standalone Windows 11 Pro system by enforcing credential prompts on the Secure Desktop for administrative elevations and enabling Admin Approval Mode for the local Built-in Administrator account using administrative tools. In what correct sequential order should the technician execute these administrative steps from start to finish?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by opening secpol.msc, navigating to Security Settings > Local Policies > Security Options, setting the administrator elevation behavior to prompt for credentials on the secure desktop, enabling Admin Approval Mode for the Built-in Administrator account, and finally executing gpupdate /force to apply the changes.
The standard procedure for hardening local security policy settings requires opening the snap-in console (secpol.msc), navigating to Security Settings > Local Policies > Security Options, configuring the target UAC prompt and Admin Approval policies, and executing gpupdate /force to force policy enforcement.

Step-by-Step Solution

1
Launch the management console using secpol.msc.
The Local Security Policy console window opens.
Administrative security options for UAC are managed within the Local Security Policy snap-in on Windows 11 Pro.
2
Navigate to Security Settings > Local Policies > Security Options.
The detailed list of system security options and UAC policies becomes visible.
UAC policies are organized under the Security Options subfolder within Local Policies.
3
Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Administrative actions trigger a credential prompt on an isolated desktop screen.
This prevents automated software or malware from spoofing user input or bypassing elevation controls.
4
Set 'User Account Control: Admin Approval Mode for the Built-in Administrator account' to 'Enabled'.
The built-in Administrator account must respond to UAC prompts for administrative privilege elevation.
By default, the built-in Administrator account bypasses UAC unless explicit Admin Approval Mode policy is enabled.
5
Run gpupdate /force from an elevated Command Prompt.
Local security policy changes take effect immediately.
Forces an immediate refresh of local policy configurations without waiting for default background refresh intervals.

Key Concept

Windows Local Security Policy (secpol.msc) and UAC Admin Approval Mode configuration
Estimated Time:2m 0s
Question 168Question

A user logged in with a standard user account on a Windows workstation attempts to run a software installer that modifies system files. Before the installation can start, a User Account Control (UAC) dialog box appears requesting administrator credentials. Which of the following explains why this prompt was displayed?

Show answer & explanation

Answer: Standard user accounts require privilege elevation and administrative credentials to make changes that affect system configurations.

Answer

Standard user accounts require privilege elevation and administrative credentials to make changes that affect system configurations.
User Account Control (UAC) prevents unauthorized system-wide changes by requiring standard users to enter administrator credentials before executing applications or installer packages that modify operating system settings.

Step-by-Step Solution

1
Identify the user's role and requested action.
The user has a standard account and is trying to run an installer that alters system-wide files.
Standard user accounts operate with limited privileges to prevent unauthorized system modifications.
2
Evaluate how User Account Control (UAC) handles standard user privilege boundaries.
UAC triggers a credential prompt requiring an administrator password to proceed with the action.
This behavior ensures that administrative consent or credentials are provided before system changes occur.

Key Concept

User Account Control (UAC) Privilege Elevation for Standard Users
Question 169Question

A systems technician must secure an organization's dedicated hardware equipment housed inside a shared colocation data center floor. Although the facility provides general building perimeter security, the technician must prevent unauthorized personnel from opening server enclosures to access internal components, as well as prevent unauthorized physical cable connections into unused network ports on rack-mounted switches. Which TWO of the following physical security controls should the technician deploy to meet these objectives?

Select all that apply

Show answer & explanation

Answer: Lockable rack cabinets; Port locks

Answer

The correct controls to implement are lockable rack cabinets and port locks.
Lockable rack cabinets restrict access to internal server components within a shared facility, while port locks insert into unused RJ45 jacks to physically prevent unauthorized network line connections.

Step-by-Step Solution

1
Analyze requirement 1: Protecting server enclosures inside a shared facility
Lockable rack cabinets provide localized enclosure locking to prevent unauthorized opening of server chassis on a shared data center floor.
Perimeter security alone does not protect hardware from other tenants or staff sharing the same room.
2
Analyze requirement 2: Preventing unauthorized connections to unused switch ports
Port locks physically block unused RJ45 network jacks, preventing unauthorized network drop connections.
Open physical ports on network switches present an unauthorized access risk if left unprotected.
3
Evaluate remaining options
Vehicle bollards, privacy filters, and Faraday cages address vehicle impacts, visual eavesdropping, and RF signals respectively, failing to meet the scenario requirements.
Each physical security control serves a specific objective and cannot be substituted for rack and port hardening.

Key Concept

Physical Security Controls
Question 170Question

A network technician is configuring wireless access for specialized barcode scanners in a distribution warehouse. The primary corporate wireless network relies on WPA3-Enterprise with 802.1X/RADIUS authentication using EAP-TLS client certificates. The new handheld scanners cannot store digital certificates or perform 802.1X authentication, but they fully support WPA3-Personal utilizing Simultaneous Authentication of Equals (SAE). Company policy requires network isolation for non-802.1X devices while maintaining the strongest possible wireless security controls without lowering the authentication requirements of the primary corporate network. Which of the following is the BEST solution for the technician to implement?

Show answer & explanation

Answer: Provision a new dedicated SSID configured with WPA3-Personal assigned to a segregated VLAN for the barcode scanners.

Answer

Provision a new dedicated SSID configured with WPA3-Personal assigned to a segregated VLAN for the barcode scanners.
Deploying a dedicated SSID configured for WPA3-Personal (SAE) on a separate VLAN isolates non-802.1X handheld scanners from corporate assets while enforcing strong WPA3 pre-shared key encryption. This meets device compatibility requirements without weakening the 802.1X/EAP-TLS security on the primary corporate SSID.

Step-by-Step Solution

1
Analyze device capabilities and enterprise constraints.
The handheld scanners lack 802.1X/EAP-TLS authentication capabilities but support WPA3-Personal (SAE).
Devices that cannot process client certificates cannot authenticate against an 802.1X RADIUS server on a WPA3-Enterprise network.
2
Evaluate security policy requirements.
Policy mandates network isolation for non-enterprise authentication devices without degrading corporate WPA3-Enterprise security.
Modifying or downgrading the main corporate SSID compromises existing security controls for corporate users.
3
Select the optimal wireless architecture solution.
Create a secondary SSID utilizing WPA3-Personal (SAE) bound to a dedicated guest/IoT VLAN.
This configuration delivers robust WPA3 encryption for the scanners while using VLAN segmentation to isolate non-802.1X traffic from corporate network resources.

Key Concept

WPA3-Personal vs Enterprise Coexistence and Network Segmentation
Estimated Time:2m 0s
Question 171Question

A desktop technician needs to configure a standalone Windows 11 workstation to the maximum User Account Control (UAC) security level using the Graphical User Interface (GUI). Place the following steps in the correct chronological order to complete this task.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with launching the User Account Control Settings utility via the Run dialog (UserAccountControlSettings.exe), sliding the security level to 'Always notify', clicking OK to save the change, and confirming the UAC prompt to elevate and enforce the updated policy.
To configure maximum UAC security, a technician must open the UAC configuration applet (`UserAccountControlSettings.exe`), move the slider to 'Always notify', select OK to commit the modification, and finally approve the resulting UAC elevation prompt to apply the system-wide policy change.

Step-by-Step Solution

1
Launch the UAC configuration window using the Run command `UserAccountControlSettings.exe`.
The User Account Control Settings control panel applet opens.
This utility provides the standard GUI interface for adjusting UAC notification thresholds.
2
Move the configuration slider up to the top level.
The policy setting updates to 'Always notify'.
This setting ensures the system prompts for administrative credentialing or consent before any software installation or system configuration change occurs.
3
Click OK at the bottom of the dialog window.
Windows initiates the administrative confirmation workflow.
System changes must be submitted before Windows requests administrative consent to commit them.
4
Click Yes on the elevation prompt.
The new UAC setting is saved and becomes active.
Modifying UAC behavior requires administrative approval to prevent unauthorized tampering.

Key Concept

Configuring User Account Control (UAC) notification levels in Windows
Question 172Question

A security administrator is hardening corporate Windows 11 Pro workstations against potential malware threats. Company security policy mandates that User Account Control (UAC) must strictly enforce Public Key Infrastructure (PKI) validation, automatically denying elevation requests for any executable file or setup installer that lacks a verified, trusted digital signature. Which policy setting under Local Security Policy (secpol.msc) directly achieves this requirement?

Show answer & explanation

Answer: User Account Control: Only elevate executables that are signed and validated

Answer

User Account Control: Only elevate executables that are signed and validated
The policy setting 'User Account Control: Only elevate executables that are signed and validated' enforces Public Key Infrastructure (PKI) signature checks. When enabled, Windows verifies the digital signature and certificate path of any executable file requesting administrative privileges, denying elevation if the signature is missing or untrusted.

Step-by-Step Solution

1
Identify the primary administrative objective in the scenario
The requirement is to force UAC to validate PKI digital signatures before granting elevation to any executable file.
Unsigned binaries or scripts must be blocked from privilege elevation to prevent malicious or unverified code execution.
2
Locate the relevant Security Options category within Local Security Policy (secpol.msc)
Navigate to Local Policies -> Security Options to inspect UAC configuration policies.
Windows granular UAC behavior controls are stored under Security Options in the Local Security Policy console.
3
Select the policy specifically targeted at code-signing compliance
Enabling 'User Account Control: Only elevate executables that are signed and validated' restricts elevation prompts strictly to PKI-signed binaries.
This specific security directive enforces strict digital certificate chain validation for any application seeking administrative rights.

Key Concept

Enforcing PKI Digital Signature Validation for UAC Elevation via Local Security Policy
Question 173Question

A systems engineer is responding to a security incident involving a Windows 11 point-of-sale terminal that was flagged for stealthy spyware behavior. The engineer has identified the infection symptoms and successfully isolated the system by disabling all network interfaces and unplugging physical connections. According to the standard CompTIA 7-step malware remediation process, which action must the engineer perform NEXT prior to updating anti-malware signatures or initiating a scan?

Show answer & explanation

Answer: Turn off System Protection to disable System Restore on the endpoint.

Answer

Turn off System Protection to disable System Restore on the endpoint.
The CompTIA 7-step malware remediation process strictly follows this sequence: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware / scan and remove), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the scenario states that symptoms have been identified (Step 1) and the system has been isolated/quarantined (Step 2), the immediate next step is Step 3: disabling System Restore.

Step-by-Step Solution

1
Analyze current progress in the CompTIA 7-step malware remediation framework.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine infected systems) have already been performed.
Determining the current state in the sequential process establishes what comes immediately next.
2
Identify the mandatory third step in the remediation process.
Step 3 requires disabling System Restore in Windows.
Disabling System Restore ensures that clean system files are not overwritten by malware during remediation and prevents infected restore points from reinfecting the machine.
3
Select the option that matches Step 3.
Turning off System Protection disables System Restore.
This step must take place before Step 4 (remediation, definition updates, and scanning).

Key Concept

CompTIA 7-Step Malware Remediation Process
Question 174Question

A systems support technician is troubleshooting a legacy 32-bit line-of-business application installed on standalone Windows 11 Pro workstations. When standard domain users run the application, it crashes upon attempting to write log data to its installation directory under C:\Program Files (x86)\VendorApp. Running the application as an administrator allows it to function, but corporate security policy strictly prohibits granting local administrative rights or disabling User Account Control (UAC). Which policy under Local Security Policy (secpol.msc) should be enabled to resolve the application errors while adhering to security mandates?

Show answer & explanation

Answer: User Account Control: Virtualize file and registry write failures to per-user locations

Answer

Enable 'User Account Control: Virtualize file and registry write failures to per-user locations' in Local Security Policy.
Enabling 'User Account Control: Virtualize file and registry write failures to per-user locations' allows Windows to transparently redirect failed write operations targeted at protected system locations (such as Program Files or HKEY_LOCAL_MACHINE) to a per-user location (%LOCALAPPDATA%\VirtualStore). This resolves compatibility issues for legacy 32-bit software without violating security baselines or requiring administrative rights.

Step-by-Step Solution

1
Identify the root cause of the application crash.
Legacy 32-bit software designed before UAC often attempts to write runtime state or log files directly to its install directory within C:\Program Files (x86).
Standard user accounts lack write permissions to system directories, causing permission denied errors.
2
Evaluate technical and security constraints.
Granting administrator privileges or disabling UAC is explicitly forbidden by security policy.
Least privilege principles must be maintained while enabling legacy application compatibility.
3
Configure UAC file and registry virtualization via Local Security Policy (secpol.msc).
Enabling 'User Account Control: Virtualize file and registry write failures to per-user locations' redirects unprivileged write operations to %LOCALAPPDATA%\VirtualStore.
Virtualization provides transparent backward compatibility for 32-bit legacy applications without altering NTFS permissions or granting administrative rights.

Key Concept

UAC File and Registry Virtualization
Question 175Question

A desktop support technician is reviewing default User Account Control (UAC) settings and behaviors on a Windows 11 Pro workstation. Which TWO of the following statements accurately describe how UAC functions to safeguard the operating system?

Select all that apply

Show answer & explanation

Answer: Standard user accounts are prompted to enter administrator credentials whenever an operation requires elevated privileges.; Administrative accounts operating in Admin Approval Mode are prompted to grant consent before high-privilege system modifications take effect.

Answer

Standard user accounts are prompted to enter administrator credentials whenever an operation requires elevated privileges, and administrative accounts operating in Admin Approval Mode are prompted to grant consent before high-privilege system modifications take effect.
User Account Control operates by restricting applications to standard user permissions even when logged in as an administrator. When a standard user attempts an action requiring administrative privileges, UAC requests valid admin credentials. When an administrator performs such an action, UAC prompts for consent to elevate the process token.

Step-by-Step Solution

1
Analyze standard user UAC elevation requirements.
Standard accounts cannot execute administrative tasks without authorization from an administrator account via credential entry.
UAC isolates system-level permissions from standard users to prevent unauthorized installation or configuration changes.
2
Analyze administrator account UAC elevation requirements.
Administrators run with standard access tokens until an operation requests elevation, triggering a consent prompt on the Secure Desktop.
This prevents background applications or malware from silently making system modifications using administrator rights.

Key Concept

User Account Control (UAC) Elevation and Prompt Behaviors
Question 176Question

A security technician is preparing to decommission server rack disk arrays containing retired magnetic Hard Disk Drives (HDDs) that stored unencrypted sensitive employee data. According to organizational security policy and CompTIA A+ guidelines, which TWO of the following sanitization and disposal methods are appropriate for destroying the data on these magnetic HDDs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Exposing the magnetic hard drives to a high-density electromagnetic field generator (degaussing); Passing the magnetic disk units through an industrial physical drive shredder

Answer

The correct procedures are degaussing the magnetic hard drives using a high-density electromagnetic field generator and physically destroying the drives using an industrial drive shredder.
For magnetic hard disk drives (HDDs), both degaussing (exposing magnetic platters to strong electromagnetic fields) and physical destruction (such as industrial drive shredding) ensure that confidential data cannot be retrieved forensically.

Step-by-Step Solution

1
Identify the media type and compliance sensitivity level.
The target media consists of magnetic Hard Disk Drives (HDDs) containing sensitive unencrypted corporate employee records.
Selecting the correct disposal method requires matching media physical construction (magnetic vs. flash memory) to required security thresholds.
2
Evaluate degaussing as a destruction method.
Degaussing neutralizes magnetic domains on disk platters, effectively rendering magnetic media blank and unreadable.
Degaussing is an industry-standard method for sanitizing magnetic media prior to disposal.
3
Evaluate physical shredding as a destruction method.
Industrial mechanical shredding destroys physical platters completely.
Physical destruction prevents any possibility of drive re-use or forensic data extraction.

Key Concept

Data Sanitization and Media Disposal Methods for Magnetic Drives
Question 177Question

A financial controller at a manufacturing company receives an urgent telephone call from an individual claiming to be a senior network technician from the firm's internet service provider (ISP). The caller states that an impending line outage will disrupt business operations unless the controller immediately verifies their administrative portal login credentials and provides a one-time multi-factor authentication passcode. Which of the following social engineering threat types is described in this scenario?

Show answer & explanation

Answer: Vishing

Answer

Vishing
The scenario describes vishing (voice phishing), which occurs when an attacker uses telephone calls or voice technology to manipulate individuals into disclosing sensitive data, such as login credentials or passcodes.

Step-by-Step Solution

1
Identify the communication vector used by the threat actor
The attack takes place via an interactive telephone voice call.
Determining the medium (voice, electronic message, physical access) narrows down the social engineering threat classification.
2
Analyze the pretext and requested action
The attacker creates false urgency (impending network outage) to trick the user into revealing portal credentials and a multi-factor passcode.
Social engineering attacks create artificial urgency to bypass logical security controls and standard operational procedures.
3
Match the observed attack characteristics to standard CompTIA security taxonomy
Voice-based phishing attacks are classified specifically as vishing.
Vishing explicitly refers to voice phishing scenarios using telecommunication networks.

Key Concept

Vishing (Voice Phishing)
Estimated Time:1m 0s
Question 178Question

A technician has successfully remediated an infected Windows workstation by running updated anti-malware scans and removing the detected threats. Which TWO of the following steps should the technician perform NEXT to complete the standard CompTIA malware remediation process?

Select all that apply

Show answer & explanation

Answer: Schedule automatic anti-malware updates and periodic system scans; Enable System Restore and create a fresh restore point

Answer

The technician should schedule automatic updates and periodic scans, and enable System Restore while creating a clean restore point.
Following malware removal (Step 4), the proper sequence requires scheduling ongoing scans and updates (Step 5), followed by re-enabling System Restore and creating a clean restore point (Step 6) to establish a safe baseline.

Step-by-Step Solution

1
Review the current step in the CompTIA 7-step malware remediation process.
The technician has completed Step 4 (Remediate infected systems).
Determines which steps sequentially follow threat removal.
2
Identify the next mandatory steps in the process.
Step 5 is scheduling updates and scans, followed by Step 6: enabling System Restore and creating a new restore point.
Ensures preventive measures and safe system recovery baselines are restored.

Key Concept

CompTIA 7-step Malware Remediation Process
Question 179Question

An IT technician is updating the company's storage media disposition policy to ensure compliance with NIST data security standards across different drive types and physical conditions. Match each data destruction method on the left with its appropriate operational description on the right.

Click a left item, then click its matching right item

Items

Degaussing
Cryptographic Erase
Industrial Shredding
Overwriting (Zero-Fill)

Matches

Show answer & explanation

Answer

Degaussing matches exposing magnetic media to electromagnetic fields. Cryptographic Erase matches deleting the media encryption key on self-encrypting SSDs/NVMe drives. Industrial Shredding matches mechanically cutting storage media into minute particles. Overwriting matches writing continuous patterns of zeroes across addressable sectors for safe drive redeployment.
Each data destruction method directly corresponds to its target mechanism: Degaussing disrupts magnetic domain alignment on magnetic drives; Cryptographic Erase destroys internal decryption keys on encrypted flash storage; Industrial Shredding physically pulverizes media; and Overwriting replaces data blocks with zeroes on working drives intended for reuse.

Step-by-Step Solution

1
Identify the underlying technology of the storage media (magnetic vs. flash storage).
Recognize that magnetic drives (HDDs, tapes) respond to electromagnetic fields, whereas flash drives (SSDs, NVMe) utilize semiconductor transistors unaffected by magnetic force.
Matching degaussing specifically to magnetic media and cryptographic erase to encrypted flash storage prevents invalid sanitization selections.
2
Evaluate hardware lifecycle goals (device reuse versus physical destruction).
Determine that functional drives intended for redeployment require non-destructive sanitization such as zero-fill overwriting or cryptographic erase, while defective drives require physical shredding.
Ensures data security compliance while optimizing hardware asset disposal policies.
3
Pair each destruction technique with its primary operational mechanism.
Link Degaussing to electromagnetic domain neutralization, Cryptographic Erase to key purging, Shredding to particle disintegration, and Overwriting to sector zero-filling.
Establishes accurate alignment with CompTIA A+ guidelines for data destruction and disposal.

Key Concept

Selecting proper data sanitization and physical disposal methods based on media architecture (magnetic vs. solid-state) and functional state.
Question 180Question

A network administrator is hardening a financial institution's wireless infrastructure to comply with updated security policies. The requirements state that all connecting wireless clients must authenticate individually using client-side digital certificates against a central RADIUS server, and the access points must completely eliminate susceptibility to wireless protocol downgrade attacks. Which TWO of the following configurations should the administrator implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) on the RADIUS server and access points.; Disable WPA2/WPA3 Transition (Mixed) Mode on the wireless access points.

Answer

The administrator must configure EAP-TLS as the authentication protocol and disable WPA2/WPA3 Transition Mode on the access points.
Implementing EAP-TLS ensures mutual authentication via digital certificates (requiring both client and RADIUS server certificates). Disabling WPA2/WPA3 Transition Mode forces all connecting devices to negotiate pure WPA3 security mechanisms, effectively mitigating potential protocol downgrade vulnerabilities.

Step-by-Step Solution

1
Analyze authentication protocol requirements for client certificates.
Identify EAP-TLS as the standard 802.1X protocol that mandates client-side and server-side digital certificates for mutual authentication.
PEAP and EAP-TTLS typically use password-based inner authentication (such as MSCHAPv2) with only server certificates, failing the mandatory client certificate policy.
2
Evaluate access point operational modes to prevent downgrade vectors.
Select disabling WPA2/WPA3 Transition Mode to enforce exclusive WPA3 Enterprise operation.
Transition mode permits legacy WPA2 client associations, leaving the network exposed to protocol downgrade attacks.

Key Concept

WPA3 Enterprise authentication architecture using EAP-TLS and 802.1X/RADIUS controls.
Estimated Time:2m 0s
PreviousPage 9 / 23Next
Security Practice Questions — CompTIA A+ (Core 1 & Core 2) — Page 9 | Examkin