Examkin

Tüm alıştırma soruları

3551 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 2521Soru →

A technician is troubleshooting a Windows 11 desktop computer configured with UEFI firmware and a GPT partitioned system drive. Upon powering on, the workstation fails to boot into the operating system and presents a blue recovery screen displaying error code 0xc000000e, indicating that the boot selection failed because a required device is inaccessible or the Boot Configuration Data (BCD) entry is missing. The technician boots the system using Windows installation media and accesses the Windows Recovery Environment (WinRE) command prompt. Which of the following commands should the technician execute first to recreate the corrupted UEFI boot loader entries on the EFI System Partition?

Cevabı ve açıklamayı göster

Cevap: Execute bcdboot C:\Windows to regenerate the BCD store and copy core boot environment files to the EFI System Partition.

Cevap

Execute bcdboot C:\Windows to regenerate the BCD store and copy core boot environment files to the EFI System Partition.
On modern UEFI systems utilizing GPT disks, boot configuration files and winload.efi reside on the hidden FAT32 EFI System Partition (ESP). The error code 0xc000000e occurs when the Boot Configuration Data (BCD) points to an invalid partition identifier or when boot entries are missing. Executing the command 'bcdboot C:\Windows' copies core system boot files directly from the Windows OS directory to the ESP and regenerates a valid BCD configuration store, enabling the system to boot properly.

Adım Adım Çözüm

1
Identify system firmware and disk layout specifications.
The target system uses UEFI firmware and a GPT disk scheme, which relies on an EFI System Partition (ESP) containing winload.efi rather than a legacy MBR boot code area.
Boot recovery tools must match the underlying disk structure and firmware standard.
2
Analyze the error code symptom 0xc000000e.
Error code 0xc000000e signifies that the Windows Boot Manager cannot locate the required device object or BCD entry to initiate winload.efi.
Corrupted or missing BCD records on UEFI systems prevent successful operating system handoff during early startup.
3
Select the proper command-line tool for UEFI boot environment reconstruction.
Running bcdboot C:\Windows extracts boot environment files from the Windows image directory and writes new boot files to the EFI System Partition while rebuilding the BCD configuration.
bcdboot is the standard utility for initializing and repairing boot files on GPT/UEFI Windows systems.

Anahtar Kavram

UEFI/GPT Windows Boot Repair using BCDBoot
Soru 2522Soru →

A weather monitoring organization hosts an automated telemetry processing system in a public cloud platform. During unpredicted atmospheric anomalies, data transmissions from thousands of field sensors spike tenfold within seconds. The underlying cloud environment automatically expands virtual computing instances to process the incoming burst load and subsequently releases those resources back to the provider once traffic subsides to baseline levels, all without administrator interaction. Which cloud characteristic is directly demonstrated in this deployment?

Cevabı ve açıklamayı göster

Cevap: Rapid elasticity

Cevap

Rapid elasticity
Rapid elasticity is the cloud computing characteristic that enables systems to automatically provision and release computing resources dynamically in response to real-time workload changes. In this scenario, the immediate expansion during data spikes and subsequent contracting when traffic normalizes demonstrates rapid elasticity.

Adım Adım Çözüm

1
Analyze the operational requirements stated in the scenario
Identified that compute capacity automatically increases during unexpected peak loads and automatically decreases when demand drops without human intervention.
Determining whether resource adjustment is automated and dynamic isolates the core feature in question.
2
Compare the identified operational capability against essential cloud characteristics
Rapid elasticity is defined as the capability to seamlessly expand (scale out) and contract (scale in) infrastructure resources dynamically matching demand.
Differentiating automatic runtime scaling from manual self-service provisioning or background multi-tenant resource assignment ensures accurate classification.

Anahtar Kavram

Cloud Characteristics: Rapid Elasticity vs. On-Demand Self-Service vs. Resource Pooling
Soru 2523Soru →

A technician is preparing to replace a motherboard in a mid-tower workstation chassis. The upgrade requires maintaining physical compatibility with the existing computer case while supporting standard desktop power supply delivery and expansion requirements. Which TWO of the following motherboard specification details should the technician verify before purchasing the replacement board?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Standard ATX form factor dimensions (12×9.6 inches12 \times 9.6\text{ inches}) and mounting hole patterns compatible with the chassis standoffs; 24-pin main ATX power connector and 8-pin EPS12V auxiliary CPU power socket presence for power supply cable connectivity

Cevap

The technician must verify standard ATX form factor dimensions (12×9.6 inches12 \times 9.6\text{ inches}) with compatible mounting hole patterns and confirm the motherboard features both a 24-pin main ATX power connector and an 8-pin EPS12V auxiliary CPU power socket.
The standard ATX form factor uses a 12×9.6 inches12 \times 9.6\text{ inches} board layout with fixed standoff mounting locations that fit mid-tower chassis. Additionally, a desktop system requires both the primary 24-pin ATX power header for board logic and an 8-pin EPS12V connector for dedicated processor power delivery.

Adım Adım Çözüm

1
Evaluate chassis form factor and mounting requirements
Confirm standard ATX measurements (12×9.6 inches12 \times 9.6\text{ inches}) align with mid-tower case screw standoffs
Motherboards must physically fit inside the enclosure and align with predefined mounting standoffs to prevent short circuits.
2
Identify power connection standards required for full motherboard powering
Require a 24-pin main power connection and an 8-pin EPS12V CPU power connection
Modern desktop motherboards derive main system power via a 24-pin connector while utilizing an 8-pin EPS12V cable for processor voltage delivery.

Anahtar Kavram

Motherboard Form Factors and Power Connectors
Tahmini Süre:1m 30s
Soru 2524Soru →

An IT security administrator is auditing the endpoint security baseline for mobile devices and embedded systems across the organization. Match each security operational control on the left with its corresponding security implementation objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Storage Containerization
Remote Wipe
Geofencing
Firmware Hardening

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Storage Containerization matches isolating enterprise data on BYOD endpoints; Remote Wipe matches sending an over-the-air command to sanitize data on lost or stolen endpoints; Geofencing matches enforcing access policies based on physical GPS coordinates; Firmware Hardening matches disabling unneeded services and changing default credentials on IoT sensors.
Each security control targets a specific domain requirement: Storage Containerization segregates enterprise apps on personal endpoints; Remote Wipe remotely erases storage upon endpoint loss; Geofencing triggers location-based security policies; and Firmware Hardening reduces the attack surface on embedded IoT hardware.

Adım Adım Çözüm

1
Identify the purpose of Storage Containerization.
Selected the option describing logical isolation of business assets from personal data on BYOD endpoints.
Containerization creates a distinct partition on personal mobile devices so corporate data can be secured independently.
2
Identify the purpose of Remote Wipe.
Selected the option describing an over-the-air data sanitization command for lost or stolen hardware.
Remote wipe protects data confidentiality when physical control of an endpoint is compromised.
3
Identify the purpose of Geofencing.
Selected the option describing policy enforcement based on physical location/GPS boundaries.
Geofencing establishes virtual geographic perimeters to dynamically grant or restrict system functions.
4
Identify the purpose of Firmware Hardening.
Selected the option describing service minimization and credential updates on IoT hardware.
Hardening embedded systems mitigates risks associated with unpatched software and factory default settings.

Anahtar Kavram

Mobile and Embedded Security Controls
Soru 2525Soru →

A technician is troubleshooting a Windows 10 computer that experiences a Stop error during startup immediately after a third-party device driver update. The technician needs to start Windows using a minimal set of core drivers and services to safely roll back the problematic driver. Which option in the Windows Recovery Environment (WinRE) Advanced Options menu should the technician select to reach Safe Mode?

Cevabı ve açıklamayı göster

Cevap: Startup Settings

Cevap

Startup Settings
Selecting Startup Settings from the WinRE Advanced Options screen restarts the computer and presents a menu of boot configurations, allowing the technician to select Safe Mode to troubleshoot and remove the faulty driver.

Adım Adım Çözüm

1
Identify the troubleshooting requirement
The system requires booting into Safe Mode to prevent loading the faulty driver that causes the Stop error.
Safe Mode loads only essential Windows drivers and services, bypassing third-party drivers.
2
Select the appropriate WinRE tool
Choose Startup Settings under the WinRE Advanced options.
Startup Settings reboots the system to present boot option menus, including Safe Mode and Disable Driver Signature Enforcement.

Anahtar Kavram

Windows Recovery Environment (WinRE) Startup Settings
Tahmini Süre:45s
Soru 2526Soru →

A cloud administrator is preparing to migrate an enterprise on-premises file server to a cloud-based storage infrastructure. To ensure minimal disruption to business operations and adhere to organizational policy, the administrator must follow formal change management procedures. In what sequence should the administrator execute the following steps of the change management workflow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with defining the purpose and scope, followed by conducting a risk assessment, creating implementation and rollback plans, obtaining CAB approval, and finally executing the change with post-implementation testing and documentation.
Standard CompTIA A+ change management workflow requires establishing scope/purpose first, evaluating risk second, building implementation/rollback plans third, securing CAB authorization fourth, and completing execution, post-testing, and documentation fifth.

Adım Adım Çözüm

1
Define purpose and scope of the proposed change.
Establishes clear boundaries and technical requirements for the migration.
A documented scope is necessary to understand what is being changed and why.
2
Conduct a risk analysis.
Identifies risk levels, potential disruptions, and affected business units.
Evaluating risk helps determine the necessary safety precautions and rollback requirements.
3
Formulate implementation procedures and a rollback plan.
Produces the technical instructions and backout steps if deployment fails.
Change management guidelines require a complete rollback plan before seeking management approval.
4
Request authorization from the Change Advisory Board (CAB).
Obtains formal business and technical approval to proceed.
The CAB must review all risk analyses and backout strategies to approve the scheduled maintenance window.
5
Execute the change, test functionality, and update documentation.
Completes the migration, verifies normal operation, and updates system records.
Deployment occurs only after approval; post-testing ensures operational stability and complete configuration management tracking.

Anahtar Kavram

CompTIA Change Management Lifecycle
Soru 2527Soru →

A network administrator is deploying a high-security enterprise wireless network. To comply with corporate security policy, the authentication method must enforce mutual authentication by requiring and validating digital certificates on both the central RADIUS server and each connecting client device. Which of the following Extensible Authentication Protocol (EAP) framework types should the administrator configure?

Cevabı ve açıklamayı göster

Cevap: EAP-TLS

Cevap

EAP-TLS (Extensible Authentication Protocol-Transport Layer Security)
EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) is an 802.1X authentication protocol that mandates digital certificates on both the RADIUS authentication server and the endpoint client device, fulfilling the requirement for mutual certificate-based authentication.

Adım Adım Çözüm

1
Identify the authentication requirements stated in the scenario.
The enterprise policy demands mutual authentication using digital certificates on both the RADIUS server and the client device.
Different EAP protocols specify distinct certificate requirements for server and client endpoints.
2
Evaluate EAP standards against certificate requirements.
EAP-TLS is the standard EAP implementation that mandates X.509 digital certificates on both the server and client sides.
Protocols like PEAP and EAP-TTLS only mandate a server certificate and rely on passwords or inner tunnels for client authentication.

Anahtar Kavram

EAP-TLS requires client and server digital certificates for mutual authentication in 802.1X wireless enterprise networks.
Tahmini Süre:1m 0s
Soru 2528Soru →

A desktop technician observes multiple unexpected pop-up windows and heavy CPU utilization on a user's computer. After identifying the presence of malware, which of the following actions should the technician take prior to initiating the anti-malware scanning process? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disconnect the computer from the local network; Disable System Restore in Windows

Cevap

The technician should disconnect the computer from the local network to isolate it and disable System Restore in Windows before running anti-malware scans.
According to the CompTIA 7-step malware removal procedure, after identifying malware (Step 1), the technician must isolate the infected system (Step 2) and disable System Restore (Step 3) before updating anti-malware tools and scanning (Step 4). Disconnecting the network cable isolates the host, while disabling System Restore prevents infected files from being saved into system snapshots.

Adım Adım Çözüm

1
Identify malware symptoms on the system.
Malware presence is identified based on pop-ups and high CPU usage.
Establishes that the system requires remediation under the 7-step removal process.
2
Isolate the infected system by disconnecting network cables and turning off Wi-Fi.
Network communication is completely severed.
Prevents lateral movement of malware to other network resources and stops command-and-control communication.
3
Disable System Restore in Windows.
System restore point creation is suspended and previous infected restore points are removed.
Prevents malicious code from being preserved in Windows restore points during scanning and remediation.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure (System Isolation and Restore Management)
Soru 2529Soru →

A user reports that whenever Microsoft Edge is opened, the home page automatically redirects to an unfamiliar search engine, and unauthorized advertisement tabs open periodically. A desktop technician verifies that system host files and local network configurations are normal. Which of the following actions should the technician take to resolve this browser security issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Remove unauthorized or unrecognized browser extensions.; Reset the web browser to its default startup and search engine configurations.

Cevap

The technician should remove unauthorized browser extensions and reset the browser to its default startup and search engine configurations.
Removing unauthorized browser extensions and resetting the browser settings targets the active mechanisms used by browser hijackers. Rogue extensions often force redirects and generate pop-ups, while resetting preferences returns the search engine and startup pages to a known safe state.

Adım Adım Çözüm

1
Audit browser add-ons
Identify and remove malicious or unapproved extensions.
Extensions often possess permissions to alter browser search settings and launch background pop-up windows.
2
Restore default browser preferences
Reset search engine defaults, home page URLs, and startup tab configurations.
Browser hijackers persist by overwriting default search providers and startup behaviors.

Anahtar Kavram

Browser Hijacker Remediation
Soru 2530Soru →

A desktop computer shuts down unexpectedly after running heavy processor workload applications for several minutes. A technician suspects the CPU is overheating due to degraded thermal compound. In what order should the technician perform the following steps to properly service the CPU thermal interface and verify the resolution?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

Disconnect power and remove heatsink -> Clean off old thermal compound -> Apply small dot of new thermal paste -> Reinstall heatsink, connect fan, and verify temperatures in BIOS/UEFI.
The correct diagnostic and repair sequence begins with safely isolating power and removing the heatsink. Next, old compound is cleaned off with isopropyl alcohol so fresh thermal paste can be applied to a clean metal surface. Finally, the heatsink is remounted securely, the fan power cable is reconnected, and temperature levels are monitored in the BIOS/UEFI setup utility.

Adım Adım Çözüm

1
Disconnect workstation power and remove the CPU cooling heatsink assembly.
The CPU heat spreader surface and heatsink contact plate are exposed.
Ensures physical safety and permits direct access to the thermal interface.
2
Clean dried thermal compound using high-percentage isopropyl alcohol and a lint-free cloth.
Both contact surfaces are clean and free of old debris.
Old, dried thermal paste acts as an insulator rather than a conductor, preventing effective heat dissipation.
3
Dispense a small, pea-sized dot of fresh thermal paste onto the center of the CPU heat spreader.
Thermal paste is positioned to spread evenly under pressure.
Provides optimal thermal conductivity without overflowing onto motherboard components.
4
Reattach the heatsink evenly, plug in the CPU_FAN header, power on the system, and check CPU temperature hardware monitors in BIOS/UEFI.
The cooling fan receives power and processor operating temperatures are confirmed within normal ranges.
Validates that the cooling system is fully functional and thermal throttling/overheating is resolved.

Anahtar Kavram

CPU Cooling Maintenance and Thermal Interface Servicing
Tahmini Süre:1m 0s
Soru 2531Soru →

A technician is assisting a macOS user who wants to view all currently open application windows simultaneously and create separate virtual desktop workspaces to organize ongoing tasks. Which native macOS feature should the technician instruct the user to use?

Cevabı ve açıklamayı göster

Cevap: Mission Control

Cevap

Mission Control is the native macOS tool that displays all open windows and allows the creation of virtual desktops (Spaces).
Mission Control allows users to view all open windows, desktop spaces, and full-screen applications in a single view, enabling quick organization and creation of virtual desktops (Spaces).

Adım Adım Çözüm

1
Identify the user's operational requirements
The user needs to view all currently open windows simultaneously and organize tasks across virtual desktops.
Understanding the required OS workflow helps isolate the built-in feature designed for window and workspace management.
2
Evaluate native macOS utilities against the functional requirement
Mission Control offers full window overview and manages desktop Spaces.
Mission Control is specifically architected to provide bird's-eye views of open windows and support multi-desktop navigation.

Anahtar Kavram

macOS System Utilities & Navigation Features
Soru 2532Soru →

A remote worker reports that their workstation has developed unusual file associations and unauthorized system settings modifications. A technician confirms a malware infection and immediately disconnects the device from the network to isolate it. According to the CompTIA standard malware removal procedures, which action should the technician perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in the operating system

Cevap

Disable System Restore in the operating system
Disabling System Restore is Step 3 of the CompTIA 7-step malware removal procedure. Once an infected system is isolated (Step 2), System Restore must be turned off to clear existing restore points and prevent infected files from being backed up during cleanup.

Adım Adım Çözüm

1
Identify the current step in the CompTIA 7-step malware removal procedure
The technician has completed Step 1 (Identify symptoms) and Step 2 (Isolate infected system).
The scenario states that the malware was verified and the laptop was disconnected from all network interfaces.
2
Determine the next sequential step in the process
Step 3 is to disable System Restore in Windows.
System Restore must be disabled before remediation to prevent malware scripts from creating or embedding within saved restore points.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure Order
Tahmini Süre:1m 0s
Soru 2533Soru →

A tier-2 helpdesk technician is auditing cross-platform system maintenance scripts used across Windows and Linux endpoints. The technician needs to verify the syntax rules for variable declaration and environment variable usage in these scripts. Which of the following statements correctly describe variable handling in PowerShell (.ps1) and Bash shell (.sh) scripts? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: PowerShell scripts require a dollar sign prefix ()whendefininguservariablesandaccessingenvironmentvariables.;Bashshellscriptsassignvaluestovariableswithoutaleadingsymbol,butrequireadollarsign() when defining user variables and accessing environment variables.; Bash shell scripts assign values to variables without a leading symbol, but require a dollar sign () prefix to reference their contents.

Cevap

PowerShell scripts use a dollar sign prefix ()fordefiningvariablesandaccessingenvironmentvariables,andBashshellscriptsassignvariablevalueswithoutaleadingsymbolwhilerequiringadollarsign() for defining variables and accessing environment variables, and Bash shell scripts assign variable values without a leading symbol while requiring a dollar sign () to evaluate or reference them.
PowerShell requires a dollar sign ()prefixforvariableinstantiationandenvironmentvariableaccess(suchas) prefix for variable instantiation and environment variable access (such as env:Path). In contrast, Bash shell scripts assign values to variables without a prefix (e.g., VAR=value) and require the dollar sign ()onlywhenreferencingthevariable′svalue(e.g.,echo) only when referencing the variable's value (e.g., echo VAR).

Adım Adım Çözüm

1
Analyze PowerShell (.ps1) variable syntax rules
Confirm that PowerShell uses the dollar sign ()symbolforvariableinstantiationand) symbol for variable instantiation and env: for environment variable access.
PowerShell consistent syntax relies on the dollar sign ($) for variable scope and access.
2
Analyze Bash shell (.sh) variable syntax rules
Confirm that Bash assigns variables using key=value without a dollar sign ()ontheleftside,butrequiresadollarsign() on the left side, but requires a dollar sign () to read the value.
Adding a dollar sign ($) during Bash variable assignment causes a syntax error.
3
Evaluate distractor statements regarding batch (.bat) syntax
Identify that enclosing variables with percent signs (%VAR%) belongs to Windows Batch scripting, not PowerShell.
PowerShell does not use percent signs for environment variable expansion.

Anahtar Kavram

Variable Declaration and Syntax Rules in Scripting Languages
Tahmini Süre:1m 30s
Soru 2534Soru →

A desktop support technician is writing a Windows Batch script (`.bat`) to automate system profile configuration during user logon. The script must reference the currently logged-in user's account name dynamically from the system environment. Which of the following syntaxes correctly formats an environment variable within a Windows Batch script?

Cevabı ve açıklamayı göster

Cevap: %USERNAME%

Cevap

Enclosing the variable name between percent signs (%USERNAME%) is the correct construct for environment variables in Windows Batch scripts.
In Windows Batch (`.bat`) scripting, environment variables are referenced by surrounding the variable name with percent signs, such as %USERNAME%. When the batch file executes, the Command Prompt interpreter replaces the expression with the actual environment variable value.

Adım Adım Çözüm

1
Identify the target scripting language and objective from the scenario.
The target language is Windows Batch (`.bat`) and the goal is to reference a system environment variable.
Different scripting environments utilize specific syntax rules for variable declaration and retrieval.
2
Evaluate the syntax rule for environment variables in Windows Command Prompt / Batch.
Windows Batch environment variables are delimited using percent signs surrounding the variable name (e.g., %VARIABLE_NAME%).
The command processor recognizes percent signs as delimiters to replace the variable placeholder with its runtime value.

Anahtar Kavram

Windows Batch Environment Variable Syntax
Tahmini Süre:1m 0s
Soru 2535Soru →

A network technician deploys a new wireless access point configured to operate exclusively in WPA3-Personal mode. While modern company laptops connect successfully, several older Wi-Fi 4 (802.11n) handheld inventory scanners are unable to associate with the wireless network. The technician must allow these legacy handheld scanners to connect without forcing the modern laptops to downgrade their security protocol. Which of the following configuration changes should the technician make on the access point?

Cevabı ve açıklamayı göster

Cevap: Enable WPA2/WPA3 transition mode on the wireless access point.

Cevap

Enabling WPA2/WPA3 transition mode allows legacy WPA2 devices to connect using PSK while allowing supported modern devices to connect via WPA3 (SAE).
Enabling WPA2/WPA3 transition mode provides backward compatibility. It allows legacy clients that only support WPA2-PSK (AES) to connect to the SSID while allowing newer clients to authenticate using WPA3-Personal (SAE) with mandatory Protected Management Frames.

Adım Adım Çözüm

1
Analyze the connectivity issue.
Modern devices connect via WPA3-Personal, but legacy Wi-Fi 4 devices fail because they lack WPA3/SAE hardware or firmware support.
WPA3-Only mode strictly requires client support for SAE and mandatory Protected Management Frames (PMF).
2
Evaluate compatibility options that maintain security for modern clients.
WPA2/WPA3 Mixed or Transition Mode enables dual-SSID broadcasting capabilities under a single SSID, supporting WPA3-SAE for capable clients and falling back to WPA2-PSK for legacy devices.
This satisfies the requirement to support legacy scanners without forcing modern devices down to WPA2-only.

Anahtar Kavram

WPA3 Mixed/Transition Mode vs WPA3-Only Mode and Backward Compatibility
Soru 2536Soru →

A systems administrator at a financial services firm is troubleshooting a workstation infected with a spyware Trojan. The administrator has already identified the malware symptoms and successfully isolated the system from the local network. Which TWO of the following steps should the administrator perform next before initiating scans and removing the infection? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable Windows System Restore; Update anti-malware signature definition files

Cevap

The administrator should disable Windows System Restore and update anti-malware signature definition files.
Following quarantine, the technician must disable System Restore to ensure that infected system files are not backed up or preserved in system restore points. Immediately after, updating anti-malware signatures ensures that the security engine possesses the newest threat definitions before running full remediation scans.

Adım Adım Çözüm

1
Review current progress within the CompTIA 7-step malware remediation framework
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
Evaluating current status identifies which sequential actions must be taken prior to remediation.
2
Determine the mandatory actions prior to active system scanning and cleaning
Step 3 requires disabling System Restore, and Step 4a requires updating anti-malware software/signatures.
Disabling restore points prevents infected files from being saved in system restore archives, while updated signatures ensure accurate threat detection.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Soru 2537Soru →

A Windows workstation running an enterprise database client frequently becomes unresponsive ('Not Responding') during high-volume queries. A CompTIA A+ technician must isolate the process hang in real-time, preserve system diagnostics prior to process termination, and correlate the event with historical system stability data. Place the administrative troubleshooting steps in the correct chronological order from initial real-time isolation to historical root-cause analysis.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with using Analyze Wait Chain in Task Manager to isolate thread dependencies, followed by creating a memory dump file while the process is still active. Next, the technician terminates the blocking process to recover system responsiveness. Finally, the technician inspects Event Viewer (Event ID 1002) for module error details and reviews Reliability Monitor (perfmon /rel) to correlate the hang with historical software changes.
The proper sequence follows standard Windows performance troubleshooting methodology: real-time diagnosis (Analyze Wait Chain), diagnostic state preservation (Create Memory Dump), symptom remediation (Ending the Blocking Process), log-level examination (Event Viewer Event ID 1002), and long-term trend correlation (Reliability Monitor). Creating a memory dump must always occur before terminating the process, as process termination purges the target memory space.

Adım Adım Çözüm

1
Use Task Manager's Analyze Wait Chain feature on the hung application process.
Identifies whether the application is waiting on another process ID (PID) or thread to release a shared system resource.
Troubleshooting must start with real-time thread inspection to determine the immediate cause of the freeze.
2
Select 'Create memory dump file' from the process context menu in Task Manager.
Generates a .dmp file capturing the active volatile memory footprint of the hung application.
Process dump files must be created prior to terminating the process, as ending the process purges its active memory space.
3
Terminate the identified blocking PID or force-close the hung process.
Releases the resource lock and restores user responsiveness on the workstation.
Clearing the deadlock is necessary to recover workstation usability after diagnostic memory state has been saved.
4
Check Event Viewer under Windows Logs > Application for Event ID 1002.
Reveals logged specifics regarding the hung process, faulting module, and crash timestamps.
Post-remediation log analysis captures binary-level details recorded by the OS during the application hang.
5
Open Reliability Monitor using perfmon /rel.
Displays a chronological graph of application failures, hardware faults, and recent software installations.
Macro-level historical evaluation determines whether the hang is part of a broader pattern triggered by recent patches or updates.

Anahtar Kavram

Windows Application Crash & Hang Isolation Workflow
Tahmini Süre:2m 30s
Soru 2538Soru →

A technician is troubleshooting a UEFI-based Windows 11 computer that fails to boot, displaying a boot configuration error. After booting into the Windows Recovery Environment (WinRE) Command Prompt, the technician decides to manually recreate the corrupted EFI System Partition (ESP) structure and Boot Configuration Data (BCD). In what correct sequence should the technician execute the following repair steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for repairing the EFI boot environment in WinRE is: 1) Run diskpart to locate the hidden EFI System Partition volume number; 2) Assign a temporary drive letter to the EFI System Partition and exit diskpart; 3) Navigate to the EFI boot directory and execute attrib -h -r -s BCD to remove system attributes from the BCD file; 4) Rename the existing BCD file to BCD.old to preserve a backup; 5) Execute bcdboot C:\Windows /s Z: /f ALL to recreate the boot environment files.
To repair a corrupted UEFI boot setup, the hidden EFI System Partition must first be located and assigned a volume drive letter using diskpart. Once accessible, file protections on the existing BCD must be cleared with attrib so it can be renamed as a backup. Finally, bcdboot is executed targeting the assigned drive letter to write clean boot files and rebuild the BCD.

Adım Adım Çözüm

1
Open Diskpart utility to inspect disk partitions and volumes.
The hidden FAT32 system partition (ESP) volume index is identified.
You cannot access or target the ESP drive until its volume number is found.
2
Select the ESP volume and assign a drive letter (e.g., Z:), then exit Diskpart.
The ESP volume becomes accessible via the Z: drive path.
Command-line tools like attrib and ren require an accessible drive letter path.
3
Change directory to Z:\EFI\Microsoft\Boot\ and run attrib -h -r -s BCD.
The file attributes locking the BCD store are cleared.
System files cannot be modified or renamed while marked as read-only, hidden, or system files.
4
Rename the BCD file using ren BCD BCD.old.
The corrupted BCD file is renamed and no longer active.
Renaming the file prevents collision errors when generating fresh BCD files.
5
Run bcdboot C:\Windows /s Z: /f ALL.
Fresh EFI system files and a new BCD store are written to the ESP partition.
bcdboot copies system boot files from the Windows directory to the target boot partition.

Anahtar Kavram

UEFI EFI System Partition (ESP) and BCD manual repair procedure using WinRE Command Line Tools
Tahmini Süre:2m 0s
Soru 2539Soru →

An IT support technician is hardening security on a company workstation running Windows 11 Pro. To mitigate the risk of ransomware, the technician needs to configure a setting that prevents untrusted applications from modifying files stored in standard user folders such as Documents, Pictures, and Desktop. Which feature within the Windows Security app should the technician enable to fulfill this requirement?

Cevabı ve açıklamayı göster

Cevap: Controlled folder access

Cevap

Controlled folder access is the Windows Security feature designed to block unauthorized or untrusted applications from modifying files in protected user directories.
Controlled folder access is a feature within Windows Security under Virus & threat protection designed to protect key folders (Documents, Pictures, Desktop, etc.) from unauthorized modifications by untrusted software, effectively mitigating ransomware threats.

Adım Adım Çözüm

1
Identify the primary administrative security requirement.
The requirement is to prevent unauthorized applications (such as ransomware) from modifying or encrypting files in user data folders.
Ransomware targets user directories to encrypt personal files and demand payment for recovery.
2
Evaluate Windows Security app features against the security requirement.
Controlled folder access in Windows Security explicitly protects specified user directories by allowing only whitelisted or trusted applications to make file changes.
It acts as a directory-level shield against unauthorized modifications.

Anahtar Kavram

Windows Security Ransomware Protection Settings
Tahmini Süre:1m 0s
Soru 2540Soru →

A security administrator is deploying mobile tablets to field service technicians who collect sensitive customer account details. The organization allows technicians to use these corporate-enrolled tablets for personal tasks during off-hours. To comply with data privacy regulations, corporate data must be completely encrypted and isolated from personal applications, and administrators must be able to remove company records if a device is lost without destroying personal photos or files. Which of the following mobile security controls should the administrator implement to meet both requirements?

Cevabı ve açıklamayı göster

Cevap: Containerization with selective wipe functionality

Cevap

Containerization with selective wipe functionality is the correct control because it logically separates corporate applications and confidential records from personal data on mobile devices, allowing administrators to remove enterprise storage without affecting personal user content.
Containerization establishes a secure, encrypted logical partition for enterprise applications and corporate customer data on mobile devices. Paired with selective wipe management through Mobile Device Management (MDM) or Mobile Application Management (MAM) solutions, IT administrators can remotely sanitize corporate records upon device loss while leaving personal photos, apps, and files intact.

Adım Adım Çözüm

1
Analyze the technical requirements of the scenario.
Identified two primary requirements: isolation of corporate data from personal applications, and the ability to wipe corporate files without erasing personal user data.
Security controls on mobile devices must balance enterprise protection with user privacy in mixed-use scenarios.
2
Evaluate storage separation technologies.
Containerization (storage segmentation) creates a secure, encrypted sandbox for corporate apps and data on the mobile OS.
Logical boundary enforcement prevents unapproved personal applications from accessing sensitive company records.
3
Match the remote management capability to the required wipe policy.
Selective wipe targets only the enterprise container, fulfilling the remote removal requirement while preserving personal photos and personal application data.
Full device wipes destroy all storage partitions indiscriminately, failing the privacy requirement.

Anahtar Kavram

Mobile Device Containerization and Selective Wipe
ÖncekiSayfa 127 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin