Examkin

Tüm alıştırma soruları

3551 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 2641Soru →

A technician is setting up a workstation to host multiple 64-bit guest virtual machines using a client-side hypervisor. When launching a guest operating system, the hypervisor reports an error indicating that hardware virtualization support and extended page table translation are disabled or unsupported. Which TWO of the following hardware features or BIOS/UEFI configurations must be enabled on the host system to resolve this issue?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Intel VT-x or AMD-V CPU virtualization extensions in BIOS/UEFI; Second Level Address Translation (SLAT) support on the host processor

Cevap

Intel VT-x or AMD-V CPU extensions enabled in BIOS/UEFI and Second Level Address Translation (SLAT) CPU support are the required host configurations.
Hosting 64-bit guest virtual machines requires CPU hardware-assisted virtualization (Intel VT-x or AMD-V) enabled in the motherboard BIOS/UEFI settings, along with CPU support for Second Level Address Translation (SLAT) to handle virtual memory mapping directly in hardware.

Adım Adım Çözüm

1
Determine the CPU virtualization requirement for running 64-bit guest VMs.
Intel VT-x or AMD-V must be enabled in BIOS/UEFI firmware to allow the host processor to perform hardware-assisted virtualization.
Without hardware virtualization extensions enabled, client hypervisors cannot manage 64-bit guest OS execution.
2
Identify the memory virtualization feature needed for hypervisor address mapping.
Second Level Address Translation (SLAT) maps guest virtual memory directly to host physical RAM in CPU hardware.
SLAT significantly reduces memory translation overhead and is required by modern client hypervisors.

Anahtar Kavram

Virtual Machine Hardware Requirements and BIOS/UEFI Virtualization Settings
Soru 2642Soru →

A desktop technician is performing malware remediation on a compromised Windows 10 workstation controlling automated machinery on a manufacturing floor. The technician has already confirmed malware infection symptoms and physically disconnected the ethernet cable to isolate the system. In what exact order should the technician perform the remaining steps to complete the standard CompTIA malware removal process?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the remaining remediation steps is: Disable System Restore, Update anti-malware signatures offline and execute a full scan, Configure recurring automated scans and schedule OS security updates, Enable System Restore and generate a clean system restore point, and Conduct end-user security training.
According to CompTIA's official 7-step malware removal process, after identifying the symptoms (Step 1) and isolating the system (Step 2), the technician must proceed through the remaining steps in strict sequence: Step 3 is Disabling System Restore, Step 4 is Remediating infected systems (updating anti-malware signatures and scanning), Step 5 is Scheduling scans and running updates, Step 6 is Enabling System Restore and creating a new restore point, and Step 7 is Educating the end user.

Adım Adım Çözüm

1
Identify malware symptoms
Malware presence confirmed (already completed in scenario).
Establishes the problem state before taking remediation steps.
2
Isolate infected systems
Ethernet cable disconnected (already completed in scenario).
Prevents lateral movement across the manufacturing network.
3
Disable System Restore
System Protection disabled; corrupted restore points purged.
Prevents the infected system from keeping backup copies of infected binaries during cleaning.
4
Remediate infected systems
Anti-malware definitions updated via external media and full system scan completed.
Ensures active malicious processes and files are completely quarantined and erased.
5
Schedule scans and run updates
Scheduled tasks created for periodic scanning and Windows Update checks.
Ensures long-term protection against re-infection.
6
Enable System Restore and create restore point
System Protection enabled; baseline restore point created.
Provides a healthy recovery baseline now that the OS is known clean.
7
Educate end user
Operators trained on security awareness and threat prevention.
Reduces human-factor vulnerability to future attacks.

Anahtar Kavram

CompTIA 7-Step Best Practice Methodology for Malware Removal
Soru 2643Soru →

A receptionist at a medical clinic reports that a Windows workstation used for check-ins is displaying unexpected adware pop-ups and generating heavy unauthorized network traffic. A technician inspects the system and confirms an active malware infection. According to the CompTIA standard 7-step malware removal process, which of the following actions should the technician perform IMMEDIATELY after identifying the infection?

Cevabı ve açıklamayı göster

Cevap: Disconnect the workstation from the network

Cevap

Disconnect the workstation from the network
Following the CompTIA 7-step malware removal process (1. Identify symptoms, 2. Isolate infected system, 3. Disable System Restore, 4. Remediate infected system, 5. Schedule scans and updates, 6. Enable System Restore, 7. Educate end user), the immediate next step after identifying malware is to isolate the system by disconnecting it from wired or wireless networks.

Adım Adım Çözüm

1
Identify the current step in the CompTIA 7-step malware removal workflow
The scenario states that the technician has already confirmed the malware infection (Step 1: Identify malware symptoms).
Determining the current phase dictates what action must follow immediately.
2
Determine the next sequential step in the process
Step 2 is to isolate the infected system.
Isolating the device by unplugging the Ethernet cable or disconnecting Wi-Fi prevents malware from spreading to other network assets or exfiltrating data.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure (Step 2: Isolate infected systems)
Tahmini Süre:45s
Soru 2644Soru →

An IT support technician is remediating a malware-infected Windows workstation following the official CompTIA 7-step malware removal process. Place the following steps of the remediation procedure in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Isolate the infected workstation from the network, 2) Disable System Restore in Windows, 3) Update anti-malware signatures and perform full system remediation scans, and 4) Re-enable System Restore and create a clean restore point.
The standard CompTIA 7-step malware removal process strictly follows this sequence: 1. Identify malware symptoms, 2. Isolate the infected system, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Disconnecting network access comes first among these choices to contain the threat, followed by disabling restore points, executing anti-malware scans/remediation, and finally re-enabling System Restore once cleanliness is assured.

Adım Adım Çözüm

1
Isolate the system
The infected endpoint is disconnected from wireless and wired network connections.
Prevents the malware from spreading to other systems on the network or communicating with remote command-and-control servers.
2
Disable System Restore
System Restore is turned off and existing restore points containing infected files are cleared.
Ensures that malware cannot be restored inadvertently from an infected restore point later.
3
Remediate infected systems
Anti-malware software is updated with current definition files and full system scans are run.
Identifies and removes active malware threats and associated infected files.
4
Re-enable System Restore
System Restore is re-enabled and a new, verified clean system restore point is created.
Establishes a reliable recovery point now that the machine is entirely clean.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Procedure
Soru 2645Soru →

A help desk analyst is troubleshooting a user's workstation where launching the web browser via its desktop shortcut consistently opens an unfamiliar advertising web page alongside the corporate homepage. The analyst verifies that the browser's startup settings and default search engine are configured correctly, and no suspicious browser extensions are installed. Which of the following should the technician inspect NEXT to resolve the persistent redirection?

Cevabı ve açıklamayı göster

Cevap: The Target field in the desktop shortcut properties for the web browser

Cevap

The technician should inspect the Target field in the desktop shortcut properties for the web browser.
Inspecting the Target field in the desktop shortcut properties addresses shortcut hijacking, a common redirection technique where malicious software appends a URL to the browser executable command line. Because internal browser configurations and extensions were verified as clean, the launch parameter outside the browser is the primary root cause.

Adım Adım Çözüm

1
Analyze the troubleshooting context and prior findings.
Internal browser startup settings, default search engines, and browser add-ons/extensions have already been verified as clean.
Eliminating internal browser configuration rules out standard homepage hijacking and rogue extensions.
2
Identify potential external launch vectors for browser redirection.
Browser shortcuts on the desktop or taskbar can have additional command-line arguments added to their target paths (e.g., chrome.exe http://malicious-site.com).
When the user clicks the modified shortcut, the OS passes the appended URL directly to the browser executable upon launch.
3
Select the appropriate inspection and remediation action.
Right-click the shortcut, select Properties, and inspect the Target string to remove any appended URLs.
Cleaning the shortcut path restores normal browser launching behavior.

Anahtar Kavram

Browser Shortcut Target Hijacking Remediation
Tahmini Süre:1m 0s
Soru 2646Soru →

A field technician is configuring a hypervisor host workstation equipped with 32 GB32\text{ GB} of physical RAM to run four concurrent virtual machines (VMs) for software testing. Each guest VM requires 8 GB8\text{ GB} of dedicated RAM, and the host operating system requires a reserved minimum of 4 GB4\text{ GB} of physical RAM to ensure system stability. What is the minimum amount of additional physical RAM that must be installed in the host workstation to support this deployment?

Cevabı ve açıklamayı göster

Cevap: 4 GB4\text{ GB}

Cevap

The host workstation requires a minimum of 4 GB4\text{ GB} of additional physical RAM to run four guest VMs of 8 GB8\text{ GB} each alongside the 4 GB4\text{ GB} host OS memory reserve.
Four VMs requiring 8 GB8\text{ GB} each demand 32 GB32\text{ GB} of RAM. Adding the mandatory 4 GB4\text{ GB} host OS memory overhead brings the total system requirement to 36 GB36\text{ GB}. Since the host currently has 32 GB32\text{ GB} installed, a minimum addition of 4 GB4\text{ GB} of physical RAM is necessary to prevent memory starvation.

Adım Adım Çözüm

1
Calculate total memory required for all guest virtual machines.
4 VMs×8 GB/VM=32 GB4 \text{ VMs} \times 8\text{ GB/VM} = 32\text{ GB}.
Each guest VM requires dedicated RAM allocated for its guest operating system and applications.
2
Add the mandatory host operating system memory overhead.
32 GB (guests)+4 GB (host reserve)=36 GB32\text{ GB (guests)} + 4\text{ GB (host reserve)} = 36\text{ GB} total system requirement.
The hypervisor and host OS require dedicated physical RAM to avoid paging and system instability.
3
Subtract currently installed physical RAM from total system requirement.
36 GB (total required)−32 GB (installed)=4 GB36\text{ GB (total required)} - 32\text{ GB (installed)} = 4\text{ GB} additional RAM required.
Determines the exact hardware capacity deficit.

Anahtar Kavram

Virtual Machine RAM Capacity Planning and Host Overhead
Soru 2647Soru →

A cybersecurity analyst at a research facility is responding to a compromised Windows 11 workstation connected to automated lab sequencing hardware. The machine exhibits persistent pop-up alerts, altered host files, and unauthorized background process creation. The analyst has already isolated the workstation by disabling its network interfaces and has disabled Windows System Restore. Which of the following actions should the analyst perform IMMEDIATELY before launching a full remediation scan on the infected system?

Cevabı ve açıklamayı göster

Cevap: Update the local anti-malware definition signatures using an offline installation package.

Cevap

Update the local anti-malware definition signatures using an offline installation package.
The scenario describes a system where Step 1 (Identify malware symptoms), Step 2 (Quarantine/Isolate), and Step 3 (Disable System Restore) have already been performed. Step 4 of the CompTIA malware removal process is 'Remediate infected systems,' which explicitly requires updating the anti-malware software and definitions (sub-step 4a) before running scans and using removal techniques (sub-step 4b). Because the workstation is disconnected from the network to maintain isolation, signature updates must be transferred via an offline installation package.

Adım Adım Çözüm

1
Analyze the current state within CompTIA's 7-step malware removal framework.
The technician has completed Step 1 (Identify symptoms), Step 2 (Quarantine/Isolate system), and Step 3 (Disable System Restore).
Establishing the current phase in the standard workflow dictates the required next action.
2
Identify the sub-steps of Step 4 (Remediate infected systems).
Step 4 requires updating the anti-malware engine/signatures first (Step 4a) before running scans and removal tools (Step 4b).
Scanning with outdated definition files may miss newly mutated malware signatures or rootkit payloads.
3
Determine the proper method for updating signatures on an isolated system.
Because the system is isolated from the network, signatures must be updated offline via removable media containing signed signature packages.
Maintaining network isolation prevents malware propagation while providing the scanner with current detection signatures.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure - Step 4 (Remediate: Update anti-malware software before scanning)
Tahmini Süre:2m 0s
Soru 2648Soru →

A desktop technician at an online retail fulfillment center is troubleshooting a Windows 11 workstation. The machine was isolated from the network after an employee reported rogue browser pop-ups and unauthorized system settings changes. The technician has verified the malware symptoms, quarantined the workstation, and disabled System Restore. Which of the following is the NEXT step the technician should perform according to the standard CompTIA malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware software and signature definition files.

Cevap

Update the anti-malware software and signature definition files.
According to the CompTIA 7-step malware remediation process, once System Restore has been disabled (Step 3), the technician must begin remediation (Step 4). Remediation specifically requires updating anti-malware software and definition files (Step 4a) before executing full system scans and removal techniques (Step 4b).

Adım Adım Çözüm

1
Review the CompTIA 7-step malware remediation process sequence.
Process order: 1. Identify symptoms, 2. Quarantine, 3. Disable System Restore, 4. Remediate (a. Update anti-malware, b. Scan/remove), 5. Schedule updates/scans, 6. Enable System Restore & create restore point, 7. Educate user.
CompTIA standards mandate a strict sequence to ensure complete malware eradication.
2
Identify current progress in the scenario.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) are already complete.
Determines the precise entry point into the remediation workflow.
3
Determine the mandatory next sub-step.
Sub-step 4a is updating the anti-malware software and signature definition files prior to scanning (4b).
Updating definitions ensures the scanner has the newest threat signatures to detect and remove the active infection effectively.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Tahmini Süre:1m 15s
Soru 2649Soru →

A Windows 11 workstation equipped with UEFI firmware fails to start, displaying an error stating that the Boot Configuration Data (BCD) file is missing or corrupted. Automatic Repair is unable to resolve the issue. A system administrator boots the computer using Windows installation media to manually rebuild the EFI System Partition (ESP) boot loader from the Command Prompt. Place the technician's administrative steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with booting into the WinRE Command Prompt via installation media, using diskpart to identify and assign a drive letter to the hidden EFI System Partition, formatting that partition as FAT32, executing the bcdboot command to reconstruct the EFI boot store, and finally rebooting the workstation to confirm normal startup.
The correct order follows the standard procedure for repairing corrupted UEFI boot structures: first boot into an offline command shell, mounting/lettering the hidden EFI partition, wiping existing corrupt boot headers with a FAT32 format, writing new boot files with bcdboot, and rebooting to complete testing.

Adım Adım Çözüm

1
Boot from Windows 11 installation media and select 'Repair your computer' to open the WinRE Command Prompt.
Obtained offline administrative CLI access to the unbootable workstation.
System partition modification and offline BCD repairs require an unmounted, offline recovery environment.
2
Launch Diskpart, select the disk and EFI System Partition, and run 'assign letter=S'.
The hidden FAT32 EFI System Partition becomes accessible via drive letter S:.
UEFI bootloader recovery commands require a target drive letter path to apply new boot files.
3
Execute 'format S: /FS:FAT32' within Diskpart or Command Prompt.
The target partition is clean-formatted with the mandatory FAT32 file system.
Clearing corrupted file systems and damaged boot blocks ensures clean deployment of replacement boot infrastructure.
4
Run 'bcdboot C:\Windows /s S: /f UEFI'.
Fresh UEFI boot files and BCD entries are copied from C:\Windows into S:.
The bcdboot tool initializes the EFI System Partition with essential boot files and BCD configuration mandatory for UEFI startup.
5
Remove installation media, exit the command prompt, and restart the system.
The workstation successfully boots into the Windows operating system.
Rebooting verifies that the UEFI firmware correctly detects the restored EFI System Partition boot sequence.

Anahtar Kavram

Manual repair of corrupt UEFI/GPT boot structures using Diskpart and BCDBoot in WinRE.
Tahmini Süre:2m 0s
Soru 2650Soru →

A desktop technician is establishing baseline security settings for standalone Windows laptops issued to remote sales personnel. The technician must ensure that the laptops automatically lock when left unattended and that malicious code cannot execute automatically when a USB drive is plugged in. Which of the following actions should the technician perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable AutoPlay and AutoRun features for all removable storage media.; Configure screen saver timeout settings and enforce password re-authentication on resume.

Cevap

The technician should disable AutoPlay and AutoRun features for all removable media and configure screen saver timeout settings requiring password re-authentication on resume.
Disabling AutoPlay and AutoRun mitigates risks associated with malicious flash drives by stopping automatic file execution. Configuring a screen saver timeout with password protection guarantees that unattended systems lock automatically, satisfying local physical security hardening baselines.

Adım Adım Çözüm

1
Address the requirement to prevent automatic execution of software from USB devices.
Disabling AutoPlay and AutoRun ensures inserted drives will not execute commands automatically without user interaction.
AutoRun and AutoPlay policies serve as primary hardening defenses against USB-borne malware vectors.
2
Address the requirement to prevent physical access to unattended workstations.
Configuring a short screen saver timeout that requires a password upon resume locks the operating system session.
Screen saver locking protects local confidentiality if an employee leaves their device unattended in a public or remote environment.

Anahtar Kavram

Workstation Security Baselines and Removable Media Policies
Soru 2651Soru →

An IT technician working at a logistics corporate headquarters is remediating a Windows workstation infected with rogue antivirus software. The technician has already identified the symptoms, isolated the machine from the network, and disabled System Restore. Which of the following actions should the technician perform NEXT before launching a full system anti-malware scan?

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware engine and signature definitions using an isolated media device.

Cevap

The technician should update the anti-malware engine and definition files prior to performing a full system scan.
According to the CompTIA 7-step malware remediation process, Step 4 is 'Remediate infected systems', which consists of two sequential parts: sub-step 4a (Update anti-malware software and definitions) followed by sub-step 4b (Scan and use removal techniques). Since the workstation is isolated from the network, definitions must be updated via external out-of-band media before initiating the scan.

Adım Adım Çözüm

1
Analyze the current state within the CompTIA 7-step malware remediation process.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) have already been completed.
Determines the appropriate next sequential remediation action required.
2
Identify the sub-components of Step 4 (Remediate the infected systems).
Sub-step 4a is updating anti-malware software/signatures, and sub-step 4b is scanning and executing removal techniques.
Antivirus software cannot effectively detect or clean current threat signatures unless updated first.
3
Select the correct action matching Step 4a.
Updating anti-malware definitions using isolated/out-of-band media (since the system is disconnected from the network).
Ensures the scanner has the latest detection patterns before scanning.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process Order
Soru 2652Soru →

A systems administrator is provisioning standalone Android-based digital signage kiosks deployed in public transit stations. The administrator needs to protect these embedded endpoints against unauthorized software installation, interface tampering, and OS-level access by members of the public. Which TWO of the following security configurations should be implemented to best harden these devices?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce application whitelisting and enable a single-app kiosk mode profile to restrict navigation.; Disable hardware interface options such as USB debugging and restrict firmware access with administrative credentials.

Cevap

The administrator should enforce application whitelisting with kiosk mode and disable USB debugging while securing firmware access.
Hardening embedded kiosks requires restricting the software layer through application whitelisting and kiosk mode profiles, alongside locking down physical debugging interfaces like USB debugging and securing bootloader/firmware settings.

Adım Adım Çözüm

1
Identify software restrictions required for public-facing embedded kiosks.
Configuring single-app kiosk mode combined with application whitelisting ensures users cannot leave the designated app interface or run unapproved software.
Public terminals are highly vulnerable to unauthorized software installation and operating system navigation.
2
Identify physical and hardware interface hardening measures.
Disabling USB debugging and protecting firmware modifications prevents physical access exploits via external media or debug connections.
Physical access to exposed ports like USB can allow attackers to bypass software controls if debugging interfaces remain active.

Anahtar Kavram

Embedded System and Kiosk Device Hardening Controls
Soru 2653Soru →

A technician is troubleshooting a Windows 11 workstation where a critical line-of-business application crashes immediately upon opening. Event Viewer records Event ID 1000 in the Application log, specifying ntdll.dll as the faulting module. Hardware diagnostics for memory and storage report no errors. Which of the following commands should the technician execute FIRST from an elevated command prompt to verify and repair corrupted system files?

Cevabı ve açıklamayı göster

Cevap: sfc /scannow

Cevap

The technician should execute sfc /scannow from an elevated command prompt to repair corrupted system files.
Executing sfc /scannow is the standard non-destructive troubleshooting step to repair corrupted system files when Event Viewer indicates a core Windows library like ntdll.dll is the faulting module.

Adım Adım Çözüm

1
Analyze Event Viewer logs
Identify Event ID 1000 indicating an application crash caused by a corrupted core system library (ntdll.dll).
Event ID 1000 logs application crashes along with the faulting application path and faulting module.
2
Select the appropriate non-destructive command-line utility
Choose System File Checker (sfc /scannow) to inspect Windows system files.
Since ntdll.dll is an essential Windows component, System File Checker compares current system files against cached, known-good versions.
3
Execute the repair command
System File Checker replaces damaged system binaries without altering user data or requiring OS reinstallation.
This isolates and resolves OS system file corruption efficiently.

Anahtar Kavram

Using System File Checker (sfc /scannow) to resolve Windows application crashes caused by corrupted system binaries.
Soru 2654Soru →

A technician is troubleshooting a Windows 11 workstation where a local database indexing tool crashes during file export operations. Performance Monitor displays an Avg. Disk Queue Length of 8.58.5 on the C:C: drive, with Task Manager indicating 100%100\% Disk Active Time while CPU and Memory utilization remain below 30%30\%. Additionally, Event Viewer logs multiple Event ID 51 (paging operation warning) entries. Which of the following actions should the technician take first to resolve the application crashes?

Cevabı ve açıklamayı göster

Cevap: Run chkdsk C: /r to check for and repair bad physical sectors on the storage drive.

Cevap

Run chkdsk C: /r to check for and repair bad physical sectors on the storage drive.
An Avg. Disk Queue Length continuously above 2.02.0 per drive, combined with 100%100\% Disk Active Time and low CPU/RAM usage, indicates that the storage sub-system is the primary bottleneck. Event ID 51 in Windows Event Viewer explicitly warns of paging operation errors during data transfers between physical RAM and pagefile.sys on disk. Running the command to check and repair bad sectors on the disk identifies bad storage clusters, relocates data, and fixes disk-level read/write failures causing the application crash.

Adım Adım Çözüm

1
Analyze the reported metrics in Performance Monitor and Event Viewer.
An Avg. Disk Queue Length of 8.58.5 (well above the normal threshold of 22 per spindle/drive) combined with 100%100\% Disk Active Time indicates a major storage disk I/O bottleneck. Event ID 51 specifically logs warnings during paging operations between physical RAM and pagefile.sys.
Identifying the bottleneck source prevents unnecessary OS reinstallation or software reconfiguration.
2
Correlate disk queue metrics with application crash symptoms.
When virtual memory requests time out due to disk read/write failures, applications attempting high disk I/O fail to respond and crash.
Paging file corruption or physical bad sectors on the disk block memory allocation, causing the indexing tool to crash.
3
Select the appropriate command-line repair tool for storage hardware sector recovery.
Executing chkdsk C: /r scans the disk surface, locates bad sectors, and attempts to recover readable data from affected sectors.
The /r switch includes all functionality of /f and specifically isolates bad sectors to resolve paging read/write failures.

Anahtar Kavram

Troubleshooting Storage Bottlenecks and Virtual Memory Paging Errors
Soru 2655Soru →

A technician is responding to a malware incident on a workstation at a community medical clinic. The system is showing pop-up warnings and redirecting browser traffic. Place the following remediation actions in the correct sequential order according to the standard CompTIA 7-step malware removal process.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order follows the standard CompTIA 7-step malware removal methodology: 1) Quarantine the infected system, 2) Disable System Restore, 3) Update anti-malware signatures and scan, 4) Re-enable System Restore and create a restore point, and 5) Educate the end user.
The CompTIA standard 7-step malware removal process follows a specific logical sequence: 1) Identify symptoms, 2) Quarantine system, 3) Disable System Restore, 4) Remediate infected systems (update definitions and scan), 5) Schedule updates and scans, 6) Enable System Restore and create restore point, and 7) Educate end user. The items provided map directly to steps 2, 3, 4, 6, and 7 in exact chronological order.

Adım Adım Çözüm

1
Isolate the compromised system from the local environment.
Network communication is terminated, preventing malware spread.
Quarantine (Step 2) must occur before modifying system settings or performing scans.
2
Disable System Restore.
Existing restore points containing malicious files are cleared and new automatic restore points are suspended.
Disabling System Restore (Step 3) ensures malware cannot persist in Windows system restore points.
3
Remediate the infected system.
Anti-malware signatures are updated and malicious payloads are detected and removed.
Updating definitions and scanning (Step 4) removes the active infection from the machine.
4
Re-enable System Restore and create a clean restore point.
System protection is restored using a clean state baseline.
Re-enabling System Restore (Step 6) guarantees future recovery options without reintroducing cleared malware.
5
Conduct end-user training.
The user is informed about security best practices.
End-user education (Step 7) completes the workflow to help prevent future infections.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process
Soru 2656Soru →

A technician is remediating a enterprise workstation where the web browser frequently redirects to unauthorized ad portals and displays intrusive desktop notifications. What is the correct sequence of steps the technician should follow to remediate the web browser configuration?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence is: 1) Disconnect the workstation from the local network to isolate the system, 2) Inspect browser add-ons and uninstall unrecognized or suspicious extensions, 3) Clear the browser cache, cookies, and reset site notification permissions, and 4) Restore the default search engine, home page settings, and browser startup preferences.
The correct remediation sequence begins with system isolation to prevent further remote activity or secondary downloads. Next, the underlying cause of redirect behavior—malicious browser extensions—must be removed. Once the extensions are uninstalled, clearing the browser cache, cookies, and site notification permissions revokes rogue push notification access. Finally, restoring the search engine defaults and home page configuration establishes clean browser operation.

Adım Adım Çözüm

1
Isolate the compromised system from the network.
Stops ongoing data transfer and prevents further malicious script injection or remote adware downloads.
Isolation is the immediate standard practice when dealing with browser hijacking or malware symptoms.
2
Remove unauthorized or malicious browser extensions.
Eliminates the root vector overriding standard search requests and injecting pop-ups.
Extensions often hold persistent control over browser behavior.
3
Purge temporary internet files, tracking cookies, and clear push notification permissions.
Removes existing persistent session tokens and revokes rogue push notification approvals.
Pop-ups are frequently driven by lingering notification permissions and stored site data.
4
Reconfigure search engine defaults and home page settings to corporate standards.
Ensures clean browser launches going forward.
Hijackers frequently modify default search URLs and startup pages.

Anahtar Kavram

Web Browser Security and Hijacker Remediation Workflow
Tahmini Süre:1m 30s
Soru 2657Soru →

A systems administrator is configuring security settings on a standalone Windows workstation placed in a public access area. The administrator must minimize the attack surface by ensuring unauthenticated users cannot gain access using built-in system privileges, while also preventing arbitrary scripts from executing automatically whenever a flash drive is inserted. Which of the following administrative actions best achieves these workstation hardening goals?

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and configure Local Group Policy to disable AutoRun and AutoPlay for all drives.

Cevap

Disable the built-in Guest account and configure Local Group Policy to disable AutoRun and AutoPlay for all drives.
Disabling the built-in Guest account removes a primary default attack vector for unauthenticated users, while disabling AutoRun and AutoPlay via Local Group Policy prevents malicious binaries on inserted USB drives from executing automatically.

Adım Adım Çözüm

1
Identify key hardening requirements from the scenario.
Requirements are blocking unauthorized privilege-less login via built-in default accounts and preventing automated media execution.
Hardening standard images requires disabling unnecessary default accounts and restricting removable media auto-execution vectors.
2
Evaluate technical controls for default accounts.
Disabling the built-in Guest account mitigates unauthorized access attempts.
Built-in Guest accounts provide a known target for unauthorized users if left active.
3
Evaluate technical controls for removable media safety.
Disabling AutoRun and AutoPlay via Group Policy stops unauthorized automatic execution upon device insertion.
AutoRun and AutoPlay allow executable code on USB storage to launch without explicit user authorization.

Anahtar Kavram

Workstation Hardening Principles: Account Disabling and Auto-execution Policy Restrictions
Tahmini Süre:1m 15s
Soru 2658Soru →

A server administrator is planning a hypervisor deployment on a physical host workstation configured with 64 GB64\text{ GB} of RAM. The host operating system and hypervisor core require a baseline allocation of 8 GB8\text{ GB} of RAM, and organizational compliance requires reserving an additional 10%10\% of the total physical RAM for hypervisor dynamic overhead and host stability. If each planned guest virtual machine requires 5 GB5\text{ GB} of dedicated RAM, what is the maximum number of virtual machines that can be concurrently deployed on this host?

Cevabı ve açıklamayı göster

Cevap: 9

Cevap

The maximum number of virtual machines that can be hosted concurrently without exceeding host resource limits is 9.
Subtracting both host core memory (8 GB8\text{ GB}) and dynamic safety overhead (10%10\% of 64 GB=6.4 GB64\text{ GB} = 6.4\text{ GB}) leaves 49.6 GB49.6\text{ GB} of usable RAM for guest workloads. Dividing 49.6 GB49.6\text{ GB} by 5 GB5\text{ GB} per VM yields 9.929.92, which rounds down to 9 fully provisioned virtual machines.

Adım Adım Çözüm

1
Calculate the host dynamic overhead buffer
10%×64 GB=6.4 GB10\% \times 64\text{ GB} = 6.4\text{ GB}
Hypervisors require reserved memory overhead beyond the base operating system requirements to manage VM states safely.
2
Calculate total host RAM requirements
8 GB+6.4 GB=14.4 GB8\text{ GB} + 6.4\text{ GB} = 14.4\text{ GB}
Combines base host OS requirement with the mandatory dynamic buffer overhead.
3
Determine total remaining RAM available for guest virtual machines
64 GB−14.4 GB=49.6 GB64\text{ GB} - 14.4\text{ GB} = 49.6\text{ GB}
Deduct host host dependencies from physical RAM capacity.
4
Calculate maximum VM count and floor to whole unit
⌊49.6 GB/5 GB⌋=⌊9.92⌋=9\lfloor 49.6\text{ GB} / 5\text{ GB} \rfloor = \lfloor 9.92 \rfloor = 9
Virtual machines cannot be provisioned partially; total memory allocation must be fully satisfied per instance.

Anahtar Kavram

Virtual Machine Memory Allocation & Host Overhead Capacity Planning
Tahmini Süre:1m 30s
Soru 2659Soru →

An IT technician is remediating a severe malware infection on a Windows 11 workstation used in a healthcare clinic's billing department. The technician has confirmed the presence of rogue security software, disconnected all network interfaces, and disabled System Restore. When attempting to launch the local anti-malware utility to scan the system, the malicious process immediately forces the security application to close. Which of the following is the NEXT best step the technician should take to remediate the machine?

Cevabı ve açıklamayı göster

Cevap: Boot the workstation into Safe Mode or a pre-installation environment to update definitions and run the scan

Cevap

Boot the workstation into Safe Mode or a pre-installation environment to update definitions and run the scan
When active malware interferes with security tools in standard Windows operational mode, booting into Safe Mode or an isolated pre-installation environment (such as WinPE) prevents third-party malware services and startup hooks from running. This allows the technician to update anti-malware definitions (via USB/offline package) and execute remediation scans successfully as part of Step 4 in the CompTIA removal process.

Adım Adım Çözüm

1
Assess current progress within the CompTIA 7-step malware removal framework
Step 1 (Identify), Step 2 (Isolate), and Step 3 (Disable System Restore) are complete. The technician is performing Step 4 (Remediate infected systems).
Remediation requires updating anti-malware signatures and running scans to remove malicious files.
2
Analyze the barrier preventing standard anti-malware execution
The malware uses active self-defense mechanisms in standard boot mode to kill security software processes.
Rogue software relies on active background services and startup registry entries running in standard user mode.
3
Implement a minimal boot environment to bypass malware persistence
Safe Mode or a WinPE boot environment loads only essential operating system drivers.
Disabling non-essential startup items prevents the malware process from starting, enabling security software to execute scans and clean infected files.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Procedure - Step 4 (Remediate Infected Systems)
Tahmini Süre:2m 0s
Soru 2660Soru →

An IT technician is troubleshooting a Windows 10 desktop computer using legacy BIOS and an MBR partition layout. Following an improper system shutdown caused by a power outage, the computer fails to boot and displays the message 'Missing operating system' on a black screen. The technician boots the system using a Windows installation media flash drive into the Windows Recovery Environment (WinRE) Command Prompt and launches the DiskPart utility. Inspection of the disk reveals that the primary system partition containing the boot loader files is fully intact, but its boot flag status is no longer marked as active. Which command within DiskPart should the technician execute after selecting the primary system partition to restore boot capability?

Cevabı ve açıklamayı göster

Cevap: Execute the active command

Cevap

The technician should execute the active command after selecting the primary system partition in DiskPart.
Executing the active command in DiskPart sets the selected primary partition as the active boot partition. On legacy MBR systems, BIOS inspects the MBR partition table to find the partition marked active, which contains the boot loader code needed to initiate Windows startup.

Adım Adım Çözüm

1
Analyze the boot error symptoms and environment
Identified a legacy MBR system displaying 'Missing operating system' due to a missing active flag on the primary system partition.
Legacy BIOS systems require an MBR partition to be marked as 'active' so the system BIOS knows which partition contains the boot sector code.
2
Navigate DiskPart focus to the correct partition
Selected the target disk and system partition containing boot files.
DiskPart commands apply strictly to the currently focused disk, volume, or partition.
3
Run the active command
The selected partition is marked as active in the Master Boot Record partition table.
Executing the active command configures the partition table so the Master Boot Record can transfer control to the partition's boot sector during startup.

Anahtar Kavram

Legacy MBR Active Partition Configuration
ÖncekiSayfa 133 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin