Tüm alıştırma soruları

3551 soru

Soru 2681Soru

A technician is troubleshooting a Windows 11 workstation where a graphic design application repeatedly crashes whenever a rendering task is initiated. In Event Viewer, the Application log records an Event ID 1000 entry identifying the faulting module as d3d11.dll. Which of the following command-line tools should the technician run FIRST to scan and repair this protected operating system file?

Cevabı ve açıklamayı göster

Cevap: sfc /scannow

Cevap

The technician should execute sfc /scannow from an elevated command prompt.
Executing System File Checker (sfc /scannow) scans all protected Windows system files and replaces corrupted binaries, such as d3d11.dll, with clean copies from the local cached repository.

Adım Adım Çözüm

1
Analyze the crash details provided in Event Viewer.
Event ID 1000 indicates an application crash caused by a specific faulting module, d3d11.dll, which is a core Windows system library file.
Identifying whether the faulting module is a core operating system component or a third-party file determines the correct repair vector.
2
Select the appropriate utility to verify system file integrity.
System File Checker (SFC) scans protected system binaries and replaces corrupted files using the local component store cache.
Executing sfc /scannow is the recommended first repair step when a core Windows system file is flagged as corrupted or faulting.

Anahtar Kavram

System File Corruption Resolution using System File Checker
Soru 2682Soru

An IT security analyst is deploying a virtual machine (VM) on a workstation to analyze untrusted software binaries. The analyst needs to prevent the VM from communicating with the local physical network while ensuring that malicious processes within the guest OS cannot exhaust host physical hardware resources. Which of the following actions should the analyst take? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the virtual network interface card (vNIC) to use Host-Only or Internal network mode.; Set maximum CPU and memory resource limits for the virtual machine within the hypervisor settings.

Cevap

The analyst should set the vNIC to Host-Only or Internal network mode and configure maximum CPU and memory resource limits for the VM in the hypervisor.
Configuring Host-Only or Internal network mode restricts the virtual machine's communication to prevent interaction with physical network devices or the external internet. Enforcing maximum CPU and RAM limits in hypervisor settings ensures that untrusted or malicious software running in the guest operating system cannot exhaust physical host resources.

Adım Adım Çözüm

1
Identify the network isolation requirement
Host-Only or Internal networking isolates the virtual machine from external networks and physical subnet devices.
Bridged networking would place the VM directly on the physical LAN, exposing external devices to untrusted traffic.
2
Identify the host system protection requirement
Configuring explicit CPU and RAM resource caps within hypervisor settings bounds the hardware allocation.
Setting maximum limits prevents malicious processes in the VM from exhausting physical host memory and processor capacity.

Anahtar Kavram

Virtualization Security Considerations and Network Configurations
Tahmini Süre:1m 30s
Soru 2683Soru

A desktop workstation was recently relocated from the Finance department subnet (192.168.10.0/24192.168.10.0/24) to the Marketing department subnet (192.168.20.0/24192.168.20.0/24). A technician manually configured the network adapter with a static IPv4 address of 192.168.20.45192.168.20.45, a subnet mask of 255.255.255.0255.255.255.0, a default gateway of 192.168.10.1192.168.10.1, and a preferred DNS server of 192.168.10.5192.168.10.5. The workstation can ping adjacent computers on the local 192.168.20.0/24192.168.20.0/24 network, but users report they cannot reach internal servers on other subnets or access external internet resources. Which of the following configuration changes will resolve the workstation's reachability issue?

Cevabı ve açıklamayı göster

Cevap: Update the default gateway IPv4 address to an IP address within the 192.168.20.0/24192.168.20.0/24 subnet, such as 192.168.20.1192.168.20.1.

Cevap

Update the default gateway IPv4 address to an IP address within the local 192.168.20.0/24192.168.20.0/24 subnet (e.g., 192.168.20.1192.168.20.1).
For a computer to reach destinations outside its local IP network, it must send traffic to a default gateway router located on its own subnet. Since the computer is on 192.168.20.0/24192.168.20.0/24, its default gateway must also have an IP address within the 192.168.20.0/24192.168.20.0/24 network block (such as 192.168.20.1192.168.20.1). Setting the default gateway to 192.168.10.1192.168.10.1 prevents the host from forwarding off-subnet traffic because the gateway IP address is not directly reachable on the local layer 2 segment.

Adım Adım Çözüm

1
Analyze host IP configuration and local subnet boundary.
The host interface has an IP address of 192.168.20.45192.168.20.45 with a /24/24 mask, placing it on the 192.168.20.0/24192.168.20.0/24 subnet (usable host range 192.168.20.1192.168.20.1 to 192.168.20.254192.168.20.254).
Devices can communicate directly with local hosts on the same subnet without routing.
2
Evaluate the configured default gateway.
The configured default gateway is 192.168.10.1192.168.10.1, which resides on a completely different subnet (192.168.10.0/24192.168.10.0/24).
A host cannot send packets directly to a gateway that does not exist within its local broadcast domain.
3
Determine the required remediation.
Change the default gateway to the local router interface address on the host's subnet (192.168.20.1192.168.20.1).
This allows remote-bound IP packets to be delivered to the local router interface for inter-subnet forwarding.

Anahtar Kavram

Default Gateway Subnet Alignment
Soru 2684Soru

An IT technician is preparing a newly imaged Windows workstation for deployment in a corporate environment. To ensure defense-in-depth and follow workstation hardening best practices, place the following security configuration steps in the correct operational sequence, from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for workstation hardening is: First, install OS security patches. Second, secure built-in accounts and default administrative credentials. Third, disable unnecessary services, ports, and AutoRun features. Fourth, enforce local policy controls such as screen saver password locks and account lockout rules. Fifth, activate host-based firewall protection and enable full disk encryption.
Hardening follows a logical sequence: patching vulnerabilities first, securing baseline user/admin accounts second, minimizing attack surfaces (ports/services/autorun) third, enforcing screen saver lockouts and policy rules fourth, and finalizing with host firewall and full disk encryption protections.

Adım Adım Çözüm

1
Patch OS Vulnerabilities
Known software flaws are remediated prior to network exposure.
System updates prevent initial compromise of baseline software components.
2
Secure Account Baselines
Default administrative entry points are removed.
Disabling the Guest account and altering default admin details removes predictable attack targets.
3
Minimize Attack Surface
Unused communication ports and autorun vulnerabilities are closed.
Disabling unneeded services and automatic execution scripts prevents automated malware execution.
4
Enforce Local Security Policies
Inactivity locks and password lockout protections are active.
Enforcing screen saver timeouts and account lockouts mitigates physical access and brute-force threats.
5
Activate Host Boundary Protections & Encryption
Data at rest and host network traffic are shielded.
Enabling host firewalls and BitLocker completes defense-in-depth protection before full deployment.

Anahtar Kavram

Workstation Hardening Standard Operating Sequence
Soru 2685Soru

A systems technician is servicing a Windows 11 Enterprise workstation controlling an automated warehouse sorting line. The system displays unusual pop-up advertisements, background network latency spikes, and unauthorized registry modifications. The technician has physically disconnected the network cable and disabled all wireless interfaces to isolate the machine. Which TWO of the following tasks must the technician perform NEXT before initiating the full system antimalware scan?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Turn off System Protection (System Restore) to prevent malicious files from being preserved in restore points.; Obtain updated antimalware definition files using a known-clean machine and transfer them to the isolated system via write-protected media.

Cevap

The technician must turn off System Protection (System Restore) and obtain updated antimalware definition files via clean offline media prior to running the antimalware scan.
Following isolation (Step 2), the technician must proceed sequentially to Step 3 (Disable System Restore) so that infected files are not preserved in system restore points. Next, as part of Step 4 (Remediate infected systems), the technician must update antimalware signature files (Step 4a) using offline media before running scans (Step 4b) on the network-isolated machine.

Adım Adım Çözüm

1
Review the CompTIA 7-step malware remediation process sequence.
Identify current status: Step 1 (Identify) and Step 2 (Isolate) are already complete.
Determines the necessary sequential actions.
2
Execute Step 3: Disable System Restore.
Prevents Windows from archiving active malware code within system restore snapshots.
CompTIA standards mandate disabling System Restore before scanning and cleaning.
3
Execute Step 4a: Update antimalware definitions.
Loads current signature files onto the isolated machine using write-protected offline media.
The system cannot access online update servers safely while isolated.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 2686Soru

A desktop technician is setting up a client application to download incoming email from an legacy mail server using unencrypted Post Office Protocol v3 (POP3). Which default port number should be configured in the client settings?

Cevabı ve açıklamayı göster

Cevap: Port 110

Cevap

Port 110 is the default TCP port for unencrypted POP3 incoming email communication.
Port 110 is the default TCP port used by Post Office Protocol v3 (POP3) to download email messages from a mail server without encryption.

Adım Adım Çözüm

1
Identify the protocol and communication direction required by the scenario
Unencrypted incoming mail retrieval using Post Office Protocol v3 (POP3)
The technician needs to connect to the mail server to download messages using unencrypted POP3.
2
Select the standard default port for unencrypted POP3
Port 110
Standard unencrypted POP3 traffic operates over TCP port 110.

Anahtar Kavram

Standard default TCP port assigned to unencrypted Post Office Protocol v3 (POP3) mail retrieval.
Soru 2687Soru

A system administrator is troubleshooting a Windows 11 workstation that experiences severe performance degradation and frequent crashes of a CAD rendering tool during complex rendering tasks. Task Manager shows RAM usage at 96% with heavy disk paging, and Event Viewer shows periodic application failure logs. Which TWO of the following diagnostic actions should the technician perform to isolate the cause of the crashes and performance issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Analyze the process in Resource Monitor using Wait Chain Analysis to determine if threads are waiting on locked resources or deadlocks.; Inspect the Windows Event Viewer Application log for Event ID 1000 entries to identify the faulting module name and exception code.

Cevap

The technician should analyze process threads using Wait Chain Analysis in Resource Monitor and review Event ID 1000 details in the Event Viewer Application log.
Analyzing process threads using Resource Monitor's Wait Chain Analysis determines if the application is waiting on hung dependencies. Checking Event ID 1000 in Event Viewer provides specific details about the faulting module causing the crash.

Adım Adım Çözüm

1
Examine process thread dependencies
Resource Monitor identifies threads waiting on locked resources or child processes.
Wait Chain Analysis helps isolate whether the CAD tool is deadlocked or waiting for system resources.
2
Review crash telemetry details
Event Viewer provides the exact faulting module name and exception code for the application crash.
Event ID 1000 logs contain detailed technical telemetry needed to pinpoint buggy DLLs or application binaries.

Anahtar Kavram

Windows Application Crash and Performance Isolation Tools
Tahmini Süre:1m 30s
Soru 2688Soru

A tier-1 desktop technician is dispatched to handle an enterprise Windows 11 workstation that has been infected with rogue software generating persistent security alerts and attempting unauthorized network transmissions. Place the following remediation steps in the exact sequence required by the standard CompTIA 7-step malware removal procedure.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence for remediating the infected system according to the CompTIA 7-step malware removal process is: 1. Unplug physical network connections (Isolate system) -> 2. Disable System Protection (Disable System Restore) -> 3. Boot into Safe Mode and run anti-malware scans (Remediate system) -> 4. Configure automated recurring scans and updates (Schedule scans/updates) -> 5. Re-enable System Protection and create a fresh baseline restore point (Enable System Restore).
The CompTIA standard 7-step malware removal process follows a strict linear sequence: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware software; scan and use removal techniques), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate end users. Disconnecting network interfaces isolates the host (Step 2), followed by disabling System Restore to clear infected shadow copies (Step 3). System remediation via Safe Mode anti-malware scans follows (Step 4), after which automated update/scan routines are scheduled (Step 5). Finally, System Restore is safely re-enabled to establish a clean baseline point (Step 6).

Adım Adım Çözüm

1
Isolate the infected machine from the network.
Network communication is halted, containing malware propagation.
Isolation must occur immediately after identifying symptoms to protect adjacent network infrastructure.
2
Disable System Restore / System Protection.
All existing restore points containing latent malicious files are removed.
If System Restore remains enabled, infected system files stored within restore points can cause reinfection after cleanup.
3
Remediate the infected system using anti-malware tools.
Malware files, registry keys, and processes are detected and removed.
Remediation requires updating definitions and running thorough scans, often in Safe Mode to prevent active process tampering.
4
Schedule automatic scans and verify software updates.
System defensiveness is reinforced against prospective threat variants.
Establishing automated scan schedules ensures ongoing proactive monitoring and patch compliance.
5
Enable System Restore and create a clean restore point.
A reliable, uncorrupted recovery baseline is established.
System Restore must only be re-enabled after complete verification of malware removal to ensure the newly created restore point is uninfected.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 2689Soru

A network administrator is deploying a virtual machine (VM) on a desktop computer to run a network management service. The service requires the VM to obtain its own IP address directly from the physical network's DHCP server and be fully accessible by other physical devices on the local subnet. Which virtual network adapter mode should the administrator configure?

Cevabı ve açıklamayı göster

Cevap: Bridged mode

Cevap

Bridged mode should be configured because it binds the virtual adapter directly to the physical network adapter, enabling the guest virtual machine to receive an IP address from the physical DHCP server and communicate as an independent host on the physical subnet.
Bridged mode creates a direct connection between the virtual network interface card (vNIC) and the physical host's network interface card (NIC). This allows the virtual machine to operate as an independent device on the physical network, obtaining its own IP address from the physical network's DHCP server and accepting incoming connections from physical network hosts.

Adım Adım Çözüm

1
Analyze the virtual machine networking requirements
The virtual machine must obtain an IP address from the external physical DHCP server and allow direct inbound access from physical network hosts.
Different virtual network modes establish distinct boundaries between the guest operating system, host operating system, and physical network.
2
Evaluate Bridged mode functionality
Bridged mode connects the virtual network adapter directly to the physical network interface layer.
This allows the virtual machine to participate directly on the physical network, request an IP address via DHCP, and receive direct incoming traffic.
3
Eliminate non-matching networking modes
NAT translates traffic behind host IP, while Host-only and Internal modes isolate traffic from the physical network entirely.
None of the isolated or address-translated modes satisfy the requirement for direct physical network visibility and DHCP lease allocation.

Anahtar Kavram

Virtual Network Adapter Modes (Bridged vs. NAT vs. Host-Only vs. Internal)
Tahmini Süre:1m 0s
Soru 2690Soru

A systems technician is configuring security hardening settings on newly deployed Windows workstations used in a retail environment as point-of-sale terminals. To reduce the system's attack surface and prevent unauthorized automated execution of malicious files from USB flash drives, which of the following administrative actions should the technician perform?

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and configure the Group Policy setting to turn off AutoPlay for all drives.

Cevap

Disable the built-in Guest account and configure the Group Policy setting to turn off AutoPlay for all drives.
Disabling default built-in accounts (such as the Guest account) eliminates unnecessary access pathways into the operating system. Disabling AutoPlay/AutoRun via Group Policy prevents Windows from automatically executing software stored on inserted USB drives, protecting the workstation from autorun-based malware.

Adım Adım Çözüm

1
Identify the key security goals from the scenario: reducing attack surface by removing unused access points and preventing automatic execution of media on USB drives.
Recognized that disabling default local accounts and disabling AutoPlay are standard OS hardening controls.
Default accounts like Guest provide unauthenticated local access, and AutoPlay poses a risk of malware auto-execution from removable storage.
2
Evaluate the available administrative policies and security configurations.
Disabling the Guest account stops unauthorized access, and setting the Group Policy to turn off AutoPlay for all drives blocks automatic execution of scripts or binaries when USB devices are attached.
These controls directly mitigate the threats mentioned in the requirement.

Anahtar Kavram

Workstation Hardening Best Practices - Account Management and AutoPlay Policies
Soru 2691Soru

An IT support technician is deploying networked smart HVAC controllers throughout a company's corporate office. The embedded operating systems on these controllers cannot support third-party endpoint security software, centralized domain joining, or local user credential management. Which of the following security practices should the technician implement to BEST secure these embedded systems against unauthorized network access?

Cevabı ve açıklamayı göster

Cevap: Place the embedded controllers on a dedicated, isolated VLAN with restrictive firewall rules

Cevap

Place the embedded controllers on a dedicated, isolated VLAN with restrictive firewall rules
Embedded systems and IoT devices often lack hardware resources or software support for standard endpoint protection and administrative agents. Placed on an isolated Virtual Local Area Network (VLAN) with strict firewall rules, these devices can perform necessary network functions without exposing the rest of the enterprise network to pivoting attacks if compromised.

Adım Adım Çözüm

1
Analyze the device constraints described in the scenario
Identified that the HVAC controllers run lightweight embedded operating systems that lack support for security agents, domain joining, or traditional endpoint management.
Embedded systems frequently have resource constraints and fixed firmware that prevent installing standard security controls directly on the device.
2
Evaluate network-level mitigation techniques for unmanageable embedded systems
Determined that network segmentation (isolated VLANs and strict Access Control Lists) provides defense-in-depth.
Isolating embedded devices contains potential security breaches and prevents lateral movement into critical corporate network segments.

Anahtar Kavram

Embedded System Hardening and Network Segmentation
Soru 2692Soru

A network administrator detects unauthorized outbound IRC traffic originating from a Windows 11 telemetry workstation located in a remote weather research facility. The administrator successfully disconnects the workstation's network interface and isolates the machine locally. Which action should be performed NEXT in accordance with the standard malware removal procedure before downloading signature updates via out-of-band media and running remediation scans?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows

Cevap

Disable System Restore in Windows
Following the compulsory CompTIA 7-step malware remediation process (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate, 5. Schedule scans/updates, 6. Enable System Restore and create restore point, 7. Educate end user), after isolating the infected computer (Step 2), the technician must immediately disable System Restore (Step 3). Disabling System Restore deletes existing restore points, ensuring malicious files are not backed up or inadvertently restored later.

Adım Adım Çözüm

1
Identify malware symptoms
Unauthorized IRC background traffic identified.
Establishes that the system is compromised by malicious software.
2
Isolate the infected system
Network interface disabled, preventing command-and-control communication.
Prevents lateral movement across the network and data exfiltration.
3
Disable System Restore
System Protection is turned off and existing restore points are purged.
Prevents malicious binaries from being backed up into System Restore archives or restored post-remediation.
4
Remediate infected system
Update antimalware definitions offline and run full system scans.
Cleans the operating system of detected malware threats.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure - Step 3 (Disable System Restore)
Soru 2693Soru

A network administrator is configuring virtual networking settings for multiple virtual machines (VMs) deployed on a hypervisor host. Match each virtual network interface card (vNIC) mode on the left with its corresponding network access requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Bridged Mode
Network Address Translation (NAT) Mode
Host-Only Mode
Internal / Private Mode

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Bridged Mode pairs with direct physical subnet access and unique IP assignment; NAT Mode pairs with outbound external access using host IP address translation; Host-Only Mode pairs with restricted communication between guest VMs and host OS only; Internal / Private Mode pairs with complete network isolation restricted strictly to inter-VM communication.
Each virtual networking mode defines specific communication boundaries between the guest VM, the hypervisor host OS, and external physical networks. Bridged mode treats the VM as an independent entity on the physical subnet. NAT mode uses host address translation for outbound requests. Host-Only mode limits traffic to the host and local VMs. Internal mode restricts traffic exclusively to local VMs on the host.

Adım Adım Çözüm

1
Analyze physical local area network integration requirements.
Identify that Bridged Mode connects the VM's vNIC directly to the physical adapter, giving it a separate IP address on the physical LAN.
Bridged networking allows the VM to participate as a full peer node on the physical network.
2
Analyze outbound routing and host protection requirements.
Identify that NAT Mode routes traffic using the host IP address.
NAT mode provides internet connectivity to guest VMs while preventing unsolicited inbound traffic from reaching the VM directly.
3
Evaluate host-to-guest isolated communication requirements.
Identify that Host-Only Mode connects the VM to a virtual switch accessible only by the host OS and other VMs on that switch.
Host-Only mode blocks external physical network connectivity while maintaining access for administrative management from the host.
4
Evaluate sandbox or strictly inter-VM isolation requirements.
Identify that Internal / Private Mode completely isolates traffic to connected VMs only.
Internal networking prevents any traffic from reaching the host OS or external network, creating a secure environment for testing or multi-tier VM communication.

Anahtar Kavram

Virtual Network Adapter Operating Modes and Isolation Boundaries
Soru 2694Soru

A desktop technician is configuring local security settings on newly provisioned standalone Windows workstations for a financial call center. The security baseline requires mitigating credential-based attacks targeting default accounts and restricting unauthorized incoming network traffic without disabling essential management access. Which TWO configuration settings should the technician implement to meet these hardening requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and rename the local Administrator account.; Enable Windows Defender Firewall and configure the active profile to block all inbound connections by default.

Cevap

The technician should disable the built-in Guest account and rename the local Administrator account, as well as enable Windows Defender Firewall and configure the active profile to block all inbound connections by default.
Disabling default built-in accounts such as Guest and renaming the default Administrator account eliminates well-known targets for brute-force attacks. Simultaneously, enforcing an inbound block rule on the host firewall minimizes network attack vectors.

Adım Adım Çözüm

1
Identify baseline account hardening requirements.
Disabling the Guest account and renaming the Administrator account mitigates brute-force attacks aimed at predictable default account names.
Default accounts with well-known SIDs are primary targets for automated reconnaissance and privilege escalation attempts.
2
Identify network-level workstation hardening controls.
Enabling the host firewall to block unsolicited inbound connections hardens the network stack.
Blocking inbound connections by default reduces vulnerable open ports and prevents unauthorized lateral movement or probing.
3
Evaluate and eliminate incorrect management options.
Discard setting UAC to 'Never Notify' and using Event Viewer for policy edits.
Lowering UAC weakens security, and Event Viewer is a log viewer rather than a security configuration tool.

Anahtar Kavram

Workstation Hardening via Account Restructuring and Host Firewall Configuration
Soru 2695Soru

An IT security analyst is establishing security baseline controls for enterprise mobile devices and embedded systems. Match each mobile or embedded security technology to its primary operational capability.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Geofencing
Containerization
Remote Wipe
Secure Boot

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Geofencing matches with location-based policy enforcement; Containerization matches with isolating corporate apps on BYOD devices; Remote Wipe matches with issuing an over-the-air command to sanitize data; Secure Boot matches with cryptographically authenticating firmware signatures prior to OS initialization.
Each listed term directly aligns with its fundamental security function: Geofencing manages location-based parameters, Containerization isolates corporate data on BYOD devices, Remote Wipe provides loss mitigation via over-the-air erasure, and Secure Boot guarantees low-level firmware integrity.

Adım Adım Çözüm

1
Identify the technology used to enforce location-aware security policies on mobile endpoints.
Pair Geofencing with restricting device features based on physical location.
Geofencing relies on geographic coordinates to trigger or block specific features.
2
Identify the storage and application isolation mechanism used for BYOD environments.
Pair Containerization with isolating corporate applications and data in an encrypted workspace.
Containerization ensures corporate assets remain segregated from personal data.
3
Determine the administrative capability used when a mobile device is reported lost or stolen.
Pair Remote Wipe with issuing an over-the-air command to sanitize endpoint storage.
Remote wipe clears sensitive data over the network to prevent data exposure.
4
Identify the embedded hardware verification feature that prevents malicious firmware execution.
Pair Secure Boot with cryptographically authenticating firmware and bootloader signatures.
Secure Boot establishes a hardware root of trust to verify software integrity before booting.

Anahtar Kavram

Mobile Device and Embedded System Security Controls
Soru 2696Soru

A user reports that a newly installed graphics editing application crashes immediately upon launch on a Windows 11 workstation. The technician opens Event Viewer and identifies an Event ID 1000 (Application Error) entry in the Application log, identifying `msvcr120.dll` as the faulting module name. System File Checker (`sfc /scannow`) completes successfully with no integrity violations detected. Which of the following is the MOST appropriate next step to resolve the application crash?

Cevabı ve açıklamayı göster

Cevap: Reinstall or repair the Microsoft Visual C++ Redistributable package associated with the faulting DLL

Cevap

Reinstall or repair the Microsoft Visual C++ Redistributable package associated with the faulting DLL.
Event ID 1000 in the Windows Application log indicates an application crash. When the faulting module is a dynamic-link library such as `msvcr120.dll`, it signifies a missing or corrupted Microsoft Visual C++ Redistributable file. Reinstalling or repairing the appropriate redistributable package restores the necessary DLL for application execution.

Adım Adım Çözüm

1
Analyze the Event Viewer crash log details
Event ID 1000 confirms an application crash, and the faulting module `msvcr120.dll` points directly to a C++ runtime dependency rather than core Windows files.
Identifying the faulting module narrows down the crash source to a specific shared library component.
2
Evaluate prior troubleshooting results
Since `sfc /scannow` found no errors, core Windows operating system files are intact.
This rules out OS file corruption and confirms the issue is localized to application-level software libraries.
3
Apply targeted remediation
Repairing or reinstalling the corresponding Microsoft Visual C++ 2013 Redistributable package restores the missing or damaged `msvcr120.dll` library file.
Replacing the specific corrupted library allows the application to initialize successfully.

Anahtar Kavram

Application Crash Isolation and Runtime Library Resolution
Soru 2697Soru

A tier-2 helpdesk technician at an electric vehicle charging network operations center is responding to an infected Windows 11 workstation that has already been disconnected and quarantined from the local network. The technician needs to prepare the system for malware removal. According to the standard CompTIA malware remediation process, which TWO of the following actions should the technician perform NEXT before initiating a full system anti-malware scan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in the Windows System Properties settings.; Update anti-malware signature definitions to the latest engine release.

Cevap

The technician should disable System Restore and update anti-malware definitions.
Following the CompTIA 7-step malware remediation process, once a system is quarantined (Step 2), the technician must disable System Restore (Step 3) to prevent the OS from creating infected restore points. The next phase is remediation (Step 4), which begins by updating anti-malware signatures (Step 4a) prior to initiating a scan (Step 4b).

Adım Adım Çözüm

1
Analyze current progress in the CompTIA 7-step malware remediation process.
Step 1 (Identify malware) and Step 2 (Quarantine infected system) are complete.
The scenario states the workstation has already been identified as infected and quarantined from the network.
2
Identify the immediate next steps (Step 3 and Step 4a).
Step 3 is disabling System Restore. Step 4a is updating anti-malware signatures.
Disabling System Restore prevents infected files from being saved into restore points, and updating anti-malware signatures guarantees that the scanner has the newest threat signatures available.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Soru 2698Soru

A software developer configures a virtual machine (VM) on a local workstation to run software integration tests. The VM requires outbound access to the internet to download update packages, but it must not be directly accessible as an independent device on the physical corporate network to prevent exposing the local subnet to test traffic. Which virtual network interface configuration should be applied to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Network Address Translation (NAT) mode

Cevap

Network Address Translation (NAT) mode is the correct configuration because it enables the virtual machine to access external internet resources by utilizing the host computer's IP address while remaining unreachable from direct inbound network traffic originating on the physical local area network.
Network Address Translation (NAT) mode provides outbound internet connectivity by translating the virtual machine's private virtual IP address into the host system's IP address. This allows the guest VM to initiate outbound web connections while protecting the physical network from direct incoming connections initiated toward the VM.

Adım Adım Çözüm

1
Analyze the network access requirements of the virtual machine.
The virtual machine requires outbound access to download files from the internet.
Software updates and dependency downloads require internet reachability.
2
Analyze the security isolation constraints.
The virtual machine must not appear as an independent physical host on the local area network.
Direct placement on the physical subnet exposes local network devices to potential test traffic and security risks.
3
Compare virtual network adapter modes against the criteria.
NAT mode satisfies both outbound internet access and local network isolation by sharing the host IP address via network address translation.
NAT routes outgoing traffic through the host's network card while hiding the VM's internal virtual IP from incoming external traffic.

Anahtar Kavram

Virtual Machine Network Interface Modes (NAT vs. Bridged vs. Host-Only)
Tahmini Süre:1m 15s
Soru 2699Soru

An IT technician is responding to a confirmed malware infection on a Windows 11 workstation operating inside a pharmaceutical cleanroom environment. The technician has already identified the symptoms and isolated the workstation from the facility network by disconnecting its Ethernet cable. According to standard CompTIA malware removal procedures, which of the following actions should the technician perform NEXT before initiating full antimalware scanning and remediation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Protection (System Restore) on the affected system.; Obtain the latest antimalware definition files using a clean computer and transfer them to the isolated system.

Cevap

The technician should disable System Protection (System Restore) and obtain updated antimalware definitions using an uninfected computer via offline media.
According to CompTIA standard malware remediation procedures, after identifying symptoms (Step 1) and isolating the system (Step 2), the technician must disable System Restore (Step 3) to prevent infected files from being saved into backup restore points. Next, as part of remediation (Step 4), the technician must update antimalware definitions; since the device is isolated, definitions should be downloaded on an uninfected machine and transferred offline.

Adım Adım Çözüm

1
Identify the current stage within the CompTIA 7-step malware removal model.
The technician has completed Step 1 (Identify malware symptoms) and Step 2 (Isolate infected system).
Establishing what has already been accomplished clarifies which steps must follow in sequence.
2
Determine Step 3 of the malware removal procedure.
Step 3 requires disabling System Restore in Windows.
This prevents malicious binaries from being stored in shadow copies or system restore points during remediation.
3
Determine the initial phase of Step 4 (Remediate infected systems).
Step 4a requires updating antimalware software definitions.
Because the system is isolated from the network, definition files must be retrieved on an uninfected system and transferred via removable media to maintain isolation prior to scanning.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Workflow (Steps 3 and 4a)
Soru 2700Soru

An IT security technician is establishing baseline OS hardening parameters for new workstations deployed in an enterprise accounting department. To reduce the system's attack surface and prevent unauthorized remote modification of system configuration settings without impacting standard domain functionality, which of the following actions should the technician perform?

Cevabı ve açıklamayı göster

Cevap: Disable the Remote Registry service and set its startup type to Disabled.

Cevap

Disable the Remote Registry service and set its startup type to Disabled.
Disabling the Remote Registry service is an essential workstation hardening practice. It ensures remote network users cannot modify system configuration keys in the Windows Registry, effectively shrinking the vulnerable surface area of the host OS.

Adım Adım Çözüm

1
Analyze the security objective in the scenario
The requirement is to prevent unauthorized remote configuration modifications while reducing unnecessary listening services on the host.
System hardening principles emphasize disabling unneeded background services to minimize attack vectors.
2
Identify unnecessary background services that expose system configuration
The Remote Registry service allows remote network users to edit registry keys.
If left enabled, malicious actors could modify registry entries remotely over the network.
3
Apply the appropriate baseline security hardening action
Stopping the service and configuring its startup type to Disabled prevents unauthorized remote registry changes.
Disabling unneeded network-facing services is a standard OS baseline hardening task.

Anahtar Kavram

Disabling Unnecessary Services during Workstation Hardening
Tahmini Süre:1m 30s
ÖncekiSayfa 135 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin