Tüm alıştırma soruları

3551 soru

Soru 2421Soru

An IT technician is updating client logon scripts to automatically evaluate system parameters and set environment variables across different operating system environments. Which TWO of the following statements correctly describe variable syntax and environment features for Windows Batch (.bat) and PowerShell (.ps1) scripts? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In a Windows Batch script (.bat), environment variables are referenced by enclosing the variable name in percent signs, such as %USERNAME%.; In a PowerShell script (.ps1), variables are declared and referenced using a leading dollar sign, such as usernameorusername or env:USERNAME.

Cevap

The correct answers are the statement describing Windows Batch script variable referencing using percent signs (%USERNAME%) and the statement describing PowerShell variable notation using a leading dollar sign (usernameorusername or env:USERNAME).
In Windows Batch (.bat) scripting, environment variables are called by enclosing their names in percent signs (e.g., %USERNAME%). In PowerShell (.ps1) scripting, variables always begin with a dollar sign prefix (e.g., usernameorusername or env:USERNAME for environment variables). Both of these statements accurately represent their respective scripting language standards.

Adım Adım Çözüm

1
Identify the variable syntax rules for legacy Windows Batch (.bat) scripts.
Batch scripts expand environment variables using percent signs, such as %USERNAME% or %TEMP%.
Windows Command Prompt syntax relies on % surrounding variable names for evaluation.
2
Identify the variable syntax rules for Windows PowerShell (.ps1) scripts.
PowerShell prefixes variables with a dollar sign (),using), using env:VARIABLE for environment variables and $variable for script-scoped variables.
PowerShell enforces strong object and variable naming conventions beginning with $.
3
Evaluate and eliminate distractors that mix script syntax rules.
Statements attributing dollar signs and -eq operators to Batch scripts, or percent signs to PowerShell scripts, are incorrect.
Mixing syntax between Batch and PowerShell is a common operational error when editing administration scripts.

Anahtar Kavram

Scripting language syntax differences between Windows Batch (.bat) and PowerShell (.ps1)
Soru 2422Soru

A system builder is connecting the small, individual wire leads from a PC case to the motherboard during a custom desktop assembly. These leads include wires labeled POWER SW, RESET SW, HDD LED, and POWER LED. To which of the following motherboard locations should these connectors be attached?

Cevabı ve açıklamayı göster

Cevap: Front panel system header

Cevap

Front panel system header
The front panel system header consists of a keyed array of small pins on the motherboard specifically designed to accept the individual 1-pin and 2-pin connectors from the computer case for power, reset, and status LEDs.

Adım Adım Çözüm

1
Identify the function of the case leads (POWER SW, RESET SW, HDD LED, POWER LED).
Recognize that these are low-voltage switches and status indicators originating from the chassis controls.
Chassis controls require a centralized pin block on the motherboard to signal power states and drive activity.
2
Locate the designated motherboard interface designed for chassis switches and indicators.
Identify the Front Panel System Header (F_PANEL / JFP1).
Motherboard pin blocks are standardized by function; the front panel header uses specific pin pair orientations for switch contacts and positive/negative LED diodes.

Anahtar Kavram

Motherboard Front Panel Headers and Pin Assignments
Soru 2423Soru

A network support technician at a municipal utility company is responding to a Windows 10 desktop infected with rogue adware and browser hijacking tools. Place the standard CompTIA malware remediation steps in the correct sequential order from first to last to properly resolve this incident.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the CompTIA 7-step malware removal process: 1. Quarantine the infected desktop by disconnecting network cables and disabling wireless adapters; 2. Disable System Restore in Windows to clear existing restore points containing infected files; 3. Update anti-malware signatures and run a full system scan to remediate the infection; 4. Enable System Restore and create a new, clean system restore point; 5. Educate the end user on identifying suspicious web links and avoiding rogue browser add-ons.
The correct order follows CompTIA's established best practices for malware remediation: first isolate the system (Quarantine), then prevent reinfection via restore points (Disable System Restore), eliminate the threat (Remediate by updating definitions and scanning), restore recovery functionality (Enable System Restore and create a restore point), and finally prevent recurrences (Educate end user).

Adım Adım Çözüm

1
Quarantine the infected system from the local network environment.
Network cables are unplugged and wireless connectivity is turned off.
Prevents the adware/hijacker from communicating with external servers or spreading laterally to other network devices.
2
Disable System Restore in Windows settings.
Existing Windows system restore points containing malicious files are permanently deleted.
Ensures that malware hidden in system restore snapshots cannot be restored after cleanup.
3
Remediate the system by updating anti-malware software definitions and executing a full scan.
The adware components, browser extensions, and unauthorized registry entries are identified and quarantined/removed.
Ensures the scanner has the latest threat signatures to locate and eradicate all components of the malware.
4
Re-enable System Restore and create a clean system restore point.
System protection is restored with a verified malware-free baseline.
Re-establishes recovery capability for the operating system after confirming the infection is completely cleared.
5
Provide security awareness education to the primary workstation user.
The user is trained on recognizing social engineering tactics, drive-by downloads, and malicious browser extensions.
Completes the remediation process by addressing the human vector to prevent future infections.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Tahmini Süre:1m 30s
Soru 2424Soru

A technician is installing an enterprise line-of-business application on a newly imaged, offline Windows 11 workstation. During the setup process, an error message indicates that Microsoft .NET Framework 3.5 is a mandatory prerequisite but is currently missing, and the setup fails because the workstation cannot reach Windows Update over the Internet. The technician has mounted the official Windows installation ISO to drive letter D:. Which of the following procedures should the technician perform to enable the required feature offline and complete the installation?

Cevabı ve açıklamayı göster

Cevap: Execute DISM from an elevated command prompt referencing the installation media source path

Cevap

Execute DISM from an elevated command prompt referencing the installation media source path
The option specifying DISM execution from an elevated prompt with the installation source path is correct. DISM (Deployment Image Servicing and Management) is designed to service Windows images and enable features like .NET Framework 3.5 in offline environments by retrieving source files directly from installation media (e.g., D:\sources\sxs) using the /source parameter.

Adım Adım Çözüm

1
Identify the installation error root cause
The target application requires .NET Framework 3.5, which is an optional Windows feature not enabled by default and unavailable online due to air-gapped environment constraints.
Air-gapped machines cannot query Windows Update servers directly to download feature-on-demand files.
2
Locate the feature payload on the local installation media
The required feature payload resides inside the Side-by-Side folder (sources\sxs) of the mounted Windows installation ISO on drive D:.
Windows installation media stores offline installation files for optional component features.
3
Run DISM command with elevated privileges
Executing 'dism /online /enable-feature /featurename:NetFx3 /all /source:D:\sources\sxs /limitaccess' installs the prerequisite feature offline without requiring internet connectivity.
DISM Services the active operating system image and points directly to local media assets.

Anahtar Kavram

Offline Feature Installation and Prerequisite Management
Tahmini Süre:1m 30s
Soru 2425Soru

A systems administrator is setting up storage and backup policies for a web application database that processes personal information of customers residing in the European Union. Which of the following technical controls and compliance procedures must be implemented to comply with the General Data Protection Regulation (GDPR)? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Implement technical mechanisms to permanently delete an individual's personal data upon receiving a valid request.; Apply strong cryptographic encryption to personal data both in transit and at rest.

Cevap

The correct controls to implement are providing technical mechanisms to permanently delete an individual's personal data upon request and applying strong cryptographic encryption to personal data in transit and at rest.
Under GDPR, organizations processing personal data of EU residents must implement robust technical protections, such as encrypting personal data in transit and at rest, while also adhering to individual data subject rights, specifically providing technical means to permanently delete personal data upon request (Right to Erasure).

Adım Adım Çözüm

1
Identify the governing regulatory framework based on the geographic and data scope.
The target compliance framework is GDPR because the application processes personal data (PII) of European Union citizens.
GDPR applies specifically to entities collecting or processing personal data belonging to EU residents.
2
Evaluate required technical safeguards and individual rights mandated by GDPR.
GDPR mandates data protection mechanisms including encryption in transit and at rest as well as honoring data subject rights like the Right to Erasure ('Right to be Forgotten').
Organizations must safeguard data integrity and confidentiality while providing users control over their stored personal data.
3
Identify and reject misapplied controls from other regulatory standards.
Storing card verification values violates PCI-DSS rules, and Business Associate Agreements pertain to HIPAA compliance, making both distractor options incorrect.
Confusing PCI-DSS payment card restrictions or HIPAA healthcare agreements with GDPR personal data requirements represents a scope misinterpretation.

Anahtar Kavram

GDPR Technical Safeguards and Data Subject Rights
Soru 2426Soru

A help desk technician is assisting a macOS user who needs to locate and manage stored passwords, private encryption keys, and digital certificates used by various applications and system services. Which native macOS utility should the technician instruct the user to open?

Cevabı ve açıklamayı göster

Cevap: Keychain Access

Cevap

Keychain Access is the correct utility for viewing and managing stored passwords, security keys, and certificates on macOS.
Keychain Access is the native macOS password and credential manager. It securely stores passwords for web accounts, Wi-Fi networks, servers, applications, as well as digital certificates and encryption keys, making it the correct tool for managing these items.

Adım Adım Çözüm

1
Identify the user requirement in the scenario.
The user needs to locate and manage saved application passwords, digital certificates, and encryption keys.
Understanding the target resource (credentials and keys) narrows down the native macOS tool needed.
2
Evaluate the functional role of native macOS administrative utilities.
Keychain Access acts as the encrypted password manager for macOS, holding internet passwords, network credentials, certificates, and secure notes.
Matching utility features ensures selection of the correct built-in macOS application.

Anahtar Kavram

macOS Keychain Access credential and certificate management utility
Tahmini Süre:1m 0s
Soru 2427Soru

A network security administrator is planning a major upgrade to an organization's centralized intrusion prevention system (IPS) appliance. The administrator has documented the purpose of the change, completed a risk analysis, outlined the step-by-step implementation procedure, and developed a verified rollback plan. Which of the following should the administrator prepare NEXT before submitting the request to the Change Advisory Board (CAB) for authorization?

Cevabı ve açıklamayı göster

Cevap: Draft an end-user and stakeholder notification plan detailing expected maintenance windows and service impacts.

Cevap

Drafting an end-user and stakeholder notification plan detailing expected maintenance windows and service impacts.
Establishing a stakeholder notification plan is a mandatory element of a standard change request. Before the Change Advisory Board (CAB) grants approval, administrators must specify how end users and business units will be notified about scheduled downtime or performance impacts.

Adım Adım Çözüm

1
Identify completed components of the change management request workflow.
Purpose, risk analysis, implementation plan, and rollback plan have already been established.
Tracking workflow progress identifies missing pre-approval requirements.
2
Determine the remaining required documentation for CAB submission.
End-user and business stakeholder notification scheduling must be established.
CAB members evaluate not only technical safety but also business disruption and communication readiness before granting approval.

Anahtar Kavram

Standard Change Request Components & Workflow Sequence
Soru 2428Soru

A technician is troubleshooting a Windows 10 workstation that displays a Boot Configuration Data (BCD) missing error during startup. The technician needs to rebuild the BCD store using the command line in the Windows Recovery Environment (WinRE). Place the steps of this repair process in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order begins with opening the WinRE Command Prompt, executing bootrec /rebuildbcd to scan for OS installations, pressing Y to add the detected OS to the BCD store, and finally exiting to restart the workstation.
The proper troubleshooting procedure requires first opening the WinRE Command Prompt, issuing bootrec /rebuildbcd to scan the storage drive for installed Windows operating systems, confirming the prompt with Y to write the entry to the BCD store, and restarting the computer to complete the verification.

Adım Adım Çözüm

1
Launch the Command Prompt from WinRE Advanced Options.
Gains elevated offline administrative CLI access.
Boot repair tools like bootrec require an offline command environment.
2
Run bootrec /rebuildbcd.
Scans disks and prompts to add discovered Windows installations to the BCD.
The /rebuildbcd switch explicitly fixes missing or damaged BCD store records.
3
Confirm the boot addition prompt by entering Y.
Writes the operating system bootloader path into the BCD configuration.
Without user confirmation, the bootrec tool will not add the identified installation to the boot loader.
4
Close the command interface and restart the PC.
Initiates normal boot process using the repaired BCD store.
A system restart is required to verify that the boot sequence completes into Windows.

Anahtar Kavram

Rebuilding the Boot Configuration Data (BCD) store using the bootrec tool in WinRE
Soru 2429Soru

An IT administrator is preparing to reassign several high-performance NVMe solid-state drives (SSDs) from a server handling confidential financial data to an internal lab environment with lower security requirements. To comply with NIST SP 800-88 sanitization guidelines and ensure the drives remain operational for reuse, which method should the administrator employ?

Cevabı ve açıklamayı göster

Cevap: Execute a Cryptographic Erase (CE) or built-in drive vendor sanitization command.

Cevap

Execute a Cryptographic Erase (CE) or built-in drive vendor sanitization command.
Executing a Cryptographic Erase (CE) or using firmware-level sanitization commands (such as NVMe Format with Sanitize command) is the NIST-approved method for purging data on self-encrypting solid-state drives. It securely destroys the data encryption key (DEK) within seconds, rendering all stored blocks unreadable while preserving the drive's operational integrity for reuse.

Adım Adım Çözüm

1
Identify the media type and goal.
The target media consists of solid-state drives (SSDs) that must be sanitized (purged) of sensitive data while remaining reusable.
Different storage technologies require specific sanitization mechanisms according to standards such as NIST SP 800-88.
2
Evaluate sanitization methods compatible with solid-state storage.
Flash-based storage requires firmware-level commands (such as Cryptographic Erase or NVMe Format / ATA Secure Erase) because software-level overwriting cannot address wear-leveled or reserved NAND blocks.
Degaussing is ineffective on flash memory, and multi-pass overwriting induces unnecessary hardware wear while leaving hidden wear-leveled blocks untouched.
3
Select the optimal method for secure purge and hardware reuse.
Cryptographic Erase instantly renders encrypted data inaccessible by destroying the media encryption key, preparing the drive safely for redeployment.
Cryptographic Erase meets regulatory purge requirements efficiently without degrading flash endurance.

Anahtar Kavram

SSD Data Sanitization and Cryptographic Erase
Soru 2430Soru

A network security technician is standardizing wireless access controls across various corporate branch sites based on specific operational requirements. Match each wireless access scenario on the left with the appropriate security protocol or mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Providing centralized user authentication against an Active Directory domain using 802.1X and a RADIUS server
Securing a small remote office network using a single shared password with AES encryption
Redirecting unauthenticated guest users to a web page requiring acceptance of an Acceptable Use Policy (AUP)
Implementing mutual authentication requiring digital certificates on both the client device and the authentication server

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Centralized 802.1X/RADIUS authentication matches WPA3-Enterprise; SOHO single shared password security matches WPA2-Personal; guest web-page redirection and AUP acceptance matches Captive Portal; mutual authentication using client and server certificates matches EAP-TLS.
Each wireless security control aligns directly with its operational scope: WPA3-Enterprise enables centralized RADIUS/802.1X authentication; WPA2-Personal relies on a PSK for smaller deployments; a Captive Portal forces guest web redirection for terms acceptance; and EAP-TLS delivers robust mutual authentication via client and server certificates.

Adım Adım Çözüm

1
Identify authentication mechanisms for corporate domain environments.
Centralized user-based authentication via 802.1X/RADIUS corresponds to WPA3-Enterprise.
Enterprise modes offload credentials handling to a AAA server (like RADIUS) instead of relying on a shared passphrase.
2
Identify security options for SOHO or small branch sites.
Using a Pre-Shared Key (PSK) with AES encryption corresponds to WPA2-Personal.
Personal mode utilizes a single passphrase shared among users, suitable for smaller sites without domain controllers.
3
Identify mechanisms for guest user access management.
Web redirection for terms acceptance corresponds to a Captive Portal.
Captive portals trap initial HTTP/HTTPS traffic from unauthenticated devices to present terms or collect guest login details.
4
Identify advanced certificate-based EAP methods.
Mutual certificate authentication corresponds to EAP-TLS.
EAP-TLS is one of the highest security EAP types because it requires client-side X.509 certificates in addition to server certificates.

Anahtar Kavram

Wireless Security Protocols and Authentication Frameworks
Soru 2431Soru

A security technician is configuring Windows Security and User Account Control (UAC) settings on newly deployed Windows 11 Pro workstations. The organization security policy requires that standard users are immediately blocked from attempting administrative privilege elevation without seeing a prompt for credentials. Additionally, any administrative actions initiated by the built-in Administrator account must run in Admin Approval Mode to prevent unprompted background elevation. Which of the following security policies in Local Security Policy (secpol.msc) should be configured to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'; Enable 'User Account Control: Admin Approval Mode for the Built-in Administrator account'

Cevap

The technician must set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and enable 'User Account Control: Admin Approval Mode for the Built-in Administrator account' in Local Security Policy (secpol.msc).
To satisfy both security requirements, the technician must configure UAC security options under Local Security Policy (secpol.msc). Setting 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' ensures standard users are denied privilege elevation immediately without presenting a credential prompt. Simultaneously, enabling 'User Account Control: Admin Approval Mode for the Built-in Administrator account' ensures that even the built-in Administrator account is subject to UAC prompts rather than executing tasks with unprompted background elevation.

Adım Adım Çözüm

1
Address the standard user privilege escalation requirement
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' prevents standard users from receiving administrative credential prompts.
This automatically blocks elevation attempts for standard accounts as required by the organizational security policy.
2
Address the built-in administrator account requirement
Enabling 'User Account Control: Admin Approval Mode for the Built-in Administrator account' applies Admin Approval Mode to the built-in Administrator.
By default, the built-in Administrator account runs all applications with full administrative privileges without UAC prompting unless Admin Approval Mode is explicitly enabled for it.

Anahtar Kavram

Configuring Local Security Policy (secpol.msc) UAC settings for standard user elevation denial and built-in administrator approval mode
Soru 2432Soru

During a routine audit at a logistics warehouse, an IT technician discovers that several staff members have downloaded unapproved third-party game packages directly from web browsers onto their corporate-managed handheld scanning devices. The devices run a customized embedded Android operating system and connect to an isolated warehouse subnet. The systems administrator needs to prevent users from installing unauthorized application packages (sideloading) while ensuring IT can still push central software updates remotely. Which of the following configurations should the administrator enforce via the Mobile Device Management (MDM) console to resolve this security risk?

Cevabı ve açıklamayı göster

Cevap: Enforce a restriction policy that blocks application installation from unknown sources across all managed devices.

Cevap

Enforce a restriction policy that blocks application installation from unknown sources across all managed devices.
The correct answer is to enforce a restriction policy blocking application installation from unknown sources. On mobile and embedded Android platforms, downloading and executing application packages directly from web browsers is known as sideloading. Pushing an MDM policy that disables 'unknown sources' prevents end-users from installing unvetted third-party software, while preserving the administrator's ability to push approved enterprise applications.

Adım Adım Çözüm

1
Analyze the threat vector identified in the scenario.
The issue involves users manually downloading and executing unverified package files directly from web browsers onto embedded mobile OS devices.
Installing apps outside trusted enterprise channels (sideloading) introduces severe malware risks.
2
Evaluate MDM control policies designed for application security.
Disabling installation from unknown sources specifically targets sideloading without obstructing pushed updates from managed enterprise repositories.
Mobile Device Management solutions allow granular policy enforcement restricting user-driven package installation.
3
Confirm the administrative resolution.
Applying the unknown sources restriction policy effectively resolves the unauthorized application risk.
This directly remediates the root security vulnerability without impacting operational workflow updates.

Anahtar Kavram

MDM Application Control and Sideloading Prevention
Tahmini Süre:1m 30s
Soru 2433Soru

A laser printer in a shared office frequently pulls multiple sheets of paper into the paper path at the same time, leading to frequent paper jams near the input tray. An IT technician confirms that the paper being used meets manufacturer specifications, is stored in a low-humidity environment, and is properly fan-separated prior to loading. Which of the following components should the technician replace to resolve this multi-sheet feeding problem?

Cevabı ve açıklamayı göster

Cevap: Separation pad

Cevap

Separation pad
The separation pad works directly with the pickup roller to ensure only a single sheet of paper enters the printer path. Over time, the rubber surface on the separation pad wears down and loses friction, causing it to fail to restrain underlying sheets when the pickup roller rotates.

Adım Adım Çözüm

1
Analyze the reported symptom and paper feed mechanics.
Multiple sheets are being pulled simultaneously from the paper tray despite using proper, dry media.
This indicates a failure in the mechanical friction barrier that isolates the single top sheet during paper pulling.
2
Evaluate the function of paper tray feed components.
The pickup roller grabs the paper, while the separation pad (or separation roller) maintains friction on underlying sheets to ensure only one page enters the paper path.
When the surface of the separation pad wears down or gets smooth, friction decreases, allowing additional sheets to slide into the tray feed assembly together.
3
Select the correct replacement part.
Replacing the worn separation pad restores proper sheet separation.
New rubber padding provides the required coefficient of friction to hold back secondary pages.

Anahtar Kavram

Laser Printer Feed Assembly Mechanics
Soru 2434Soru

A system administrator is remotely troubleshooting a Windows 11 workstation where a custom line-of-business database process has frozen. The administrator opens an elevated Command Prompt and needs to identify the Process Identifier (PID) of the non-responsive executable (`dbengine.exe`) and then forcefully terminate it using that PID. Which of the following commands or command-line switches should the administrator execute to complete these tasks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: tasklist; taskkill /pid <PID> /f

Cevap

The administrator should run 'tasklist' to locate the process identifier (PID) and 'taskkill /pid <PID> /f' to forcefully terminate the process using its PID.
To view running processes and discover their assigned Process Identifiers (PIDs) in Windows Command Prompt, the 'tasklist' utility is used. Once the PID is identified, 'taskkill /pid <PID> /f' is used to forcefully terminate the process by targeting its PID with the /pid parameter and forcing termination with the /f parameter.

Adım Adım Çözüm

1
Identify the running process PID
Obtain the numerical PID associated with dbengine.exe
Executing 'tasklist' outputs active system processes alongside their assigned PIDs.
2
Force terminate the frozen process by PID
The unresponsive application process is closed forcefully
'taskkill /pid <PID> /f' specifies the target process by PID and applies the force flag (/f) to stop unresponsive applications.

Anahtar Kavram

Windows Process Management Utilities (tasklist and taskkill)
Soru 2435Soru

A system administrator is preparing to deploy a newly imaged standalone Windows workstation into a high-security corporate network environment. To ensure defense-in-depth and prevent exposure to network-borne threats during setup, the administrator must execute the workstation hardening baseline in a logical, secure sequence. What is the correct order of steps the administrator should take to secure the workstation from initial setup to final network placement?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for hardening the workstation is: First, change default administrative credentials and disable the local Guest account; second, connect to an isolated VLAN to install OS patches and security definitions; third, disable unneeded OS services, AutoPlay, and unused ports; fourth, configure local group policies for screen lock and lockout thresholds; fifth, enable the host-based firewall and connect to the production network.
The correct order follows established CompTIA security hardening guidelines: credentials and accounts are secured first to eliminate default access risks; OS updates and signatures are downloaded on an isolated VLAN next; unnecessary services, ports, and AutoPlay are disabled to minimize the attack surface third; local security policies (such as screen lock timeouts and account lockout controls) are enforced fourth; and host-based firewalls are activated immediately prior to joining the production network fifth.

Adım Adım Çözüm

1
Secure local identity and default access controls.
Default administrative credentials are changed, and the Guest account is verified disabled.
Initial access vector risks must be mitigated first so unauthorized users cannot log into the machine using vendor defaults.
2
Perform patch management on an isolated segment.
System OS patches and antimalware definitions are updated without exposing the unhardened system to production network threats.
An unpatched system exposed directly to the network can be compromised before security software is updated.
3
Perform attack surface reduction.
Unnecessary OS services, ports, and AutoPlay/AutoRun policies are disabled.
Disabling unneeded features reduces potential exploit vectors on the local system.
4
Enforce OS security policies.
Screen lock timeouts, account lockout controls, and password complexity rules are established.
Policy enforcement secures the operating system environment against local unauthorized physical access and brute-force attempts.
5
Activate network layer endpoint defenses and join production network.
Host-based firewall is enabled and system is moved to production network.
Activating host firewall controls before final network plug-in completes defense-in-depth isolation.

Anahtar Kavram

Workstation Hardening Sequence & Attack Surface Reduction
Soru 2436Soru

A desktop technician receives a suspicious executable file submitted by an end user for analysis. To examine the file's runtime behavior safely without exposing the workstation host operating system or local network to potential malware, the technician launches a temporary, isolated guest operating system on their workstation. Which client-side virtualization purpose is being demonstrated in this scenario?

Cevabı ve açıklamayı göster

Cevap: Security sandboxing

Cevap

Security sandboxing is the primary client-side virtualization use case for running untrusted code in an isolated guest environment to protect host resources.
Security sandboxing allows IT personnel to execute untrusted, potentially malicious code within a completely isolated virtual machine. Because the guest virtual machine operates independently of the host operating system, any damage or infection remains contained within the VM and can be discarded easily.

Adım Adım Çözüm

1
Analyze the scenario requirement
The technician needs to execute a potentially malicious file while isolating it from the host OS and corporate network.
Running unknown executables directly on a production OS risks malware infection and data compromise.
2
Match the requirement to client-side virtualization use cases
Creating an isolated environment to run untrusted software without affecting the host is defined as security sandboxing.
Virtual machines act as a sandbox, preventing changes within the guest OS from persistent impact on the underlying host system.

Anahtar Kavram

Client-Side Virtualization Purposes: Security Sandboxing
Soru 2437Soru

A tier-2 desktop technician at an educational publishing firm has completed scanning and successfully removed a persistent rootkit infection from an isolated Windows 11 workstation. The technician has also configured scheduled automated daily anti-malware scans and system updates. Which of the following steps should the technician perform NEXT in the standard CompTIA malware remediation workflow?

Cevabı ve açıklamayı göster

Cevap: Enable System Restore and create a new system restore point.

Cevap

Enable System Restore and create a new system restore point.
According to the official CompTIA 7-step malware remediation process, the steps are: 1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan/remove), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Since steps 1 through 5 have been completed, the technician must now enable System Restore and create a clean restore point.

Adım Adım Çözüm

1
Review the completed steps of the CompTIA 7-step malware remediation process
Identify that step 4 (Remediate infected systems) and step 5 (Schedule updates and integration of scans) have already been completed.
Following the strict sequence prevents re-infection or corrupted restore points.
2
Determine the next sequential step in the process
Step 6 is to re-enable System Restore and create a clean restore point.
System Restore was disabled during initial cleanup to prevent restored infections. Now that the system is verified clean and updates are scheduled, a fresh clean restore point can be established.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Soru 2438Soru

An IT support technician is performing administrative configuration tasks across several Windows client workstations in an enterprise environment. Match each administrative task on the left with its corresponding Windows Control Panel utility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Configuring Microsoft Outlook user profiles, email server accounts, and OST/PST data file locations outside of the Office desktop application.
Configuring automated, continuous backups of personal library files and desktop items to an attached external drive.
Subscribing a client workstation to published virtual applications and remote desktop collections hosted on an enterprise server.
Importing and assigning ICC/ICM display color profiles to specific monitors for color-critical graphic editing tasks.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings are: 1) Mail (32-bit) matches with configuring Outlook user profiles and data files; 2) File History matches with configuring automated local file backups; 3) RemoteApp and Desktop Connections matches with subscribing to published virtual applications; and 4) Color Management matches with assigning ICC/ICM display profiles.
Each task maps directly to its specialized Control Panel applet: Mail (32-bit) manages Microsoft Outlook profiles and data stores; File History configures backup schedules for personal user files; RemoteApp and Desktop Connections configures access to published RDS virtual resources; and Color Management handles ICC/ICM color profiles for display adapters and monitors.

Adım Adım Çözüm

1
Identify the utility required for managing Outlook accounts and data stores outside the application.
Match the Outlook profile management task to the Mail (32-bit) Control Panel utility.
The Mail applet provides direct access to Outlook profile settings and data files independently of launching the Microsoft Outlook app.
2
Identify the tool for setting up automated personal file backups to secondary storage.
Match the continuous local file backup task to File History.
File History routinely scans and saves incremental copies of user personal folder contents to an external drive or network destination.
3
Identify the utility used to access corporate virtual applications hosted on Remote Desktop Services.
Match the published virtual application task to RemoteApp and Desktop Connections.
RemoteApp and Desktop Connections sets up connection URLs to access remote desktops and published programs within the enterprise network.
4
Identify the utility used for configuring display monitor color profiles.
Match the ICC/ICM profile assignment task to Color Management.
Color Management controls system-wide color calibration and associates color profile files with graphic adapters and monitors.

Anahtar Kavram

Windows Control Panel Utilities
Soru 2439Soru

An IT support specialist is deploying a web-based employee onboarding portal for a domestic business enterprise. The application database collects and stores new hires' Social Security numbers, dates of birth, residential street addresses, and personal telephone numbers. Which of the following data classifications best applies to this collected dataset?

Cevabı ve açıklamayı göster

Cevap: Personally Identifiable Information (PII)

Cevap

Personally Identifiable Information (PII)
Social Security numbers, dates of birth, residential addresses, and personal phone numbers represent data that can be directly linked to a specific person's identity. Within IT operational procedures and data privacy standards, this aggregate information is categorized as Personally Identifiable Information (PII), requiring appropriate security controls to maintain confidentiality.

Adım Adım Çözüm

1
Analyze the data elements listed in the scenario.
Identified Social Security numbers, dates of birth, residential street addresses, and personal telephone numbers.
Determining the specific nature of the data is necessary to select the correct compliance classification.
2
Evaluate data privacy classifications against the identified dataset.
Data elements directly identify unique individuals in a general enterprise context.
Any direct identifiers that can uniquely trace a specific individual constitute Personally Identifiable Information (PII).
3
Match the dataset to the appropriate regulatory definition.
The dataset is classified as Personally Identifiable Information (PII).
PII requires specific administrative and technical protection controls under operational privacy procedures.

Anahtar Kavram

Data Classification and Compliance (PII vs PHI vs PCI-DSS vs FERPA)
Soru 2440Soru

A user installed an unverified device driver on a Windows 10 desktop. Upon restarting, the computer displays a stop error (blue screen) during startup and continuously reboots before reaching the sign-in screen. Which of the following is the BEST option for the technician to select in the Startup Settings menu to troubleshoot and remove the faulty driver?

Cevabı ve açıklamayı göster

Cevap: Enable Safe Mode

Cevap

Enabling Safe Mode allows the operating system to start with standard default drivers, bypassing the corrupted third-party driver so it can be uninstalled.
Booting into Safe Mode loads Windows with a minimal driver set. Because the third-party driver is not loaded during Safe Mode, the operating system can boot successfully, enabling the technician to access Device Manager and uninstall or roll back the corrupted driver.

Adım Adım Çözüm

1
Identify the cause of the startup crash
Recognize that a newly installed driver is causing Windows to crash during early boot driver initialization.
Third-party drivers loaded during normal boot can trigger kernel-mode stop errors if incompatible.
2
Select the appropriate recovery environment option
Boot into Safe Mode via Advanced Startup Options.
Safe Mode loads only core system files and basic drivers, keeping third-party device drivers disabled.
3
Remediate the driver issue
Access Device Manager or Programs and Features to uninstall or roll back the driver.
Removing the faulty driver restores the system to a clean boot state.

Anahtar Kavram

Safe Mode Boot Troubleshooting for Driver Conflicts
ÖncekiSayfa 122 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin