Tüm alıştırma soruları

3551 soru

Soru 2701Soru

After a system crash, a user restarts a Windows 10 desktop and receives a black screen with the error message 'Invalid partition table'. A technician boots the workstation into the Windows Recovery Environment (WinRE) command prompt to repair the Master Boot Record (MBR) and restore the boot configuration settings. Which TWO commands should the technician execute to resolve this specific boot issue? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: bootrec /fixmbr; bootrec /rebuildbcd

Cevap

The technician should run bootrec /fixmbr to repair the corrupted Master Boot Record structure and bootrec /rebuildbcd to scan for Windows installations and rebuild the Boot Configuration Data store.
The 'Invalid partition table' error occurs when the Master Boot Record boot code or partition table references are corrupted. Running 'bootrec /fixmbr' writes a valid Windows-compatible MBR to the system partition without altering existing partition structures. Following up with 'bootrec /rebuildbcd' ensures that any missing or unreferenced Windows OS installations are identified and incorporated into the Boot Configuration Data repository, allowing proper boot continuation.

Adım Adım Çözüm

1
Boot into WinRE and access the Command Prompt interface.
Access to offline command line recovery tools is established.
System partition modifications cannot be performed while the corrupted operating system attempts to boot.
2
Execute bootrec /fixmbr.
A master boot record compatible with Windows 10 is written to the system disk.
This directly resolves the 'Invalid partition table' error caused by corrupted MBR boot code.
3
Execute bootrec /rebuildbcd.
The Windows installations on the disk are detected and added back to the BCD store.
Rebuilding the BCD ensures that the Windows Boot Manager can locate and load the OS kernel successfully.

Anahtar Kavram

Master Boot Record (MBR) and Boot Configuration Data (BCD) Recovery in WinRE
Soru 2702Soru

An IT technician is troubleshooting a Windows workstation that crashes with a stop error (BSOD) during the boot sequence immediately following a recent driver update. Automatic Repair is unable to fix the issue, and normal boot fails consistently. The technician opens the Command Prompt inside the Windows Recovery Environment (WinRE) to isolate and disable the problematic driver. Which of the following commands should the technician execute to configure the Operating System to launch into Safe Mode on the next system restart?

Cevabı ve açıklamayı göster

Cevap: bcdedit /set {default} safeboot minimal

Cevap

Execute the command 'bcdedit /set {default} safeboot minimal' from the WinRE command prompt to force Windows into Safe Mode on the next boot.
Configuring the BCD store with 'bcdedit /set {default} safeboot minimal' forces the OS to start in Safe Mode. Safe Mode loads minimal essential drivers, allowing the technician to access Device Manager or Apps & Features to roll back or remove the malfunctioning third-party driver.

Adım Adım Çözüm

1
Identify the troubleshooting goal in WinRE
The goal is to force the workstation into Safe Mode so third-party kernel drivers are bypassed during startup.
Safe Mode loads a minimal set of drivers and services, preventing the faulty driver from causing a blue screen.
2
Select the proper command-line utility for boot configuration settings
Use BCDEdit (Boot Configuration Data Editor) to modify boot parameters.
BCDEdit manages the boot settings store in modern Windows operating systems.
3
Apply the appropriate parameter switch
Run 'bcdedit /set {default} safeboot minimal'.
Setting the safeboot option to minimal instructs the bootloader to load the standard Safe Mode environment upon reboot.

Anahtar Kavram

Configuring Boot Configuration Data (BCD) flags via BCDEdit in WinRE to troubleshoot startup driver crashes
Soru 2703Soru

A user reports that a video rendering application unexpectedly closes with memory allocation errors on a Windows 11 workstation during high-load processing. Place the following troubleshooting steps in the correct logical order for a technician to isolate the root cause and resolve the performance crash.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins by observing real-time memory usage in Task Manager, checking Event Viewer System logs for Event ID 2004 resource exhaustion entries, inspecting the paging file configuration in Advanced System Properties, and finally reconfiguring the virtual memory to be automatically managed followed by a system reboot.
The correct troubleshooting workflow follows standardCompTIA methodology: first observe live performance metrics in Task Manager during symptom reproduction, second confirm diagnostic log evidence in Event Viewer (Event ID 2004 for resource exhaustion), third inspect the relevant control tool (Paging file settings in Advanced System Properties), and fourth apply the corrective change by enabling system-managed paging file sizing and restarting.

Adım Adım Çözüm

1
Monitor real-time system resource metrics in Task Manager.
Identifies immediate resource bottlenecks and confirms whether physical RAM utilization spikes to 100% during the workload.
Live diagnostic observation is the first step in verifying user-reported symptoms before modifying configuration settings.
2
Analyze historical system event logs in Event Viewer.
Locates Event ID 2004 logs generated by the Resource-Exhaustion-Detector, confirming virtual memory exhaustion.
Corroborating live observations with system logs verifies that Windows was unable to allocate virtual memory.
3
Inspect virtual memory settings in Advanced System Properties.
Reveals whether the paging file is set too low, disabled, or locked to a static custom size.
Checking configuration settings allows the technician to pinpoint misconfigured paging parameters causing the crash.
4
Apply virtual memory remediation and restart the computer.
Enables Windows to dynamically expand the page file on disk as memory demand increases during rendering operations.
Reconfiguring to system-managed paging file size directly resolves virtual memory allocation limits.

Anahtar Kavram

Troubleshooting Virtual Memory Exhaustion and Application Performance Crashes
Soru 2704Soru

A cybersecurity technician is setting up a dedicated virtual machine (VM) on a host workstation to download security updates from an external public repository. To maintain security, the VM must be allowed outbound internet access while preventing direct IP connectivity to other corporate devices on the local physical network. Additionally, host security measures must prevent the guest VM from consuming excessive physical host resources during large downloads. Which of the following actions should the technician take to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the virtual network adapter to use Network Address Translation (NAT) mode.; Implement resource limits and caps on the hypervisor for CPU and RAM allocation to the guest VM.

Cevap

The correct configurations are setting the virtual network adapter to Network Address Translation (NAT) mode and enforcing hypervisor resource limits on CPU and RAM for the guest VM.
Selecting Network Address Translation (NAT) mode grants the guest virtual machine outbound internet connectivity by masking its traffic behind the host system's IP address, keeping it separated from the rest of the local physical network. Additionally, configuring explicit hypervisor resource limits (such as capping maximum RAM and CPU core usage) protects the host machine from Denial of Service or instability caused by compromised or intensive guest processes.

Adım Adım Çözüm

1
Analyze network isolation and outbound connectivity requirements
NAT mode provides guest outbound internet access while hiding the guest behind the host's IP, preventing direct Layer 2/3 inbound traffic from the local corporate LAN.
Bridged mode exposes the guest directly to the physical LAN, whereas Host-Only or Internal modes prevent internet access completely.
2
Analyze hypervisor security and host protection controls
Applying resource quotas (CPU and RAM caps) prevents resource exhaustion attacks or runaway guest processes on the host hardware.
Unrestricted resource allocation allows guest processes to consume physical RAM and CPU cycles, causing Denial of Service to the host system.

Anahtar Kavram

Virtual Machine Isolation and Hypervisor Resource Controls
Tahmini Süre:1m 30s
Soru 2705Soru

A cybersecurity technician at a commercial maritime container terminal is troubleshooting a Windows 11 workstation used for crane operations. The workstation is displaying rogue pop-up advertisements and experiencing unauthorized browser redirects. The technician has already isolated the workstation from the local network to quarantine it and has disabled System Restore. Which of the following actions should the technician perform NEXT according to the standard CompTIA malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware software engine and signature definitions.

Cevap

Update the anti-malware software engine and signature definitions.
According to the official CompTIA 7-step malware remediation workflow, once the malware symptoms have been identified, the system quarantined, and System Restore disabled, the technician must enter Step 4 (Remediate infected systems). Step 4 is subdivided into updating anti-malware software definitions first (Step 4a) and then running malware scans and removal tools second (Step 4b). Updating the definitions ensures the scanner has the most current detection signatures.

Adım Adım Çözüm

1
Review the current phase within the CompTIA 7-step malware remediation process.
Identified that Step 1 (Identify symptoms), Step 2 (Quarantine system), and Step 3 (Disable System Restore) have already been completed.
Determines which step comes next in the strict sequential workflow.
2
Identify the immediate next requirement in Step 4 (Remediate infected systems).
Step 4a is to update anti-malware software and signature definitions (via removable media or isolated environment update package if network access is restricted).
Anti-malware software requires the latest threat signatures to effectively detect and quarantine modern malware strains during the scan phase.
3
Select the option that matches updating signature definitions prior to scanning.
Selected 'Update the anti-malware software engine and signature definitions.'
This strictly adheres to standard remediation procedures before performing scans or re-enabling system services.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process (Step 4a: Update anti-malware signatures)
Tahmini Süre:1m 0s
Soru 2706Soru

A desktop support specialist is servicing a dedicated CAD engineering workstation in a manufacturing plant. The machine was disconnected from the network immediately after exhibiting severe performance degradation and launching unauthorized processes. The technician has confirmed the presence of active malware and successfully disabled System Restore. According to standard CompTIA malware removal procedures, which of the following actions should the technician perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Update the antimalware definition files using a verified external medium, then perform a comprehensive system scan.

Cevap

Update the antimalware definition files using a verified external medium, then perform a comprehensive system scan.
Following the CompTIA 7-step malware remediation process (Identify, Isolate, Disable System Restore, Remediate, Schedule scans/updates, Enable System Restore/Create restore point, Educate user), after disabling System Restore, the technician enters the Remediate phase. This requires updating the antimalware software and definitions—using clean offline media since the machine is network-isolated—and executing thorough scans to remove the threat.

Adım Adım Çözüm

1
Analyze the current state within the CompTIA 7-Step Malware Removal process.
The technician has already identified the symptoms (Step 1), isolated the system (Step 2), and disabled System Restore (Step 3).
Tracking progress through the framework determines the exact next procedural phase.
2
Identify the next required step in the standard procedure.
Step 4 is Remediate Infected Systems, which consists of updating antimalware signatures and executing scans/removal techniques.
Remediation requires fresh definition signatures applied in a safe environment (such as offline updates via clean media) to ensure all threat variants are detected without breaking isolation.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure - Remediation Phase
Soru 2707Soru

An IT technician is establishing standard security hardening configurations across enterprise desktops. Match each workstation security control on the left with the primary risk mitigation it provides on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Disabling unnecessary background services and open network ports
Configuring an aggressive screen lock timeout policy
Disabling the built-in Guest user account
Disabling Autorun and Autoplay features

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Disabling unnecessary services and ports matches reducing the system attack surface. Configuring a screen lock timeout matches mitigating unauthorized access to unattended desktop sessions. Disabling the Guest account matches preventing unauthenticated logons using default local credentials. Disabling Autorun/Autoplay matches preventing automatic execution of malicious payloads upon inserting external storage media.
Each hardening control directly addresses a specific vulnerability vector: disabling unnecessary services minimizes overall network entry points; screen lock timeouts protect against physical access to unattended active sessions; turning off the Guest account eliminates default unauthenticated logon access; and disabling Autorun prevents drive-by execution of malware from attached removable media.

Adım Adım Çözüm

1
Analyze service and port management controls
Turning off unneeded system services closes corresponding network ports and listening sockets.
Closing unused open entry points directly decreases the exposed attack surface of the OS.
2
Analyze desktop inactivity policies
Setting screen lock timeouts requires password re-entry after specified minutes of idle time.
Protects active user contexts when a physical workspace is left unattended.
3
Analyze account security controls
Disabling built-in default accounts neutralizes known account targets that do not require complex setup.
Prevents unauthenticated users from leveraging default Guest privileges for network or local access.
4
Analyze media execution policies
Turning off Autorun and Autoplay prevents OS auto-execution triggers.
Blocks flash drives or optical media from running startup scripts automatically upon insertion.

Anahtar Kavram

Workstation Hardening and Best Practices
Soru 2708Soru

A technician is using the Command Prompt in the Windows Recovery Environment (WinRE) to repair a legacy BIOS/MBR system that fails to boot after unexpected disk corruption. Place the following boot recovery commands in the correct sequential order to repair the Master Boot Record, partition boot sector, scan for Windows installations, and rebuild the boot configuration data.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with repairing the Master Boot Record (bootrec /fixmbr), followed by writing a new boot sector (bootrec /fixboot), scanning for Windows installations (bootrec /scanos), and finally rebuilding the Boot Configuration Data (bootrec /rebuildbcd).
The recovery process must logically proceed from low-level disk structures to higher-level OS configuration stores. First, bootrec /fixmbr fixes the disk's Master Boot Record. Second, bootrec /fixboot repairs the active partition boot sector. Third, bootrec /scanos identifies installed Windows systems. Fourth, bootrec /rebuildbcd reconstructs the Boot Configuration Data database and adds missing Windows entries.

Adım Adım Çözüm

1
Repair the MBR code
System partition MBR code is replaced with compatible Windows boot code.
The MBR contains the master boot code executed by legacy BIOS to find the active partition.
2
Repair the Partition Boot Sector
A new boot sector compatible with the Windows system is written.
The partition boot sector is called by the MBR to locate and run bootmgr.
3
Scan for OS installations
All disks are scanned for Windows installations compatible with the current OS.
Scanning identifies valid OS entries that need to be cataloged for boot loading.
4
Rebuild the BCD Store
The Boot Configuration Data store is completely rebuilt and updated.
Rebuilding the BCD incorporates identified OS installations into the boot menu choices.

Anahtar Kavram

Sequential repair of Windows legacy boot components using bootrec switches in WinRE
Soru 2709Soru

A desktop support technician at a regional meteorology research institute discovers that a Windows workstation used for weather radar monitoring has been infected with a rootkit trojan. The technician needs to execute the standard CompTIA seven-step malware remediation process. Place the following remediation steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the CompTIA 7-step malware remediation process: 1. Isolate the infected workstation (Quarantine), 2. Disable Windows System Restore, 3. Update anti-malware signatures and perform a full scan (Remediate), 4. Re-enable System Restore and create a clean restore point, 5. Train the user on security best practices (Educate user).
The correct order strictly follows the standard CompTIA malware removal procedure: Step 2 (Quarantine/Isolate), Step 3 (Disable System Restore), Step 4 (Remediate by updating definitions and scanning), Step 6 (Enable System Restore and create a restore point), and Step 7 (Educate the end user).

Adım Adım Çözüm

1
Identify and Quarantine the System
Workstation is isolated from the network to stop lateral movement.
Quarantining the system immediately follows identification.
2
Disable System Restore
Infected restore points are deleted so malware cannot reinfect the system via system recovery.
System Restore must be disabled before running cleanup tools.
3
Remediate the System
Anti-malware signatures are updated and scans remove the rootkit.
Remediation involves updating definitions and executing scan and removal techniques.
4
Enable System Restore and Create a Restore Point
A fresh, uninfected baseline restore point is established.
System Restore is re-enabled only after confirming the system is clean.
5
Educate the End User
User learns how the infection occurred and how to prevent recurrence.
User education is always the final step in standard malware remediation.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Soru 2710Soru

A helpdesk technician is setting up a client-side virtual machine (VM) on a workstation to host a legacy database application. The application requires its own dedicated identity on the physical network, including obtaining an IP address lease directly from the company's physical DHCP server so that other physical clients on the local subnet can communicate with it directly. Which virtual network interface card (vNIC) mode should the technician configure for this VM?

Cevabı ve açıklamayı göster

Cevap: Bridged mode

Cevap

Bridged mode is the correct configuration because it connects the virtual network interface directly to the physical network switch, allowing the VM to operate as an independent node on the physical network and receive an IP address from the physical DHCP server.
Bridged mode binds the virtual network adapter directly to the physical host adapter. This allows the guest VM to request and obtain a distinct IP address from the physical network's DHCP server and communicate directly with physical devices on the local area network.

Adım Adım Çözüm

1
Analyze the network requirement in the scenario.
The requirement specifies that the VM must obtain an IP address directly from the physical network's DHCP server and be reachable by other physical hosts on the local network.
Determining network visibility and IP assignment source isolates the required virtual network mode.
2
Evaluate the capabilities of virtual network modes.
Bridged mode binds the vNIC to the physical network card, making the VM appear as a separate entity on the physical network LAN.
Only Bridged mode places the guest OS directly onto the host's physical network segment.

Anahtar Kavram

Virtual Network Adapter Modes (Bridged vs. NAT vs. Host-Only vs. Internal)
Tahmini Süre:1m 0s
Soru 2711Soru

An IT technician is dispatched to handle a Windows 11 self-service airport check-in kiosk exhibiting malware symptoms, including unauthorized background network connections and browser redirects. Arrange the following remediation procedures in the correct sequential order according to the official CompTIA 7-step malware removal workflow, starting from the earliest step to be performed.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order follows CompTIA's 7-step malware removal process: 1. Disconnect network interfaces (Isolate), 2. Turn off System Protection (Disable System Restore), 3. Boot into Safe Mode and run remediation tools (Remediate), 4. Configure automated scans and OS updates (Schedule scans/updates), and 5. Re-enable System Protection and create a fresh restore point (Enable System Restore).
The correct sequence strictly follows the CompTIA 7-step malware remediation procedure. The technician must first isolate the system by disconnecting network interfaces (Step 2), disable System Restore to purge infected points (Step 3), remediate the system in Safe Mode (Step 4), schedule recurring scans and install updates (Step 5), and finally re-enable System Restore to establish a clean restore point (Step 6).

Adım Adım Çözüm

1
Isolate the infected device
Disconnecting network interfaces prevents C2 communication and lateral network movement.
Isolation is Step 2 of the CompTIA 7-step process, performed immediately after identifying symptoms.
2
Disable System Restore / System Protection
Prevents the OS from creating backups containing malware files and purges infected legacy restore points.
Disabling System Restore is Step 3 of the process, required before active scanning and removal.
3
Remediate infected systems
Removes malicious files and registry keys while operating in a minimal environment like Safe Mode.
Remediation is Step 4 of the process.
4
Schedule scans and update security software
Ensures antimalware signatures are current and sets up ongoing prevention mechanisms.
Scheduling scans and updating software is Step 5 of the process.
5
Enable System Restore and create a restore point
Restores system backup functionality and creates a confirmed clean state recovery point.
Re-enabling restore features is Step 6 of the process, performed only after verification of complete remediation.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 2712Soru

A technician is investigating a Windows 11 workstation that experiences severe performance degradation after running automated data processing tasks for several hours. In Task Manager, the technician notices that available physical memory steadily decreases to near zero, while non-paged pool memory continuously accumulates and remains unreleased even after the processing application is terminated. Which of the following is the most likely cause of these symptoms?

Cevabı ve açıklamayı göster

Cevap: An application or driver memory leak

Cevap

An application or driver memory leak
The correct answer identifies an application or driver memory leak. Memory leaks occur when a software process or kernel-mode driver requests memory allocation from the operating system but neglects to release it after completing the operation. Because non-paged pool memory resides strictly in physical RAM and cannot be paged to disk, a leak in this pool causes overall available RAM to diminish steadily until the computer is restarted or the faulty driver is reloaded.

Adım Adım Çözüm

1
Analyze the observed system performance metrics in Task Manager.
Identified continuous consumption of physical RAM and a steadily rising non-paged pool value.
Non-paged pool memory is allocated in RAM and cannot be swapped out to disk.
2
Evaluate the behavior after the application is closed.
The allocated pool memory remains locked and is not freed back to the operating system.
When software fails to properly release memory handles upon closing, it points directly to poor memory management in code.
3
Correlate symptoms with Windows performance troubleshooting concepts.
Conclude that an application or driver memory leak is occurring.
Memory leaks are defined by unreleased memory allocations that persist and degrade system responsiveness over time.

Anahtar Kavram

Identifying Memory Leaks in Windows Performance Monitoring
Tahmini Süre:1m 30s
Soru 2713Soru

A systems administrator is configuring local security policies on standalone Windows workstations designated for short-term contractors at a financial services firm. To minimize the attack surface associated with default credential exploitation and unauthenticated local access, which of the following workstation hardening actions should the technician perform?

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and rename the default Administrator account.

Cevap

Disabling the built-in Guest account and renaming the default Administrator account is the best practice for local account hardening.
Disabling the built-in Guest account and renaming the default Administrator account reduces the workstation's attack surface by eliminating default entry points that attackers frequently target in automated brute-force attacks.

Adım Adım Çözüm

1
Identify baseline account hardening security requirements for standalone Windows systems.
Recognize that default accounts (Administrator and Guest) present well-known targets for malicious actors.
Default accounts have well-known names and predictable configurations across default OS installations.
2
Apply local account hardening best practices.
Rename the built-in Administrator account and ensure the Guest account is completely disabled.
This mitigates automated password spraying and unauthorized local logon attempts.

Anahtar Kavram

Workstation Account Hardening and Default Account Management
Soru 2714Soru

A desktop computer running Windows 10 suddenly fails to boot after a user resets the BIOS/UEFI settings to factory defaults. Upon powering on the system, Windows attempts to load but crashes immediately with the Stop Error code INACCESSIBLE_BOOT_DEVICE. Which of the following is the most likely cause of this error, and what action should the technician take FIRST?

Cevabı ve açıklamayı göster

Cevap: The BIOS/UEFI SATA controller mode reverted to IDE or RAID mode instead of AHCI; change the SATA mode back to AHCI in BIOS/UEFI settings.

Cevap

The BIOS/UEFI SATA controller mode reverted to IDE or RAID mode instead of AHCI; change the SATA mode back to AHCI in BIOS/UEFI settings.
When BIOS/UEFI settings are reset to factory defaults, the SATA mode frequently reverts from AHCI to IDE or RAID mode. Because Windows relies on the AHCI driver initialized during installation, changing the hardware controller interface prevents the OS from mounting the boot volume, resulting in an INACCESSIBLE_BOOT_DEVICE stop code. Reverting the BIOS setting back to AHCI resolves the issue immediately without software repair.

Adım Adım Çözüm

1
Analyze the boot error symptom and recent system change.
The symptom is INACCESSIBLE_BOOT_DEVICE occurring immediately after resetting BIOS/UEFI to factory defaults.
When BIOS/UEFI is reset, storage controller settings (SATA mode) often default to RAID or IDE mode. Windows was installed using the AHCI AHCI driver; changing the controller mode prevents Windows from finding the boot device driver.
2
Identify the first non-destructive corrective step.
Re-enter BIOS/UEFI setup and change the storage configuration / SATA mode back to AHCI.
Restoring the original SATA controller mode enables the OS to successfully load the existing storage drivers and boot normally.

Anahtar Kavram

SATA Controller Mode Mismatch during Windows Boot
Tahmini Süre:1m 30s
Soru 2715Soru

A systems administrator is configuring virtual network settings for several virtual machines deployed on a local hypervisor. Match each operational deployment requirement to its corresponding virtual network adapter mode.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A virtual machine requires its own unique IP address from the physical network's DHCP server and must act as an independent host on the physical local subnet.
A isolated virtual machine needs outbound internet access to fetch system updates while remaining hidden from direct incoming access from external physical network hosts.
A testing virtual machine must communicate directly and exclusively with the hypervisor host OS for administrative management, with no traffic routed to external physical networks.
Multiple sandbox virtual machines must communicate only with each other across a private virtual switch, completely isolated from both the hypervisor host and external networks.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Bridged Mode maps to requiring an independent IP address on the physical network. NAT Mode maps to requiring outbound access while concealing the guest from incoming external traffic. Host-Only Mode maps to restricting communication strictly to the guest and the hypervisor host. Internal/Private Mode maps to restricting network communication strictly between designated guest VMs, isolating them from the host and external network.
Each virtual network mode defines explicit boundaries for network exposure. Bridged mode integrates the VM into the physical local network. NAT mode provides outbound access via host IP translation. Host-Only restricts traffic to the guest and host OS. Internal/Private mode isolates network traffic exclusively to guest VMs on the hypervisor.

Adım Adım Çözüm

1
Analyze requirement 1 (independent physical subnet presence)
Bridged mode connects the virtual interface card directly to the physical network card, binding it to the physical subnet infrastructure.
Bridging allows a VM to request its own network IP address from the external physical DHCP server.
2
Analyze requirement 2 (outbound access with inbound network translation)
NAT mode translates internal VM network traffic through the host's IP address.
NAT provides single-direction outbound internet accessibility without exposing open ports to the physical LAN.
3
Analyze requirement 3 (communication limited strictly to host-to-guest link)
Host-Only mode configures a virtual network adapter accessible only by the physical host OS.
Host-Only mode isolates guest network interfaces from physical network adapters while leaving a local loop interface to the host.
4
Analyze requirement 4 (inter-VM communication isolated completely from host and physical network)
Internal / Private mode isolates network switches purely within hypervisor VM boundaries.
Private virtual networking prevents packets from reaching even the management hypervisor OS host interface.

Anahtar Kavram

Virtual Network Adapter Modes and Isolation Boundaries
Tahmini Süre:2m 0s
Soru 2716Soru

An IT technician at a television broadcast studio is responding to a Windows workstation used for live news graphics that is displaying unauthorized pop-up advertisements and experiencing severe system slowdowns. The technician confirmed the presence of malware and unplugged the Ethernet cable to isolate the machine. According to the standard CompTIA 7-step malware remediation process, which action should the technician take NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.

Cevap

Disable System Restore in Windows.
According to the official CompTIA 7-step malware remediation process, once the system is quarantined (Step 2), the technician must disable System Restore (Step 3) before attempting remediation. This prevents Windows from creating shadow copies or restore points containing the active infection.

Adım Adım Çözüm

1
Identify current progress in the CompTIA 7-step malware remediation process.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
The technician confirmed symptoms and disconnected the device from the network.
2
Determine the next sequential step in the process.
Step 3 is to disable System Restore.
Disabling System Restore ensures that clean points are not overwritten with malware-infected backups during removal efforts.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Soru 2717Soru

A network administrator monitoring a high-availability telemetry console at a commercial building management facility notices pop-up warnings indicating active file encryption and unauthorized background network socket activity. The administrator immediately unplugs the Ethernet cable and disables wireless adapters to isolate the system. According to the CompTIA 7-step malware removal procedure, which of the following actions should the administrator perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable System Protection to prevent malicious executables from being saved in volume shadow copies.

Cevap

The administrator should disable System Protection (System Restore) to prevent malicious files from being preserved in system backup points prior to remediation.
According to CompTIA's official 7-step malware removal workflow, after identifying symptoms (Step 1) and isolating the system from the network (Step 2), the technician must disable System Restore/System Protection (Step 3). Disabling System Restore deletes existing restore points so infected files cannot be restored accidentally or re-triggered automatically.

Adım Adım Çözüm

1
Identify malware symptoms.
Malware activity confirmed via unauthorized encryption alerts and socket activity.
Establishes the presence and scope of the malware threat.
2
Isolate the infected system.
Network interfaces disconnected.
Prevents lateral movement across the internal network.
3
Disable System Restore / System Protection.
Existing restore points and volume snapshots containing malicious code are purged/disabled.
Ensures that malware cannot persist or trigger reinfection through system recovery points.

Anahtar Kavram

CompTIA 7-step malware removal process: 1. Identify symptoms, 2. Isolate system, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and updates, 6. Enable System Restore and create restore point, 7. Educate end user.
Soru 2718Soru

A user reports that a financial data application on a Windows workstation freezes and crashes with an out-of-memory error during large calculations. While reproducing the issue, a technician notes physical RAM usage reaching 99%99\% and excessive disk swapping activity right before the application closes unexpectedly. Which TWO of the following steps should the technician take to resolve this performance bottleneck and prevent future crashes?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Increase the size of the Windows paging file to expand available virtual memory capacity.; Install additional physical RAM modules into the workstation motherboard.

Cevap

The correct solutions are to increase the size of the Windows paging file to expand virtual memory and to install additional physical RAM into the workstation.
Expanding the paging file provides immediate extra virtual memory commit limit to stop out-of-memory application crashes, while installing additional physical RAM directly resolves memory starvation and eliminates heavy disk swapping performance bottlenecks.

Adım Adım Çözüm

1
Analyze the observed performance metrics.
High RAM utilization (99%99\%) and heavy disk swapping indicate physical memory exhaustion and virtual memory saturation.
When physical memory is exhausted, Windows uses the paging file on the disk as virtual memory; if the commit limit is exceeded, applications crash with out-of-memory errors.
2
Implement virtual memory remediation.
Increasing the virtual memory paging file size prevents immediate application crashes by expanding total system commit memory.
This provides immediate relief for memory-intensive background tasks.
3
Implement physical memory remediation.
Installing additional physical RAM modules resolves the performance bottleneck caused by disk thrashing/swapping.
Hardware upgrade guarantees sustained performance under high operational load.

Anahtar Kavram

Troubleshooting Virtual Memory and Physical RAM Exhaustion in Windows
Tahmini Süre:1m 30s
Soru 2719Soru

An IT technician is tasked with applying baseline security controls to a newly provisioned standalone Windows computer before placing it into service. Place the following workstation hardening steps in the correct chronological order in which they should be executed from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order begins with securing account credentials (disabling Guest and changing default administrative passwords), followed by applying system updates and patches, disabling unneeded services and features to minimize the attack surface, and concluding with configuring local security policy controls.
The proper sequence for workstation hardening dictates securing account access first to prevent administrative exploitation, followed by updating and patching system software, disabling non-essential services and features to minimize attack vectors, and finally establishing local security policy thresholds.

Adım Adım Çözüm

1
Secure local account access
Default administrative credentials are changed and the Guest account is disabled.
Securing local administrative accounts prevents unauthorized privileged access while performing further system management.
2
Apply system updates and patches
The OS is fully updated with current security patches and malware definitions.
Known security vulnerabilities are remediated before applying system policies.
3
Minimize attack surface
Unused services, open network ports, and AutoRun capabilities are turned off.
Closing unused entry points restricts potential vectors for unauthorized network access or unauthorized media execution.
4
Enforce local security policies
Account lockout thresholds and screensaver password requirements are enabled.
Configuring local security policies establishes operational session security for everyday usage.

Anahtar Kavram

Workstation Hardening Procedural Sequence
Soru 2720Soru

An IT technician at a smart grid distribution control center is troubleshooting a Windows 11 workstation connected to the operational network. The technician has confirmed the presence of trojan malware and has already isolated the workstation from the network. According to the CompTIA standard 7-step malware remediation process, which TWO of the following steps should the technician perform NEXT before initiating the system scan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.; Update anti-malware software and signature definitions.

Cevap

The technician should disable System Restore in Windows and update the anti-malware software and signature definitions.
Following system isolation (Step 2), the standard CompTIA process requires disabling System Restore (Step 3) to prevent saving corrupted system files, followed by updating anti-malware signatures (Step 4a) to ensure full detection capabilities during the subsequent remediation scan.

Adım Adım Çözüm

1
Determine current progress in the 7-step malware remediation process
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
The scenario specifies that malware was identified and the workstation isolated.
2
Select the immediate next procedures required before scanning
Perform Step 3 (Disable System Restore) and Step 4a (Update anti-malware software/signatures).
System Restore must be disabled so infected files are not backed up, and scanner definitions must be updated to detect the latest malware signatures.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
ÖncekiSayfa 136 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin