Tüm alıştırma soruları

3551 soru

Soru 2581Soru

An enterprise administrator notices that a workstation's web browser consistently routes requests for common financial portals to an unverified third-party IP address, causing invalid SSL certificate warnings. System scans confirm no malicious browser extensions or add-ons are installed. Which of the following configuration files or settings should the technician inspect FIRST to resolve this redirection issue?

Cevabı ve açıklamayı göster

Cevap: The local hosts file located in %systemroot%\system32\drivers\etc to check for unauthorized static IP mappings

Cevap

The local hosts file located in %systemroot%\system32\drivers\etc to check for unauthorized static IP mappings
Inspecting the local hosts file (%systemroot%\system32\drivers\etc\hosts) is the correct first action. When web browsers redirect traffic to IP addresses that trigger certificate errors without any rogue extensions present, the local hosts file has likely been altered by malware to override standard DNS lookups for specific URLs.

Adım Adım Çözüm

1
Analyze the symptoms described in the scenario
Identified persistent domain redirection and SSL certificate warnings without any unauthorized browser extensions present.
This indicates that DNS resolution or path routing has been modified at the OS level.
2
Check system-level name resolution configurations
The Windows hosts file (%systemroot%\system32\drivers\etc\hosts) takes precedence over standard DNS queries for domain name resolution.
Malware frequently inserts static entries into the hosts file to divert traffic from legitimate websites to malicious servers.
3
Select the correct immediate troubleshooting action
Inspecting and restoring the hosts file will remove rogue static domain mappings and stop unauthorized site redirection.
This directly resolves the root cause of the network redirection.

Anahtar Kavram

Browser Security and Hosts File Redirection Remediation
Soru 2582Soru

A system administrator manages a mixed environment of macOS workstations and Linux servers. Match each native operating system tool or command on the left with its primary administrative purpose on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

dd
chmod
Time Machine
Spotlight

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

dd matches block-level data copying; chmod matches altering file access permissions; Time Machine matches native macOS automated incremental backups; Spotlight matches native macOS indexing utility.
Each tool is accurately matched to its intended administrative function: dd is used for low-level block copying, chmod manages permission bits, Time Machine handles automated macOS backups, and Spotlight performs index searching across macOS.

Adım Adım Çözüm

1
Identify the function of the Linux/macOS CLI tool dd.
dd is a low-level utility used for raw block-level drive cloning and disk image creation.
It reads and writes raw data blocks directly across storage devices or files.
2
Identify the function of the command-line utility chmod.
chmod is used to modify mode/permission bits (read, write, execute) on files and directories.
Security administration relies on chmod for restricting or granting file access privileges.
3
Identify the function of the macOS GUI tool Time Machine.
Time Machine provides continuous, automated incremental backups for macOS.
It allows system recovery to specific historical snapshots.
4
Identify the function of the macOS tool Spotlight.
Spotlight creates a indexed database of files, metadata, and application shortcuts for fast searching.
It is the main search tool built into the macOS desktop.

Anahtar Kavram

Distinguishing core administrative CLI commands and native OS features in macOS and Linux environments.
Soru 2583Soru

A desktop administrator at a commercial airline flight operations center is troubleshooting a Windows 11 workstation infected with a persistent Trojan. The administrator has already verified the malware symptoms, isolated the workstation from the network to quarantine it, disabled System Restore, and updated the anti-malware signature definitions. Which of the following should the administrator perform NEXT according to standard CompTIA malware remediation procedures?

Cevabı ve açıklamayı göster

Cevap: Perform a full system scan using anti-malware software to locate and remove the infection.

Cevap

Perform a full system scan using anti-malware software to locate and remove the infection.
The CompTIA 7-step malware remediation procedure follows a strict sequence: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (a. Update signature files, b. Scan and use removal techniques), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the user. Since the technician has already updated the signature definitions (Step 4a), the next required action is executing the anti-malware scan to remove the threat (Step 4b).

Adım Adım Çözüm

1
Review the completed steps in the CompTIA 7-step malware remediation process.
Completed: Step 1 (Identify), Step 2 (Quarantine), Step 3 (Disable System Restore), and Step 4a (Update anti-malware signatures).
Tracking progress ensures remediation follows proper sequence without missing key safety measures.
2
Determine the required sub-step for completing remediation (Step 4b).
The technician must execute a full anti-malware scan (in Safe Mode if necessary) to quarantine and remove malicious files.
Updated definitions are ineffective until an active scan is triggered to locate and neutralize the threat.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Tahmini Süre:1m 15s
Soru 2584Soru

A systems administrator is configuring Mobile Device Management (MDM) security controls across an enterprise fleet of smartphones and tablets. Match each mobile device security control on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Containerization
Geofencing
Selective Wipe
Full Device Encryption (FDE)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Containerization pairs with isolating enterprise applications and sensitive data from personal data. Geofencing pairs with triggering security restrictions based on the physical location of the endpoint. Selective Wipe pairs with erasing corporate profile data without impacting personal files. Full Device Encryption pairs with protecting stored data at rest across system storage.
The paired definitions accurately describe the key technical operational capabilities of MDM security mechanisms: Containerization isolates corporate environments on personal devices; Geofencing enforces policy dynamically based on location coordinates; Selective Wipe target-deletes corporate data only; and Full Device Encryption protects all underlying data at rest.

Adım Adım Çözüm

1
Analyze Containerization requirements.
Identified as logical isolation between work and personal data structures on a single endpoint.
Containerization enforces BYOD privacy and compliance by creating a dedicated encrypted sandbox.
2
Analyze Geofencing features.
Identified as location-based policy enforcement.
Geofencing leverages spatial coordinates (GPS/Wi-Fi) to restrict capabilities dynamically based on physical presence.
3
Analyze Selective Wipe vs Full Wipe.
Identified as enterprise-only data removal.
Selective wipe targets managed profiles specifically, preserving non-corporate user assets.
4
Analyze Full Device Encryption (FDE).
Identified as full volume data-at-rest protection.
FDE encrypts the whole storage partition, preventing unauthorized offline data access.

Anahtar Kavram

Mobile Device Management (MDM) Controls and Security Measures
Soru 2585Soru

An enterprise financial auditing firm utilizes a public cloud platform where multiple corporate clients execute their analytical workloads on shared physical hardware. The cloud provider dynamically allocates and reallocates physical compute cores, memory, and storage arrays among tenants based on real-time consumption, while preventing individual tenants from determining or controlling the exact physical location of the underlying hardware. Which cloud characteristic is best illustrated by this deployment configuration?

Cevabı ve açıklamayı göster

Cevap: Resource pooling

Cevap

Resource pooling
The scenario describes resource pooling, an essential cloud characteristic where a provider's computing resources are pooled to serve multiple consumers using a multi-tenant model. Physical and virtual resources are dynamically assigned and reassigned according to demand, with location independence for the consumer.

Adım Adım Çözüm

1
Analyze the operational scenario presented in the stem.
The scenario describes a multi-tenant cloud environment where physical hardware resources (CPU, RAM, storage) are dynamically assigned to multiple customers from a shared pool without tenant visibility into physical hardware locations.
Identifying the defining features of the cloud environment is essential for selecting the corresponding NIST cloud characteristic.
2
Evaluate the identified features against essential cloud characteristics.
Multi-tenancy combined with dynamic assignment and reassignment of shared physical resources directly matches the definition of resource pooling.
Resource pooling specifically enables providers to aggregate physical resources to serve multiple consumers efficiently.

Anahtar Kavram

Cloud Characteristics: Resource Pooling
Soru 2586Soru

An IT support specialist is working on a compromised Windows point-of-sale workstation. Before running anti-malware remediation tools to clean the system, which TWO of the following pre-scan procedures must be completed according to the standard CompTIA malware removal steps?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Isolate the system from the network by disconnecting wired and wireless network connections; Disable System Restore in the operating system

Cevap

The correct pre-scan procedures are isolating the system from the network and disabling System Restore.
According to the CompTIA 7-step malware removal methodology, after identifying symptoms, the technician must isolate the infected system by disconnecting network links to halt potential malware spread and command-and-control communication. Following isolation, the technician must disable System Restore to delete infected restore points before running remediation tools.

Adım Adım Çözüm

1
Identify the proper sequence of pre-remediation steps in the standard CompTIA 7-step malware removal process.
The initial steps in order are: 1. Identify symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems.
Isolation and disabling System Restore must occur before any scanning or cleaning phase begins.
2
Select the actions that correspond to isolating the computer and handling restore points.
Disconnecting network cables/Wi-Fi isolates the machine, while disabling System Restore clears infected shadow copies.
Scanning an unisolated machine risks network propagation, and leaving System Restore active risks reinfection from backed-up shadow copies.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure - Isolation and System Restore Management
Soru 2587Soru

A systems specialist is preparing a batch of Windows 11 desktop computers designated for a corporate financial analysis unit handling restricted client data. The goal is to reduce the attack surface and prevent unauthorized physical or administrative access. Which of the following steps should the specialist execute to properly harden these workstations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and rename the local Administrator account.; Configure a mandatory screen saver lock policy requiring password authentication upon resume.

Cevap

The specialist should disable the built-in Guest account while renaming the local Administrator account, and configure a mandatory screen saver lock policy requiring password authentication upon resume.
Hardening workstations involves eliminating unnecessary account vectors (such as disabling the Guest account and renaming the default Administrator account) and mitigating physical exposure through unattended session controls (such as screen saver locks requiring password authentication).

Adım Adım Çözüm

1
Identify default account vulnerabilities and account hardening controls.
Disabling the Guest account and renaming the default Administrator account reduces vector exposure to automated brute-force attacks.
Standard account names are well-known targets for malicious actors.
2
Identify session security and idle timeout requirements.
Configuring a screen saver lock secures unattended workstations against unauthorized physical interaction.
Workstations left unattended present an immediate security risk if session lock policies are not active.

Anahtar Kavram

Workstation Hardening and Attack Surface Reduction
Soru 2588Soru

A technician is troubleshooting a desktop computer that displays no power LEDs and produces no fan rotation when the power button is pressed. Arrange the troubleshooting steps below in the correct order, from the initial basic physical checks to final component replacement.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Verify wall outlet power and the PSU rear rocker switch, 2) Inspect and reseat the 24-pin ATX and 8-pin CPU power connectors on the motherboard, 3) Disconnect internal power cables and test PSU output rail voltages using a PSU tester, and 4) Replace the motherboard after confirming normal PSU voltage output.
Following standard troubleshooting methodology, a technician must always start with the simplest, least invasive external checks (verifying AC outlet power and the rear PSU switch), then progress to internal cable seating, followed by diagnostic testing of the power supply using a tester, and finally replacing the motherboard once the PSU has been verified functional.

Adım Adım Çözüm

1
Perform initial external power verification.
Ensures the system is receiving AC power from the wall and the PSU power switch is enabled.
CompTIA troubleshooting methodology requires starting with simple, non-invasive external checks first.
2
Inspect internal power connections.
Confirms that power from the PSU can flow to the motherboard and processor.
Loose motherboard power connectors can mimic a dead power supply or motherboard failure.
3
Test PSU voltage rails directly.
Determines whether the PSU is providing proper +12V, +5V, and +3.3V DC power.
Isolating the power supply pinpoints whether the power delivery unit is defective before replacing core motherboard components.
4
Replace the motherboard.
Restores system operation when a known-good PSU produces no power response from the motherboard.
Once the PSU is confirmed fully functional, a total lack of power response indicates a faulty motherboard.

Anahtar Kavram

CompTIA hardware troubleshooting methodology for complete power failure scenarios.
Tahmini Süre:1m 0s
Soru 2589Soru

A helpdesk technician at an architectural design studio is remediating a Windows 11 rendering workstation infected with persistent adware and unauthorized browser extensions. The technician has isolated the system from the network, disabled System Restore, updated the anti-malware signatures, and successfully removed all malicious files during a scan in Safe Mode. Which of the following procedures should the technician perform NEXT to follow the standard CompTIA 7-step malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Schedule automatic anti-malware updates and recurring system scans.

Cevap

The technician should schedule automatic anti-malware updates and recurring system scans.
The standard CompTIA 7-step malware remediation workflow proceeds as follows: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan/remove), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the technician has just finished Step 4 (updating signatures and removing threat files in Safe Mode), the mandatory next step is Step 5: scheduling automatic updates and recurring scans.

Adım Adım Çözüm

1
Identify the completed steps in the CompTIA 7-step malware remediation process.
The technician has completed Step 1 (Identify symptoms), Step 2 (Quarantine system), Step 3 (Disable System Restore), and Step 4 (Remediate system by updating definitions and scanning/removing malware).
Determining the current phase of remediation establishes where the technician is in the mandatory protocol.
2
Determine the next sequential step following Step 4 (Remediate infected systems).
Step 5 in the CompTIA 7-step process is 'Schedule updates and run scans'.
Automating recurring scans and updates ensures ongoing protection against recurring threats before restoring operational features like System Restore.
3
Select the option matching Step 5.
Scheduling automatic anti-malware updates and recurring scans directly corresponds to Step 5.
This action adheres to the strict sequence established by CompTIA security standards.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process Sequence
Tahmini Süre:1m 15s
Soru 2590Soru

A systems administrator is configuring Windows local group security baseline controls across newly deployed workstations. Match each workstation hardening policy control on the left to its corresponding primary risk mitigation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Account Lockout Threshold Policy
Disabling Unused Network Ports and Services
Screen Lock Timeout with Re-authentication
Disabling AutoPlay and AutoRun features

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Account Lockout Threshold Policy matches automated brute-force mitigation; Disabling Unused Network Ports and Services matches attack surface reduction of network channels; Screen Lock Timeout matches prevention of unattended physical access; Disabling AutoPlay/AutoRun matches prevention of automatic executable launching from removable storage.
Each workstation hardening policy directly addresses a distinct attack vector: account lockout limits online password cracking, service/port disabling removes latent attack surface, screen locking secures unattended physical hardware, and disabling AutoPlay blocks weaponized removable media.

Adım Adım Çözüm

1
Analyze each security hardening baseline control
Identified four standard CompTIA A+ Security domain workstation hardening techniques.
Security baseline hardening controls target specific threat vectors across physical, network, system, and media domains.
2
Correlate each control to its primary risk reduction mechanism
Account lockout protects credentials, service disabling protects listening endpoints, screen timeout protects physical sessions, and AutoPlay disabling protects against malicious media execution.
Proper matching requires understanding defense-in-depth principles for local OS configuration.

Anahtar Kavram

Workstation Hardening & Risk Mitigation Alignment
Soru 2591Soru

An IT specialist is preparing a host server to run guest virtual machines (VMs) for software QA testing. The physical computer contains 56 GB56\text{ GB} of installed system RAM. The host operating system requires 5 GB5\text{ GB} of RAM, and the Type 2 hypervisor application requires an additional 3 GB3\text{ GB} of dedicated host RAM overhead. If each guest VM requires 6 GB6\text{ GB} of RAM for optimal performance, what is the maximum number of guest VMs that can run concurrently without overcommitting physical host memory?

Cevabı ve açıklamayı göster

Cevap: 8 virtual machines

Cevap

8 virtual machines can run concurrently without overcommitting memory.
To determine the maximum number of virtual machines without overcommitting RAM, first subtract the combined host operating system requirement (5 GB5\text{ GB}) and hypervisor overhead (3 GB3\text{ GB}) from total physical RAM (56 GB8 GB=48 GB56\text{ GB} - 8\text{ GB} = 48\text{ GB}). Then, divide the remaining available memory by the per-VM requirement (48 GB/6 GB=848\text{ GB} / 6\text{ GB} = 8). Therefore, 8 virtual machines can run concurrently.

Adım Adım Çözüm

1
Calculate the total host RAM reservation.
5 GB (Host OS)+3 GB (Hypervisor)=8 GB5\text{ GB} \text{ (Host OS)} + 3\text{ GB} \text{ (Hypervisor)} = 8\text{ GB} total host RAM reserved.
The host OS and hypervisor require dedicated memory to maintain system stability and host management functions.
2
Calculate RAM available for guest virtual machines.
56 GB (Total physical RAM)8 GB (Host reserved)=48 GB56\text{ GB} \text{ (Total physical RAM)} - 8\text{ GB} \text{ (Host reserved)} = 48\text{ GB} available.
Subtracting host overhead prevents physical memory overcommitment and disk thrashing.
3
Determine maximum guest virtual machines supported.
48 GB/6 GB=848\text{ GB} / 6\text{ GB} = 8 virtual machines.
Dividing the remaining usable RAM by the per-VM requirement yields the maximum concurrent VM capacity.

Anahtar Kavram

Virtual Machine Host Memory Allocation and Overhead Planning
Soru 2592Soru

A technician is troubleshooting a custom line-of-business application that has stopped responding on a Windows 11 workstation. The application window is frozen, and CPU utilization remains high. Place the troubleshooting and isolation steps in the correct chronological sequence that a technician should follow to diagnose, capture diagnostic evidence, recover system responsiveness, and identify the root cause module.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Analyze the wait chain in Resource Monitor to check for thread contention, 2) Create a memory dump file in Task Manager to preserve volatile memory, 3) End the task in Task Manager to terminate the frozen process, and 4) Inspect Event Viewer Application logs for Event ID 1000 or 1002 faulting module information.
The correct troubleshooting workflow prioritizes live non-destructive diagnosis and memory state preservation prior to process termination. First, Analyze Wait Chain in Resource Monitor inspects real-time thread dependencies. Second, creating a memory dump in Task Manager preserves volatile RAM data for debugging. Third, End Task clears the hung application from system resources. Fourth, Event Viewer Application logs (Event ID 1000/1002) are examined to identify the faulting DLL or binary.

Adım Adım Çözüm

1
Use Resource Monitor to Analyze Wait Chain on the target process.
Determines whether the application is waiting on another locked thread or system process.
Troubleshooting active application hangs starts with non-destructive live diagnostics.
2
Create a process memory dump file through Task Manager.
Generates a snapshot file containing process memory details for developer debugging.
Dumping memory must occur before process termination, as ending the task destroys volatile RAM state.
3
Terminate the unresponsive application using End Task in Task Manager.
Frees up CPU and system memory resources locked by the hung application.
After capturing diagnostic data, clearing the hung process restores user productivity.
4
Examine Event Viewer logs under Windows Logs > Application.
Provides logged crash/hang details, including the faulting module path and exception codes.
System logs document the specific component fault for root-cause resolution.

Anahtar Kavram

Methodical sequence for isolating hung Windows applications while preserving diagnostic evidence.
Soru 2593Soru

A user reports that an enterprise database reporting tool on a Windows 11 workstation consistently crashes upon opening specific reporting modules. What is the correct sequence of troubleshooting steps a technician should follow to identify the faulting component and remediate system dependency corruption using Windows administrative tools?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with reviewing Event Viewer Application logs for Event ID 1000 crash details, running System File Checker (sfc /scannow) to repair system files, executing DISM /Online /Cleanup-Image /RestoreHealth if the component store is damaged, and finally re-running sfc /scannow to complete file restoration.
The proper troubleshooting process begins by examining Event Viewer Application logs for Event ID 1000 details to verify if a system module caused the crash. The technician then runs System File Checker (sfc /scannowsfc\ /scannow) to repair damaged files. If SFC encounters corrupted files it cannot fix due to store corruption, DISM (dism /online /cleanupimage /restorehealthdism\ /online\ /cleanup-image\ /restorehealth) must be executed to repair the Windows component store. Finally, executing sfc /scannowsfc\ /scannow a second time applies the repairs using the restored component store.

Adım Adım Çözüm

1
Review diagnostic logs in Event Viewer
Locate Event ID 1000 entry containing the faulting application name, faulting module path, and crash offset.
Gathers empirical diagnostic evidence to determine if system file corruption is the underlying cause of the crash.
2
Run initial System File Checker scan
Detect corrupt protected system files, but encounter errors if the local component store is compromised.
SFC verifies system file integrity against the local Windows component store.
3
Execute DISM image restoration command
Fetch clean payload binaries from Windows Update or local media to repair the Component Store (WinSxS).
DISM repairs the component store payload when SFC cannot restore files due to local cache corruption.
4
Re-run System File Checker scan
Successfully repair and replace corrupted operating system files using the refreshed component store.
Completes system binary remediation using the newly validated store payload.

Anahtar Kavram

Troubleshooting Application Crashes and Windows System File Repair Sequence
Soru 2594Soru

A technician is troubleshooting a Windows 11 workstation that displays a Stop Code screen with INACCESSIBLE_BOOT_DEVICE during startup immediately after a motherboard firmware update reset the UEFI/BIOS setup to factory defaults. The technician verifies that the NVMe solid-state drive is physically detected in the UEFI setup utility. Which of the following actions should the technician take first to resolve this boot error?

Cevabı ve açıklamayı göster

Cevap: Reconfigure the storage controller mode (AHCI vs. RAID/NVMe) in the UEFI settings to match the original OS configuration.

Cevap

Reconfigure the storage controller mode (AHCI vs. RAID/NVMe) in the UEFI settings to match the original OS configuration.
The correct option addresses the root cause of the error. When UEFI firmware settings are reset to defaults, storage controller modes (such as Intel VMD/RAID vs. Standard AHCI) often revert. If the Windows storage stack driver expects RAID/VMD mode but the controller is operating in AHCI mode (or vice versa), Windows cannot initialize the boot device driver and fails with the Stop Code INACCESSIBLE_BOOT_DEVICE. Reverting the controller mode in UEFI resolves the mismatch.

Adım Adım Çözüm

1
Analyze the boot error symptom and recent change history.
The error INACCESSIBLE_BOOT_DEVICE occurred right after a UEFI firmware update reset settings to default values.
Firmware resets frequently revert storage controller settings (AHCI/RAID/VMD) to factory defaults, which prevents the Windows kernel boot driver from interfacing with the storage drive properly.
2
Identify the non-destructive, configuration-level resolution.
Entering UEFI settings and toggling the storage controller mode restores the hardware state expected by the installed Windows storage driver.
Matching the controller mode to the pre-reset state immediately allows Windows to locate and mount the boot partition without requiring OS repairs or partition modifications.

Anahtar Kavram

Troubleshooting Windows UEFI storage controller mode mismatches causing INACCESSIBLE_BOOT_DEVICE Stop errors.
Tahmini Süre:2m 0s
Soru 2595Soru

A desktop technician at a municipal water treatment facility is remediating a Windows 11 workstation used for SCADA oversight that has been infected with persistent adware and unauthorized browser redirects. The technician has already verified the malware symptoms and quarantined the computer from the network. According to the standard CompTIA 7-step malware remediation workflow, which TWO of the following actions should the technician perform NEXT prior to running a full anti-malware scan?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows configuration settings.; Update the anti-malware signature definitions and scanning engine.

Cevap

The technician should disable System Restore in Windows settings and update the anti-malware signature definitions.
Following quarantine (Step 2), the technician must proceed sequentially to Step 3 (Disable System Restore) and Step 4a (Update anti-malware definitions). Disabling restore points ensures malware cannot hide within volume shadow copies, and updating definitions ensures the anti-malware engine can recognize the specific adware and browser hijacking components during the subsequent scan.

Adım Adım Çözüm

1
Identify current progress in the CompTIA 7-step malware remediation procedure.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine infected systems) have already been completed.
Determining the current phase establishes what immediate remediation actions are required.
2
Select Step 3 of the malware remediation procedure.
System Restore must be disabled.
Disabling System Restore prevents clean restore points from being contaminated and prevents infected restore points from reinfecting the system.
3
Select Step 4a of the remediation process before running the scan.
Update the anti-malware software and definition files.
Up-to-date signature files ensure maximum threat detection coverage during the subsequent full system scan (Step 4b).

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Tahmini Süre:1m 30s
Soru 2596Soru

A Windows 11 workstation performing large data transformations experiences sudden application crashes without generating an error prompt on screen. A technician inspects Event Viewer and observes Event ID 1000 (Application Error) with exception code 0xc0000005 in the Application log. Monitoring system metrics reveals that prior to the crash, the Commit Charge reached 99% of the Commit Limit, and Resource Monitor reported a high frequency of Hard Faults/sec across background processes. Physical RAM utilization remained at 85%. Which of the following is the most appropriate action to resolve the root cause of these application crashes?

Cevabı ve açıklamayı göster

Cevap: Reconfigure the system virtual memory settings to ensure the paging file is enabled and configured for system-managed size on the system drive.

Cevap

Reconfigure the system virtual memory settings to ensure the paging file is enabled and configured for system-managed size on the system drive.
The correct option addresses the root cause of the crash. Commit Charge represents the total amount of virtual memory allocated by all running processes. When Commit Charge reaches the Commit Limit (RAM plus pagefile size), Windows fails further memory allocation requests, causing applications to terminate unexpectedly with access violation errors (code 0xc0000005). Enabling a system-managed paging file ensures the Commit Limit automatically expands to satisfy high memory allocation demands during intensive processing.

Adım Adım Çözüm

1
Analyze diagnostic indicators from Event Viewer and Resource Monitor metrics.
Event ID 1000 with exception code 0xc0000005 indicates a memory access violation. Commit Charge hitting 99% of Commit Limit alongside high Hard Faults/sec indicates virtual memory (paging file) exhaustion.
Commit Charge represents total virtual memory allocated by all active processes, while Commit Limit is physical RAM plus maximum pagefile size.
2
Evaluate potential underlying causes for Commit Limit exhaustion.
The paging file is either disabled, set to a custom fixed size that is too small, or located on a disk lacking sufficient free space.
If Commit Charge reaches the Commit Limit, Windows refuses memory allocation requests, causing applications to abruptly crash with access violation exceptions.
3
Identify the remediation step that restores virtual memory expandability.
Configuring a system-managed paging file on the main system drive allows Windows to dynamically expand virtual memory allocation as workload demand spikes.
System-managed paging files adaptively grow to accommodate high Commit Charge requirements, preventing 0xc0000005 allocation crashes.

Anahtar Kavram

Windows Virtual Memory and Paging File Exhaustion Diagnosis
Soru 2597Soru

A network technician is installing smart environmental monitoring sensors throughout a corporate data center. These embedded IoT devices run a lightweight, proprietary firmware that cannot support endpoint security software or Mobile Device Management (MDM) agent enrollment. Which of the following strategies best secures these embedded devices against unauthorized access while protecting the internal network?

Cevabı ve açıklamayı göster

Cevap: Place the embedded sensors on a dedicated, logically isolated VLAN with restricted firewall rules.

Cevap

Placing the embedded sensors on a dedicated, logically isolated VLAN with restricted firewall rules is the best security approach.
Embedded systems and IoT devices frequently run restricted or proprietary operating systems that cannot support agent-based endpoint security software or MDM management. The industry standard approach for securing these devices is network segmentation (such as placing them on a dedicated VLAN) paired with restrictive firewall access control lists (ACLs) to ensure they cannot initiate unauthorized communication with internal corporate assets.

Adım Adım Çözüm

1
Identify constraints of embedded IoT devices.
Recognize that these devices run specialized firmware unable to support standard MDM agents, antivirus software, or active endpoint management.
Embedded systems often have limited computing resources and non-standard operating systems.
2
Evaluate risk mitigation controls for unmanaged endpoints.
Determine that compensating network security controls, such as micro-segmentation and strict access control lists (ACLs), must be used.
Logical isolation limits the blast radius if an unmanaged embedded system is targeted or compromised.
3
Select the appropriate network isolation technique.
Assign the IoT devices to a separate virtual local area network (VLAN) isolated from production workstations and server subnets.
A separate VLAN enforces traffic restriction at the network boundary.

Anahtar Kavram

Embedded System Security & Network Isolation
Soru 2598Soru

A Windows 11 workstation administrator is troubleshooting an issue where a specialized CAD rendering application crashes every afternoon during heavy data processing. System Event Viewer reveals Event ID 1000 logged under the Application log referencing `render_engine.dll`. During live observation in Resource Monitor, the technician notes that the `Commit (KB)` value for the process increases continuously over several hours until system committed memory reaches 99%99\% of the page file limit, triggering severe disk thrashing (>200 hard faults/sec>200\text{ hard faults/sec}) and culminating in process crash. Which of the following represents the underlying cause of this performance degradation and crash, and what is the best long-term resolution?

Cevabı ve açıklamayı göster

Cevap: The application is suffering from a memory leak; patch or update the CAD rendering software to correct memory management.

Cevap

The application is suffering from a memory leak; patch or update the CAD rendering software to correct memory management.
The combination of continuously rising process `Commit (KB)` values, eventual page file exhaustion (99%99\%), excessive hard fault rates, and Event ID 1000 application crashes points directly to a software memory leak. When a program allocates RAM but fails to release it after execution cycles, committed memory steadily rises until the system runs out of virtual address space, causing disk thrashing and process crashes. Updating or patching the software is the correct resolution.

Adım Adım Çözüm

1
Analyze Resource Monitor and Event Viewer performance indicators
Identified Event ID 1000 (Application Crash) and continuously rising `Commit (KB)` alongside high hard fault rates (>200 hard faults/sec>200\text{ hard faults/sec}).
Committed memory reflects total RAM and page file space reserved by processes. A steady upward trend without stabilization indicates memory allocations are not being released back to the operating system.
2
Differentiate software defect symptoms from system environment errors
Confirmed that memory exhaustion is localized to the specific rendering process rather than global OS file corruption or drive failure.
Because memory allocation growth originates from `render_engine.dll` inside the third-party application, the issue is an application-level memory leak.
3
Determine the appropriate remediation path
Selected software update/patching to resolve the underlying code defect.
Developer-supplied patches address unreleased memory references in code, offering a permanent fix for memory leaks.

Anahtar Kavram

Identifying Application Memory Leaks and Virtual Memory Exhaustion
Soru 2599Soru

A workstation on a design team's network displays symptoms of a trojan infection. The IT technician immediately disconnects the Ethernet cable to quarantine the system from the network. What is the next step the technician should perform according to the standard CompTIA malware removal procedures?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows

Cevap

The technician should disable System Restore in Windows before proceeding with anti-malware scanning or remediation.
Following CompTIA's official 7-step malware remediation process, after identifying the malware and isolating the machine, the technician must disable System Restore before executing remediation tools. This ensures infected files saved inside restore points are cleared.

Adım Adım Çözüm

1
Identify current progress in the 7-step malware removal procedure
The technician has completed Step 1 (Identify symptoms) and Step 2 (Isolate the system).
Disconnecting the Ethernet cable represents isolating the infected host.
2
Determine the mandatory next step in the procedure
Step 3 requires disabling System Restore in Windows.
Disabling System Restore purges existing restore points and prevents malware from backing itself up into restore points during scanning.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 2600Soru

A desktop technician is implementing security hardening baseline policies on several standalone Windows workstations used by temporary contractors in a corporate office. The workstations must automatically secure active user sessions during periods of inactivity and restrict unauthorized local administrative capabilities. Which of the following security configurations best achieves these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a password-protected screen saver timeout after 5 minutes of inactivity and disable the built-in Guest account.

Cevap

Configure a password-protected screen saver timeout after 5 minutes of inactivity and disable the built-in Guest account.
Enforcing a screen lock with a short inactivity timeout and requiring authentication upon resume prevents unauthorized personnel from hijacking an open session. Disabling unused built-in accounts, such as the Guest account, directly aligns with CompTIA security best practices for reducing the workstation attack surface.

Adım Adım Çözüm

1
Identify the primary security requirements for workstation hardening in the scenario.
Requirements are preventing unauthorized access to unattended active sessions and disabling unused default account attack vectors.
Hardening best practices require session lock controls and attack surface reduction.
2
Evaluate operating system security settings that enforce session protection.
Configuring a short screen lock/screensaver timeout requiring password re-entry ensures that inactive desktops lock automatically.
This mitigates unauthorized physical interaction when a user leaves their desk.
3
Evaluate local account hardening controls.
Disabling built-in accounts such as the Guest account prevents anonymous access.
Default and unneeded accounts should always be disabled to minimize local vulnerability paths.

Anahtar Kavram

Workstation Hardening Baselines and Account Hygiene
Tahmini Süre:1m 15s
ÖncekiSayfa 130 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin