Tüm alıştırma soruları

3551 soru

Tüm türler3,551 Çoktan seçmeli1,809 Çoklu seçim786 Sayısal12 Eşleştirme521 Sıralama423

An IT security technician is auditing embedded smart security cameras mounted around a company perimeter. The audit indicates that the devices broadcast their network services automatically using Universal Plug and Play (UPnP) and accept remote administrative connections over unencrypted HTTP. Which of the following is the best remediation measure to secure these embedded IoT devices?

Disable UPnP on the devices, isolate them on a dedicated IoT network segment, and enforce HTTPS for administrative connections.

Deploy enterprise Mobile Device Management (MDM) containerization profiles and configure remote wipe parameters on each camera.

Configure WPA2-Personal using Temporal Key Integrity Protocol (TKIP) across all camera wireless interfaces.

Install physical security barriers such as vehicle bollards and security gates adjacent to the camera mounting poles.

Cevabı ve açıklamayı göster

Cevap: Disable UPnP on the devices, isolate them on a dedicated IoT network segment, and enforce HTTPS for administrative connections.

Cevap

Disable UPnP on the devices, isolate them on a dedicated IoT network segment, and enforce HTTPS for administrative connections.

The correct answer addresses the specific vulnerabilities identified in the audit. Embedded IoT devices require attack surface reduction (disabling unneeded services like UPnP), encryption of management channels (HTTPS), and logical isolation (dedicated IoT VLAN) to prevent lateral movement across the internal corporate network.

Adım Adım Çözüm

Identify vulnerabilities in the embedded camera setup.

Discovered exposed UPnP discovery services and cleartext HTTP administration channels.

Embedded IoT devices often ship with risky convenience features enabled by default.

Apply embedded system hardening controls.

Disable UPnP to block unauthorized network discovery, restrict management traffic to HTTPS, and isolate devices on a segmented VLAN.

Minimizes the attack surface and prevents unauthorized network traversal if a single camera is compromised.

Anahtar Kavram

Embedded System and IoT Security Hardening

Soru 2622Soru →

An IT support specialist is hardening newly deployed desktop computers in a corporate training center accessible to visiting contractors and temporary staff. To enforce account security best practices and minimize the local attack surface on these endpoints, which of the following actions should the technician take?

Disable the built-in Guest account and rename the default local Administrator account while creating unique maintenance accounts.

Enable the built-in Guest account and assign it to the local Administrators group so temporary users can run software updates.

Use Event Viewer to configure interactive logon banner messages and enforce automatic session lockouts for idle users.

Attach physical privacy filters to the workstation monitors to prevent unauthorized network access over local wireless connections.

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and rename the default local Administrator account while creating unique maintenance accounts.

Cevap

Disable the built-in Guest account and rename the default local Administrator account while creating unique maintenance accounts.

Disabling default accounts such as Guest and securing built-in Administrator accounts is a fundamental OS hardening baseline step that removes predictable targets for credential attacks.

Adım Adım Çözüm

Identify the security requirement for endpoint account hardening.

Recognize that default accounts present a known target for unauthorized access.

Hardening best practices require reducing the attack surface by eliminating default or unnecessary accounts.

Evaluate account management controls.

Disabling the Guest account and renaming the default Administrator account neutralizes common brute-force target names.

Attackers frequently attempt automated login attacks using standard default account names like 'Guest' or 'Administrator'.

Anahtar Kavram

Workstation Hardening Account Baselines

Soru 2623Soru →

A desktop computer powers on, but the screen remains blank and the system emits a repeating sequence of beep codes before halting. Which of the following components is most likely causing this failure during the Power-On Self-Test (POST)?

Improperly seated or faulty system memory (RAM)

Corrupted operating system bootloader files

Outdated dedicated graphics card software drivers

Unfragmented hard disk drive storage sectors

Cevabı ve açıklamayı göster

Cevap: Improperly seated or faulty system memory (RAM)

Cevap

Improperly seated or faulty system memory (RAM) is the most likely cause because POST beep codes alert the technician to core hardware initialization failures prior to loading the display or operating system.

Audible POST beep codes are produced directly by motherboard firmware when fundamental hardware components—most commonly RAM—fail initialization before video output can be established.

Adım Adım Çözüm

Analyze the reported symptom and startup phase.

The issue occurs during the Power-On Self-Test (POST) phase with audible beep codes and no video.

Beep codes are firmware diagnostic alerts produced when core hardware (RAM, CPU, motherboard) fails initial checks.

Differentiate between firmware hardware checks and operating system/software loading.

System memory (RAM) issues prevent POST from completing successfully, triggering audible alert patterns.

If RAM is not detected or seated properly, the system cannot initialize basic functions to display text or load the operating system.

Anahtar Kavram

POST Beep Code Diagnostics for Core Hardware Isolation

Soru 2624Soru →

An IT support technician is assisting a financial analyst whose Windows 11 laptop displays multiple unexpected pop-up notifications claiming the system is compromised, alongside severe performance degradation. The technician has confirmed the symptoms, disconnected all physical network cables, and disabled the Wi-Fi card to quarantine the infected host from the enterprise network. According to standard CompTIA malware removal procedures, which action should the technician perform NEXT?

Disable System Protection and delete existing restore points on the infected system.

Connect an external storage drive to perform an immediate full system backup before scanning.

Run an anti-malware definition update and execute a full background scan.

Conduct end-user training on identifying phishing vectors and suspicious browser pop-ups.

Cevabı ve açıklamayı göster

Cevap: Disable System Protection and delete existing restore points on the infected system.

Cevap

Disable System Protection and delete existing restore points on the infected system.

According to the official CompTIA 7-step malware removal process (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate, 5. Schedule scans/updates, 6. Enable System Restore, 7. Educate end user), the immediate next step after isolating the system is to disable System Restore/System Protection. This prevents Windows from saving copies of malware into restore points during remediation.

Adım Adım Çözüm

Identify current progress in the 7-step malware removal workflow.

The technician completed Step 1 (Identify malware symptoms) and Step 2 (Isolate the infected system).

The scenario states symptoms were confirmed and all network adapters (Ethernet and Wi-Fi) were disconnected.

Determine the next sequential step in the process.

Step 3 of the CompTIA malware removal process is to Disable System Restore (in Windows).

If System Restore remains enabled during remediation, infected files or registry keys could be backed up into shadow copies or restored accidentally.

Select the option that matches Step 3.

Disabling System Protection/System Restore is the correct immediate next step.

This halts automatic creation of system restore points containing malicious files before running cleanup scans.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process

Soru 2625Soru →

A desktop computer initialized with a legacy Master Boot Record (MBR) system partition fails to start following an unexpected system power interruption. Upon powering on, the machine halts immediately after POST with the message 'Operating System not found'. The technician boots into the Windows Recovery Environment (WinRE) command prompt to repair the fundamental boot records on the disk. Which TWO of the following bootrec utility operations must the technician execute to repair the corrupted master boot code and rewrite the partition boot sector? (Select TWO.)

Geçerli olan tümünü seçin

bootrec /fixmbr

bootrec /fixboot

bootrec /scannow

bootrec /reinstall

Cevabı ve açıklamayı göster

Cevap: bootrec /fixmbr; bootrec /fixboot

Cevap

The technician must run bootrec /fixmbr to repair the Master Boot Record and bootrec /fixboot to write a new boot sector to the system partition.

The correct selections are bootrec /fixmbr and bootrec /fixboot. On legacy MBR systems, an 'Operating System not found' error occurs when the MBR or the partition boot sector is missing or corrupted. Running bootrec /fixmbr writes a master boot record to the system partition, and bootrec /fixboot writes a new boot sector to the system partition to restore normal startup capability.

Adım Adım Çözüm

Identify the boot architecture and failure stage

The system uses legacy MBR partitioning and displays 'Operating System not found', indicating corrupted or missing boot code on the MBR or partition boot sector.

Legacy BIOS/MBR systems rely on valid MBR code and a compatible volume boot sector to locate and launch the boot loader.

Repair the Master Boot Record (MBR)

Executing bootrec /fixmbr writes a clean, standard MBR code block to the initial sectors of the system disk.

This resolves issues where corrupt MBR code fails to point to the active partition.

Rewrite the partition boot sector

Executing bootrec /fixboot writes a new partition boot sector to the system volume.

This ensures the active partition contains proper sector code capable of loading the Windows Boot Manager.

Anahtar Kavram

Troubleshooting MBR and Partition Boot Sector Corruption using WinRE CLI utilities

Tahmini Süre:2m 0s

Soru 2626Soru →

An IT technician is tasked with performing baseline workstation hardening on a newly deployed Windows system before issuing it to an employee. In which sequential order should the technician perform these hardening steps to establish proper security controls from account access to session security?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct procedural order is: first, disable the built-in Guest account and rename the default Administrator account; second, configure local password complexity and account lockout policies; third, disable AutoRun and AutoPlay for external media; and fourth, enable a screen lock timeout requiring a password on resume.

The correct order follows standard baseline security principles: eliminating high-risk default account exposure first, establishing robust user authentication rules second, restricting dangerous system automation (AutoRun/AutoPlay) third, and finalizing local physical session security (screen lock timeouts) fourth.

Adım Adım Çözüm

Address account vulnerabilities by disabling the Guest account and renaming the default Administrator account.

Known default account vectors are closed, preventing unauthorized privilege escalation.

Securing default credentials must occur before enabling broader account governance policies.

Define password complexity and lockout policies in Local Security Policy.

User authentication rules are hardened against dictionary and brute-force attempts.

Password and lockout baselines enforce credential strength for all created user profiles.

Configure Local Group Policy to disable AutoRun and AutoPlay.

Automatic background execution from connected USB or optical media is suppressed.

Restricting peripheral execution protects the system from drive-by hardware infection.

Set the screen saver timeout and enforce password protection upon waking.

Active user sessions lock automatically during periods of inactivity.

Session protection prevents unauthorized physical access when an authorized user steps away.

Anahtar Kavram

Workstation Baseline Hardening Sequence

Soru 2627Soru →

An IT support specialist at a solar power generation monitoring facility is remediating a Windows 11 workstation infected with rogue spyware. The specialist has already identified the malware symptoms, disconnected the system from the network to isolate it, and disabled System Restore in Windows. According to the standard CompTIA 7-step malware remediation process, which of the following actions should the specialist perform NEXT?

Update the anti-malware software signature definitions using an offline update package.

Schedule recurring automatic anti-malware scans and daily definition updates in Task Scheduler.

Re-enable System Restore and manually generate a clean system restore point.

Run the sfc /scannow command from an elevated Command Prompt to restore modified system binaries.

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware software signature definitions using an offline update package.

Cevap

Update the anti-malware software signature definitions using an offline update package.

According to CompTIA's official 7-step malware remediation process, once the system is quarantined (Step 2) and System Restore is disabled (Step 3), the technician must remediate the infected system (Step 4). The first part of remediation (Step 4a) is updating the anti-malware software signature files and engine. Because the system was isolated from the network during quarantine, deploying updated definitions via offline media is necessary before launching remediation scans (Step 4b).

Adım Adım Çözüm

Review the CompTIA 7-step malware remediation framework order.

The steps are: 1. Identify symptoms, 2. Quarantine, 3. Disable System Restore, 4. Remediate (a. Update definitions, b. Scan/remove), 5. Schedule scans/updates, 6. Enable System Restore & create restore point, 7. Educate user.

CompTIA strictly enforces this sequential methodology.

Identify the current progress established in the scenario stem.

Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) have already been completed.

The next action must be Step 4a: Update the anti-malware signatures/engine.

Select the option corresponding to Step 4a.

Updating anti-malware signatures using an offline update package is the immediate required step.

Because the machine is quarantined from the network, definition updates must be installed via offline media before scanning.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices

Tahmini Süre:1m 0s

Soru 2628Soru →

A technician is preparing to troubleshoot a Windows workstation exhibiting severe pop-up advertisements and browser redirects. Following standard CompTIA malware removal procedures, which of the following actions should the technician take PRIOR to executing anti-malware remediation tools? (Select TWO.)

Geçerli olan tümünü seçin

Disconnect the workstation from all wired and wireless network connections.

Disable System Restore within the operating system options.

Enable System Restore and generate a new baseline restore point.

Provide security awareness training to the primary workstation user.

Cevabı ve açıklamayı göster

Cevap: Disconnect the workstation from all wired and wireless network connections.; Disable System Restore within the operating system options.

Cevap

Disconnecting the workstation from all network connections and disabling System Restore are the required steps to complete prior to running malware remediation tools.

According to standard malware removal procedures, system isolation (unplugging network cables / turning off Wi-Fi) and disabling System Restore must take place before anti-malware tools remediate the system. Disconnecting network access prevents malware spread, while disabling System Restore purged infected restore points.

Adım Adım Çözüm

Isolate the infected system

Network cables are removed and Wi-Fi radios are disabled.

System isolation prevents lateral malware propagation across the network.

Disable System Restore

All existing restore points on the system are deleted.

Disabling System Restore ensures malware stored in system backups cannot reinfect the machine after cleaning.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure (Isolation and Pre-remediation Steps)

Soru 2629Soru →

A tier-2 helpdesk technician receives an escalated ticket regarding a workstation in a healthcare facility's radiology department. The workstation is experiencing extreme processing latency, rogue pop-up notifications, and unauthorized changes to browser settings. After confirming that these symptoms indicate an active malware infection, which of the following actions should the technician take NEXT prior to scanning and removing the malicious files? (Select TWO.)

Geçerli olan tümünü seçin

Disconnect the workstation from the local network by unplugging the Ethernet cable and disabling wireless connections

Turn off Windows System Protection to disable System Restore points on the affected system

Create an immediate system restore point to safeguard existing registry settings

Conduct an end-user training session on identifying phishing emails and malicious links

Replace the internal storage drive under the assumption of mechanical hardware failure

Cevabı ve açıklamayı göster

Cevap: Disconnect the workstation from the local network by unplugging the Ethernet cable and disabling wireless connections; Turn off Windows System Protection to disable System Restore points on the affected system

Cevap

The technician should isolate the workstation from the network (unplug Ethernet and turn off Wi-Fi) and disable Windows System Restore.

According to the official CompTIA 7-step malware remediation process, after identifying the malware symptoms (Step 1), the immediate next steps are to isolate the infected system (Step 2) by severing wired/wireless network connections, and to disable System Restore (Step 3) so that malware files are not preserved in restore snapshots during remediation.

Adım Adım Çözüm

Identify malware symptoms

Confirmed malware infection based on extreme processing latency, pop-ups, and browser redirects.

Completes Step 1 of the CompTIA 7-step malware removal process.

Isolate the infected system

Physical and wireless network connections are severed.

Prevents lateral movement of malware across the healthcare network and stops exfiltration of sensitive patient data.

Disable System Restore

System Protection is turned off, purging/suspending infected restore points.

Ensures that malware binaries stored in existing restore snapshots cannot survive or be restored post-cleanup.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure (Step 2: Isolate infected system, Step 3: Disable System Restore)

Tahmini Süre:2m 0s

Soru 2630Soru →

A technician is investigating a Windows 11 workstation where an enterprise application gradually consumes available system memory, causing severe system slowdowns after several hours of operation. In what order should the technician perform the following troubleshooting steps to identify and isolate the root cause?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct troubleshooting sequence begins with monitoring active process memory metrics in Task Manager and Resource Monitor, followed by reviewing Event Viewer application logs for crash and resource exhaustion events (Event ID 1000 and 2004). Next, configure a clean boot state using System Configuration (msconfig) by hiding Microsoft services and disabling non-Microsoft services. Finally, reboot the system and incrementally re-enable services to isolate the specific application service causing the memory leak.

The standard CompTIA troubleshooting workflow for application memory leaks and crashes requires first gathering live diagnostic metrics (Task Manager/Resource Monitor), reviewing recorded log events (Event Viewer Event IDs 1000/2004), establishing a clean startup baseline (msconfig with Microsoft services hidden), and systematically testing services after a reboot to isolate the offending third-party service.

Adım Adım Çözüm

Observe live system resource metrics using Task Manager and Resource Monitor.

Identifies high memory utilization, uncommitted Working Set growth, or memory leak patterns in real time.

Troubleshooting begins with active observation and symptom verification without altering system state.

Inspect Windows Event Viewer Application logs for related fault events.

Gathers specific error codes, event IDs (such as Event 1000 Application Error or Event 2004 Resource Exhaustion), and faulting module names.

Correlating live symptoms with system log data confirms the underlying executable and failure mechanism.

Open System Configuration (msconfig) to configure a clean boot environment.

Disables third-party services and startup items while preserving critical Microsoft OS services.

Establishes a baseline software environment free from non-essential background service interference.

Reboot the computer and systematically re-enable startup services.

Isolates the individual third-party service causing memory degradation upon re-activation.

Incremental isolation testing in a clean boot environment pinpoints the precise service or application responsible.

Anahtar Kavram

Methodological isolation of Windows application crashes and memory leaks

Soru 2631Soru →

A cybersecurity technician is responding to a compromised Windows 11 enterprise workstation exhibiting unauthorized network beaconing and modified system files. Arrange the following technician actions in the correct chronological sequence mandated by the official CompTIA 7-step malware removal procedure, starting with the earliest action.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order follows CompTIA's standard 7-step malware removal protocol: 1) Quarantine the endpoint by disconnecting network interfaces (Isolate), 2) Turn off System Protection (Disable System Restore), 3) Update signature files and perform a full scan (Remediate), 4) Enable automatic OS updates and schedule regular scans (Schedule scans and updates), and 5) Turn System Protection back on and generate a clean restore point (Enable System Restore).

The correct sequence directly adheres to CompTIA's official 7-step malware removal process: Step 2 requires isolating the infected device (disconnecting Ethernet and Wi-Fi) to contain the threat. Step 3 requires disabling System Restore to clear infected restore points. Step 4 encompasses remediating the system by updating anti-malware signatures and executing scans. Step 5 involves scheduling automated scans and applying OS updates. Step 6 involves re-enabling System Restore and generating a new, known-good restore point.

Adım Adım Çözüm

Isolate the compromised system.

Prevents active malware from spreading laterally across the enterprise network or communicating with command-and-control servers.

System isolation is Step 2 and must occur immediately after malware symptoms are recognized.

Disable System Restore / System Protection.

Deletes stored restore points that could retain copy-protected malicious binaries.

Step 3 prevents accidental system reinfection during or after the remediation phase.

Remediate the infected environment.

Anti-malware definitions are updated offline or via safe methods, and malicious software is successfully purged.

Step 4 focuses on active eradication using updated software and dedicated removal tools.

Schedule scans and install OS/application updates.

Patches system vulnerabilities and establishes ongoing automated monitoring to prevent reinfection.

Step 5 ensures long-term system integrity once active threats have been eradicated.

Enable System Restore and create a clean restore point.

Establishes a verified, uninfected recovery baseline for future troubleshooting.

Step 6 must only occur after confirming the system is patched, clean, and fully operational.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure

Soru 2632Soru →

A technician is troubleshooting a Windows workstation where a local database reporting application consistently causes system slowdowns. Task Manager indicates that memory utilization increases steadily to 95% whenever the application is active, while handle counts rise continuously until the application crashes. The technician suspects a background third-party service is conflicting with the application. Which of the following procedures should the technician perform to isolate the issue by initiating a clean boot?

Open System Configuration (msconfig.exe), navigate to the Services tab, select Hide all Microsoft services, and select Disable all.

Open the Services console (services.msc), select all non-running services, and change their Startup type setting to Disabled.

Open Task Manager, navigate to the Startup Apps tab, right-click each process, and select End Task to stop active memory consumption.

Run the sfc /scannow command from an elevated Command Prompt to restore default startup service configurations.

Cevabı ve açıklamayı göster

Cevap: Open System Configuration (msconfig.exe), navigate to the Services tab, select Hide all Microsoft services, and select Disable all.

Cevap

Open System Configuration (msconfig.exe), navigate to the Services tab, select Hide all Microsoft services, and select Disable all.

Performing a clean boot using System Configuration (msconfig.exe) by hiding all Microsoft services and disabling the remaining third-party services allows Windows to start with a minimal driver and service profile. This isolates background software conflicts causing high memory utilization and handle leaks without risking operating system functionality.

Adım Adım Çözüm

Analyze symptoms and diagnostic metrics.

High memory utilization (95%) and rising handle counts indicate a resource issue or memory leak potentially triggered or exacerbated by conflicting background services.

Isolating whether third-party background software causes the instability requires disabling non-essential services.

Select the appropriate Windows diagnostic tool for clean boot configuration.

System Configuration (msconfig.exe) provides options to disable third-party services while preserving core Microsoft OS services.

Hiding core Microsoft services ensures system stability while allowing third-party items to be systematically disabled.

Execute the clean boot procedure.

Navigating to the Services tab in msconfig.exe, checking 'Hide all Microsoft services', and clicking 'Disable all' sets up the environment for isolation testing upon restart.

If the issue disappears after restarting, the technician can re-enable services in small groups to pinpoint the conflicting background process.

Anahtar Kavram

Clean Boot Diagnostic Procedure for Windows Performance Troubleshooting

Tahmini Süre:1m 30s

Soru 2633Soru →

An IT security administrator is updating the enterprise Mobile Device Management (MDM) baseline for corporate endpoints and field devices. Match each mobile security control on the left with its primary security objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Containerization matches isolating corporate data into encrypted logical storage spaces. Geofencing matches enforcing context-aware security profiles based on physical location. Sideloading restriction matches preventing installation of unverified software binaries. Remote wipe matches sanitizing storage and returning endpoints to factory defaults.

Each security control targets a distinct endpoint protection layer: containerization isolates corporate data partitions on mobile devices; geofencing adjusts device behavior using physical boundaries; sideloading restrictions mitigate untrusted application installations; and remote wipe protects data on missing hardware by wiping local storage.

Adım Adım Çözüm

Identify the purpose of Containerization

Matches isolating corporate data into an encrypted logical storage space

Containerization creates a secure virtual compartment on mobile endpoints to prevent data leakage between personal and business applications.

Identify the purpose of Geofencing

Matches enforcing context-aware security profiles based on physical location

Geofencing establishes virtual geographic boundaries to trigger security controls, such as disabling camera features inside secure facilities.

Identify the purpose of Sideloading restriction

Matches preventing the installation of unverified software binaries

Disabling application sideloading mitigates malware exposure by restricting installation sources exclusively to enterprise-managed repositories or official stores.

Identify the purpose of Remote wipe

Matches sanitizing storage and returning an endpoint to factory defaults

Remote wipe commands ensure that compromised or stolen devices are completely cleared of sensitive organizational assets.

Anahtar Kavram

Mobile Device Security Controls and Management Features

Soru 2634Soru →

An IT support analyst is configuring a developer's workstation to host three concurrent virtual machines (VMs) for multi-platform application testing. The resource requirements for the guest VMs are as follows:
- VM 1: $8\text{ GB}$ of RAM
- VM 2: $16\text{ GB}$ of RAM
- VM 3: $8\text{ GB}$ of RAM

The host operating system requires a minimum of $8\text{ GB}$ of RAM, and the client-side hypervisor specifies an additional $4\text{ GB}$ of system RAM overhead. What is the minimum total amount of physical RAM that must be installed in the workstation to run all three VMs simultaneously without memory overcommitment?

32\text{ GB}

36\text{ GB}

40\text{ GB}

44\text{ GB}

Cevabı ve açıklamayı göster

Cevap: $44\text{ GB}$

Cevap

The minimum amount of physical RAM required is

44\text{ GB}

, calculated by adding all guest VM allocations (

32\text{ GB}

), host OS memory (

8\text{ GB}

), and hypervisor overhead (

4\text{ GB}

To ensure stable performance without overcommitting resources, a host machine must contain enough physical RAM to cover all active guest virtual machines (

8\text{ GB} + 16\text{ GB} + 8\text{ GB} = 32\text{ GB}

), plus the RAM needed by the host operating system (

8\text{ GB}

) and hypervisor management overhead (

4\text{ GB}

). Summing these values yields

32\text{ GB} + 8\text{ GB} + 4\text{ GB} = 44\text{ GB}

Adım Adım Çözüm

Calculate total memory required for all guest virtual machines

8\text{ GB} + 16\text{ GB} + 8\text{ GB} = 32\text{ GB}

Each guest VM requires dedicated RAM allocated to perform its tasks.

Identify memory requirements for host environment and hypervisor management

Host OS =

8\text{ GB}

, Hypervisor Overhead =

4\text{ GB}

The host system must retain sufficient RAM to run its own processes and manage guest VM hardware abstraction.

Sum all memory requirements to determine minimum physical RAM capacity

32\text{ GB} + 8\text{ GB} + 4\text{ GB} = 44\text{ GB}

Ensures the host physical RAM accommodates all operational demands without relying on page files or disk swapping.

Anahtar Kavram

Virtual Machine Memory Allocation & Host Overhead Requirements

Soru 2635Soru →

A Windows 11 workstation fails to complete startup following a sudden power failure during a system update. On power-on, the machine displays a blue Recovery screen stating 'Your PC/Device needs to be repaired' along with error code 0xc000000e, indicating that the Boot Configuration Data (BCD) file is missing or contains errors. The IT technician boots the computer into the Windows Recovery Environment (WinRE) using bootable installation media and opens the Command Prompt. Which command should the technician execute FIRST to locate installed Windows OS instances and rebuild the boot configuration?

bootrec /rebuildbcd

bootrec /fixmbr

sfc /scannow

chkdsk C: /r

Cevabı ve açıklamayı göster

Cevap: bootrec /rebuildbcd

Cevap

The command 'bootrec /rebuildbcd' should be executed first to scan disks for Windows installations and reconstruct the missing or corrupted Boot Configuration Data store.

The error code 0xc000000e occurs when the Windows Boot Manager cannot locate or read the Boot Configuration Data (BCD) file. Running 'bootrec /rebuildbcd' within the Windows Recovery Environment scans disk partitions for installed Windows operating systems and allows the technician to rebuild the BCD database, resolving the startup error.

Adım Adım Çözüm

Analyze the error code and boot state

Error code 0xc000000e specifies a missing or damaged BCD store, preventing Windows Boot Manager from locating the boot loader.

Identifying the exact boot phase failure isolates the problem to BCD file corruption rather than driver failure or disk corruption.

Boot into WinRE Command Prompt

Access to offline command-line repair tools is established.

WinRE provides the environment necessary to run recovery tools against offline operating system partitions.

Execute the bootrec /rebuildbcd command

The tool scans connected storage for Windows installations and prompts to add discovered installations to the BCD store.

Rebuilding the BCD directly addresses BCD corruption by recreating missing entries required by Windows Boot Manager.

Anahtar Kavram

Windows Boot Configuration Data (BCD) Recovery via WinRE Command Prompt

Soru 2636Soru →

A security technician is configuring operating system baseline settings for a workstation that will be deployed to a high-security research facility. The workstation must adhere to the principle of least functionality by reducing unnecessary network-facing vulnerabilities before network placement. Which of the following workstation hardening practices directly accomplishes this objective?

Disabling unneeded background services and unrequired OS features to minimize the system attack surface.

Installing physical cable locks and privacy screens to block unauthorized network traffic and protocol inspection.

Configuring Event Viewer MMC snap-in to actively block incoming port connection requests.

Modifying Indexing Options in Control Panel to inspect and filter network traffic crossing local directories.

Cevabı ve açıklamayı göster

Cevap: Disabling unneeded background services and unrequired OS features to minimize the system attack surface.

Cevap

Disabling unneeded background services and unrequired OS features to minimize the system attack surface.

Disabling unnecessary background OS services, applications, and ports directly implements system hardening by enforcing the principle of least functionality. Reducing running components minimizes the potential attack surface available to unauthorized network actors.

Adım Adım Çözüm

Analyze the scenario requirements.

Identified the need to enforce the principle of least functionality and reduce network attack vectors on a new workstation.

Workstation hardening mandates turning off default features, open ports, and services that are not strictly necessary for system operation.

Evaluate the technical effectiveness of each security control.

Turning off unused background services closes listening ports and removes unnecessary software execution paths.

Every active service represents a potential entry point for exploits if unpatched or misconfigured.

Anahtar Kavram

Workstation Hardening via Service Reduction

Tahmini Süre:1m 15s

Soru 2637Soru →

A desktop technician at a live broadcast news production studio is responding to a malware incident on a Windows 11 workstation. The machine was disconnected from the local network after pop-ups and unusual background network traffic were detected. The technician has confirmed the presence of rogue spyware and has already disabled System Restore on the machine. Which TWO actions should the technician perform NEXT to adhere to the CompTIA 7-step malware remediation process? (Select TWO.)

Geçerli olan tümünü seçin

Update the local anti-malware software engine and definition signatures using an offline installation package

Perform a full system scan in Safe Mode using specialized anti-malware removal tools

Re-enable System Restore and create an initial system recovery checkpoint

Configure Windows Task Scheduler to execute daily automated anti-malware scans during off-peak hours

Execute the command 'sfc /scannow /f' inside Windows Task Manager to repair malicious DLL modifications

Cevabı ve açıklamayı göster

Cevap: Update the local anti-malware software engine and definition signatures using an offline installation package; Perform a full system scan in Safe Mode using specialized anti-malware removal tools

Cevap

Updating the anti-malware software and definition signatures offline, followed by performing a full system scan in Safe Mode using dedicated removal tools.

According to the CompTIA 7-step malware remediation process, once the technician has identified the symptoms (Step 1), quarantined the system (Step 2), and disabled System Restore (Step 3), the next phase is Step 4: Remediate the infected system. This phase consists of two parts: first updating anti-malware software and signature definitions (Step 4a), and second using scanning and removal techniques such as Safe Mode or pre-boot environments (Step 4b). Updating definitions offline ensures the quarantined system gets the latest signatures without reconnecting to the network.

Adım Adım Çözüm

Review the current progress in the 7-step remediation workflow

Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) are already completed.

Determines the exact position in the standard procedure.

Identify the sub-steps of Step 4: Remediate Infected Systems

Step 4a requires updating signatures/definitions (via offline media since the host is quarantined), and Step 4b requires scanning and removing infected files.

Remediation cannot effectively eradicate threats without up-to-date threat signatures and execution in an isolated state like Safe Mode.

Select the correct actions matching Step 4a and Step 4b

Updating definitions offline and running a scan in Safe Mode are selected as the immediate next steps.

Subsequent steps like scheduling scans (Step 5), re-enabling System Restore (Step 6), and end-user education (Step 7) must wait until remediation succeeds.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process (Step 4: Remediate Infected Systems)

Soru 2638Soru →

A user on a Windows 11 workstation reports that launching web browsers automatically redirects their sessions to an external ad-supported search engine. Further inspection reveals that entering standard internal and external domain names into the address bar routes requests to unauthorized third-party IP addresses. Which of the following remediation steps should the technician perform to resolve these browser security issues? (Select TWO.)

Geçerli olan tümünü seçin

Inspect the web browser add-on manager and disable or uninstall unrecognized extensions.

Clear the web browser temporary cache and browsing history.

Inspect the local Windows hosts file and delete unauthorized domain-to-IP address mappings.

Rebuild the local search index using the Indexing Options Control Panel applet.

Cevabı ve açıklamayı göster

Cevap: Inspect the web browser add-on manager and disable or uninstall unrecognized extensions.; Inspect the local Windows hosts file and delete unauthorized domain-to-IP address mappings.

Cevap

The technician should inspect the web browser add-on manager to remove unrecognized extensions, and examine the local Windows hosts file to delete unauthorized domain-to-IP mappings.

To completely remediate unwanted browser redirects and forced domain routing, a technician must remove rogue extensions within the browser add-on manager and delete unauthorized domain-to-IP mappings in the operating system's local hosts file.

Adım Adım Çözüm

Isolate and remove extension-based browser hijackers within the web browser.

Unapproved extensions causing search engine redirection are removed from the browser environment.

Rogue extensions frequently alter default search providers and home page settings.

Examine system-level name resolution settings in C:\Windows\System32\drivers\etc\hosts.

Unauthorized static IP entries redirecting web traffic are erased.

Modifications to the local hosts file intercept domain lookup requests before DNS resolution occurs.

Anahtar Kavram

Browser Hijacking & Hosts File Redirection Remediation

Soru 2639Soru →

An organization permits employees to access corporate email and proprietary internal applications on their personal mobile devices under a Bring Your Own Device (BYOD) policy. The IT security administrator must ensure that corporate data can be erased remotely if a device is lost or an employee departs, without destroying the employee's personal photos and files. Which of the following security controls BEST fulfills this requirement?

Containerization

Full device remote wipe policy

WPA2-Personal authentication enforcement

Physical security cable locks

Cevabı ve açıklamayı göster

Cevap: Containerization

Cevap

Containerization separates corporate data from personal data on mobile devices, allowing administrators to execute a selective wipe of business information while leaving personal files intact.

Containerization establishes an isolated, encrypted environment on personal devices specifically for corporate data and applications. Through MDM/MAM administration, IT teams can issue a selective wipe command that removes only the corporate container and its encrypted keys, preserving the user's personal media, personal apps, and configuration settings.

Adım Adım Çözüm

Analyze the administrative goal and constraints

The administrator must enable remote wiping of corporate data on BYOD endpoints while preserving employee personal data.

BYOD security policies require balancing corporate data protection with employee privacy.

Evaluate technical features of mobile security controls

Containerization creates a logically separated, encrypted compartment for enterprise apps and storage on the smartphone.

This logical boundary allows Mobile Device Management (MDM) or Mobile Application Management (MAM) software to issue a selective wipe target limited strictly to the corporate container.

Select the optimal control

Containerization directly satisfies the requirement for selective data erasure.

Other options either perform an all-or-nothing factory reset or focus on unrelated physical and network transport security.

Anahtar Kavram

BYOD Security Controls and Mobile Containerization

Soru 2640Soru →

An IT technician is troubleshooting a Windows workstation at a remote branch office that has been infected with browser-hijacking spyware and persistent adware. The technician has already identified the malware symptoms, disconnected the workstation from the local network, and turned off Windows System Protection (disabled System Restore). According to the CompTIA standard 7-step malware removal procedures, which of the following actions should the technician perform NEXT?

Update the anti-malware signature files and perform a full remediation scan using targeted removal tools.

Schedule recurring daily background scans and configure automatic operating system updates.

Re-enable System Protection and generate a new clean system restore point.

Replace the network interface card and storage drive assuming hardware failure is causing the performance degradation.

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware signature files and perform a full remediation scan using targeted removal tools.

Cevap

Update the anti-malware signature files and perform a full remediation scan using targeted removal tools.

CompTIA follows a strict 7-step malware removal process: (1) Identify malware symptoms, (2) Isolate infected systems, (3) Disable System Restore, (4) Remediate infected systems, (5) Schedule scans and run updates, (6) Enable System Restore and create a restore point, and (7) Educate the end user. Since the technician has already completed steps 1 through 3, the immediate next action required is Step 4: Remediating the infected system by updating anti-malware signatures and scanning/removing the threat.

Adım Adım Çözüm

Analyze current progress in the 7-step malware removal process.

Completed steps are: Step 1 (Identify), Step 2 (Isolate system), and Step 3 (Disable System Restore).

CompTIA enforces a mandatory sequential ordering for malware remediation.

Identify the immediate subsequent step following Step 3.

Step 4 is 'Remediate infected systems', which includes updating anti-malware software and executing full system scans in a safe/isolated environment.

System restore must remain disabled while active scanning and removal tools clean the operating system.

Evaluate the choices to find the matching action.

Updating anti-malware definitions and running remediation scans directly corresponds to Step 4.

Steps 5 (Schedule scans), 6 (Enable System Restore), and 7 (End-user education) occur later in the process.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure

ÖncekiSayfa 132 / 178Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram