Examkin

Tüm alıştırma soruları

3551 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 2741Soru →

A technician is troubleshooting a Windows 10 workstation that experiences a continuous boot loop. During the Windows splash screen, the system crashes with a Blue Screen of Death (BSOD) displaying the stop code SYSTEM_THREAD_EXCEPTION_NOT_HANDLED. The issue began immediately after an automated driver update for the dedicated video card. Which of the following is the most appropriate initial action to resolve the boot issue?

Cevabı ve açıklamayı göster

Cevap: Boot the system into Safe Mode via Startup Settings in WinRE and roll back the video driver.

Cevap

Boot the system into Safe Mode via Startup Settings in WinRE and roll back the video driver.
The stop code SYSTEM_THREAD_EXCEPTION_NOT_HANDLED following a driver update indicates that a third-party driver is crashing the Windows kernel during startup. Booting into Safe Mode loads generic display drivers instead of the third-party driver, allowing the operating system to start so the technician can roll back or uninstall the problematic driver in Device Manager.

Adım Adım Çözüm

1
Identify the cause of the boot failure from the BSOD error message.
The stop code SYSTEM_THREAD_EXCEPTION_NOT_HANDLED following a driver update indicates a kernel-mode driver crash.
A newly installed device driver is executing invalid instructions during the OS boot phase.
2
Access Windows Recovery Environment (WinRE) Startup Settings.
Select Enable Safe Mode from the Startup Settings options after restarting through Advanced Options.
Safe Mode boots Windows with a minimal set of generic drivers, bypassing the problematic video card driver.
3
Perform driver remediation in Safe Mode.
Open Device Manager, locate the display adapter, and select Roll Back Driver or uninstall the device.
Restoring the previous working driver resolves the kernel crash and allows normal startup.

Anahtar Kavram

Using Safe Mode and WinRE Startup Settings to isolate and repair driver-induced startup crashes.
Soru 2742Soru →

During a security assessment at a financial firm, auditors observe that employees frequently leave their Windows workstations unattended when stepping away from their desks, allowing unauthorized personnel to view sensitive customer data on active sessions. Which of the following workstation hardening measures should the IT technician implement to automatically secure idle sessions?

Cevabı ve açıklamayı göster

Cevap: Enforce a screen saver timeout policy that requires a password to resume the session.

Cevap

Enforce a screen saver timeout policy that requires a password to resume the session.
Enforcing a screen saver timeout policy requiring a password on resume is an effective security control against walk-away risks. When an employee leaves a desktop unattended, the operating system detects inactivity, starts the screen saver, and locks the console. Any attempt to resume interaction requires entering the user's password, effectively preventing passersby from accessing sensitive data.

Adım Adım Çözüm

1
Identify the primary threat presented in the scenario.
The core vulnerability is unauthorized physical access to active, logged-in user sessions due to unattended workstations.
Employees are walking away without manually locking their operating system sessions.
2
Evaluate potential workstation hardening controls to address session hijacking.
Automated session locking via screen saver timeout policies or screen locks enforces protection without relying solely on manual user compliance.
Configuring a screen saver lock forces the system to lock after a specified threshold of inactivity and demands valid user credentials to unlock.
3
Select the option that directly automates screen locking upon inactivity.
Enforcing a screen saver timeout policy with password protection on resume directly resolves the issue.
This is the standard CompTIA-recommended hardening procedure for preventing walk-away session vulnerability.

Anahtar Kavram

Workstation Hardening: Screen Lock and Inactivity Timeout Policies
Soru 2743Soru →

A systems technician at an architectural design firm is working on a Windows workstation infected with a rogue malware threat. The technician has already identified the malware symptoms, isolated the machine from the local network, and disabled System Restore. Which TWO of the following actions should the technician perform NEXT during the remediation phase of the CompTIA 7-step malware remediation process? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware engine and signature files.; Perform a complete malware scan using bootable media or Safe Mode.

Cevap

The technician must update the anti-malware engine and signature files, and perform a complete malware scan using bootable media or Safe Mode.
Step 4 of the CompTIA 7-step malware remediation process specifies remediating the infected system by first updating the anti-malware signatures/engine and then performing scan and removal techniques in an isolated environment (such as Safe Mode or WinPE). Both of these actions directly satisfy Step 4.

Adım Adım Çözüm

1
Identify the current step in the CompTIA 7-step malware remediation workflow.
Steps 1 (Identify symptoms), 2 (Quarantine system), and 3 (Disable System Restore) have already been completed.
The next logical phase is Step 4: Remediate infected systems.
2
Determine the required tasks within Step 4 (Remediate infected systems).
Step 4 consists of two sequential actions: (a) Update anti-malware software/signatures, and (b) Scan and use removal techniques (such as Safe Mode or bootable media).
Signatures must be updated prior to running scans so the system can accurately detect and eradicate the identified malware strain.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Soru 2744Soru →

A technician is troubleshooting a dedicated digital signage player in a public transit station. The system exhibits rogue security notifications and high CPU utilization. The technician has confirmed the presence of malware and has unplugged the network cable to isolate the system. According to the CompTIA standard 7-step malware removal procedure, which of the following actions should the technician perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.

Cevap

Disabling System Restore in Windows is the correct next step after isolating the infected machine.
Following the CompTIA standard 7-step malware removal procedure (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate, 5. Schedule scans/updates, 6. Enable System Restore, 7. Educate end user), the technician has already completed steps 1 and 2. The immediate next action required before remediation is to disable System Restore to prevent Windows from caching infected system files.

Adım Adım Çözüm

1
Identify malware symptoms
Confirmed malware infection (rogue notifications and abnormal system behavior).
Establishes the initial problem context.
2
Isolate the infected system
Physical network cable unplugged.
Prevents the malware from spreading across the local network.
3
Disable System Restore
System Protection is turned off, preventing infected restore points from being created or preserved.
Ensures that malicious binaries are not saved in restore points or automatically restored during system recovery.

Anahtar Kavram

CompTIA 7-step malware removal process order
Soru 2745Soru →

A Windows 10 desktop computer fails to complete the startup sequence immediately after a third-party graphics driver update was installed. During the Windows logo splash screen, the system displays a Stop error (BSOD) and continuously restarts in a boot loop. The technician successfully boots the workstation into the Windows Recovery Environment (WinRE). Which of the following is the most appropriate initial action to restore system bootability?

Cevabı ve açıklamayı göster

Cevap: Navigate to Startup Settings and boot into Safe Mode to roll back the updated driver.

Cevap

Navigate to Startup Settings and boot into Safe Mode to roll back the updated driver.
Safe Mode starts Windows with a baseline set of drivers and essential services. Because the crash occurs during the boot phase due to a newly installed graphics driver, booting into Safe Mode bypasses the third-party driver, allowing the technician to access Device Manager and execute a driver rollback.

Adım Adım Çözüm

1
Analyze the symptoms described in the scenario.
Identified that the system encounters a Blue Screen of Death (BSOD) during the kernel loading phase specifically following a graphics driver update.
Determining the root cause isolates the issue to a corrupted or incompatible driver operating in kernel space rather than a damaged boot sector or missing hardware.
2
Evaluate WinRE recovery tools for driver-level failure remediation.
Booting into Safe Mode loads essential Windows components only, preventing the newly updated third-party graphics driver from initializing.
Safe Mode provides a stable environment to access Device Manager or System Restore.
3
Remediate the driver corruption.
Roll back or uninstall the problematic graphics driver from Device Manager.
Restoring the previously known-good driver resolves the crash loop and allows standard system boot.

Anahtar Kavram

Isolating and recovering from driver-induced boot crashes using WinRE Safe Mode
Soru 2746Soru →

A desktop support technician at a municipal transit authority is responding to a Windows workstation infected with rogue adware and spyware. The technician has confirmed the malware symptoms, isolated the system from the local network, and disabled System Restore. Which of the following actions should the technician perform NEXT to adhere to the CompTIA standard malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware software signature files using a clean flash drive.

Cevap

The technician should update the anti-malware software definitions using an offline source, such as a clean flash drive.
The CompTIA 7-step malware remediation workflow proceeds as follows: 1. Identify symptoms, 2. Quarantine system, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and remove), 5. Schedule scans and updates, 6. Enable System Restore and create restore point, 7. Educate end user. Since steps 1 through 3 are already completed, the next logical action is Step 4a: updating the anti-malware signature definitions.

Adım Adım Çözüm

1
Identify current progress in the 7-step remediation process
Steps 1 (Identify), 2 (Quarantine/Isolate), and 3 (Disable System Restore) are complete.
Determines which step comes next in the established sequence.
2
Determine the next required step in sequence
Step 4 is Remediate infected systems, starting with updating anti-malware software/signatures (Step 4a).
Anti-malware software must have the latest signatures to effectively detect and remove modern threats.
3
Select the correct action matching Step 4a
Because network connectivity is disabled for quarantine, signatures must be updated via removable media.
Ensures the anti-malware database is current without rejoining the network prematurely.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process Order
Soru 2747Soru →

A user modified partition settings on a legacy MBR-based Windows 10 system, resulting in a startup failure with error code 0xc000000e indicating missing or corrupted Boot Configuration Data. A help desk technician boots the computer into the Command Prompt within the Windows Recovery Environment (WinRE). Which TWO commands should the technician execute to locate installed operating systems and reconstruct the boot database? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: bootrec /scanos; bootrec /rebuildbcd

Cevap

The technician must execute `bootrec /scanos` to identify Windows installations missing from the Boot Configuration Data and `bootrec /rebuildbcd` to reconstruct the BCD database.
The correct steps involve using `bootrec /scanos` to detect installed Windows instances missing from the boot configuration and `bootrec /rebuildbcd` to rebuild the Boot Configuration Data store, allowing the OS entry to be restored.

Adım Adım Çözüm

1
Identify the cause of the boot failure
Error 0xc000000e points to missing or inaccessible Boot Configuration Data (BCD).
Understanding the error code narrows the required repair utility down to BCD-specific commands.
2
Execute the boot scanner utility
Running `bootrec /scanos` checks drives for valid Windows installations not referenced in the BCD.
Verifies that the operating system files are detected before modifying boot entries.
3
Rebuild the boot configuration store
Running `bootrec /rebuildbcd` prompts the technician to add detected OS paths into a fresh BCD database.
Restores proper boot entry mappings so Windows can initiate startup.

Anahtar Kavram

Rebuilding the Windows Boot Configuration Data (BCD) store using Bootrec commands in WinRE
Soru 2748Soru →

A video editing workstation at an animation studio exhibits persistent ad pop-ups, degraded rendering performance, and unexpected outbound network traffic. A desktop technician identifies and confirms a Trojan infection, then immediately disconnects the system's Ethernet cable and disables its wireless adapter to isolate it. According to the CompTIA 7-step malware removal procedure, what is the VERY NEXT action the technician should perform?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.

Cevap

Disable System Restore in Windows.
The CompTIA 7-step malware removal workflow follows a specific sequential order: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the scenario specifies that identification (Step 1) and isolation (Step 2) have occurred, the immediate next step is to disable System Restore.

Adım Adım Çözüm

1
Identify symptoms and verify infection
Malware symptoms (pop-ups, network traffic) confirmed as a Trojan infection.
Step 1 of the CompTIA 7-step process is already completed.
2
Isolate the infected system
Ethernet cable unplugged and Wi-Fi disabled.
Step 2 of the CompTIA 7-step process is already completed.
3
Disable System Restore
Existing restore points containing malicious payload copies are purged.
Step 3 must occur before scanning and remediation (Step 4) so that infected files are not preserved in system snapshots.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Soru 2749Soru →

A cybersecurity technician at a regional credit union is responding to a Windows 11 workstation exhibiting unauthorized background outbound traffic and rogue spyware pop-ups. The technician has confirmed the presence of malware on the system. Place the standard CompTIA remediation steps in the correct chronological order to resolve the incident.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Quarantine the infected workstation by disconnecting network cables and disabling wireless adapters; 2) Disable System Restore in Windows settings; 3) Update anti-malware signatures and perform a comprehensive system scan; 4) Re-enable System Restore and generate a clean system restore point; 5) Provide end-user security awareness training.
The standard CompTIA 7-step malware removal process follows a specific lifecycle: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and use removal techniques), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the user. The correct ordering strictly adheres to this workflow by isolating the endpoint first, disabling restore snapshots prior to cleaning, running updated anti-malware tools, re-enabling restore features once clean, and finishing with end-user education.

Adım Adım Çözüm

1
Isolate the compromised system (Quarantine).
Network communication is severed, preventing lateral movement across the credit union network.
According to the CompTIA 7-step malware removal procedure, isolation/quarantine immediately follows identification.
2
Disable System Restore.
All existing restore points (which may contain infected files) are purged.
Disabling System Restore prevents Windows from accidentally restoring infected system files during recovery.
3
Remediate the system (Update engine and scan/remove malware).
Malware components are identified, quarantined, and deleted from the operating system.
Updating signature files first guarantees maximum detection capabilities before running removal scripts.
4
Enable System Restore and create a restore point.
A clean backup baseline is established for future operating system protection.
System protection should only be re-established after verification that all malicious software has been eliminated.
5
Educate the end user.
The workstation user learns safe browsing and email hygiene practices.
User education is the critical final step to prevent future vector exploitation.

Anahtar Kavram

CompTIA 7-step Malware Remediation Process
Soru 2750Soru →

An IT support technician is deploying a shared workstation in a financial service firm's reception area. To protect sensitive client financial records from unauthorized exfiltration, company policy requires that standard users be restricted from reading or writing data to external flash drives, while essential USB peripherals such as keyboards and mice remain fully functional. Which of the following is the most effective workstation hardening action to fulfill this requirement?

Cevabı ve açıklamayı göster

Cevap: Configure Removable Storage Access policies in the Local Group Policy Editor to deny access to removable disks.

Cevap

Configure Removable Storage Access policies in the Local Group Policy Editor to deny access to removable disks.
Configuring Removable Storage Access policies in the Local Group Policy Editor allows administrators to block read and write permissions specifically for USB flash drives and external disks while permitting USB Human Interface Devices (such as keyboards and mice) to operate normally.

Adım Adım Çözüm

1
Analyze the technical requirements and constraints.
USB mass storage devices must be blocked to prevent data loss, but USB Human Interface Devices (HID) must remain operational.
Disabling the entire USB controller hardware would render the workstation unusable.
2
Identify the appropriate administrative tool and policy path.
Navigate to Local Group Policy Editor (gpedit.msc) under Computer Configuration -> Administrative Templates -> System -> Removable Storage Access.
Group Policy provides targeted control over device classes rather than global driver shutdown.
3
Apply the granular access restriction.
Enable policies such as 'Removable Disks: Deny read access' and 'Removable Disks: Deny write access'.
This selectively prevents storage mounting and data transfer while leaving peripheral input drivers unaffected.

Anahtar Kavram

Removable Storage Restriction via Local Group Policy
Tahmini Süre:1m 15s
Soru 2751Soru →

A desktop support technician at a game development studio is responding to a workstation infected with spyware. The technician has successfully isolated the system from the network, disabled System Restore, updated the anti-malware definitions in Safe Mode, and executed a full scan that detected and removed all malicious files. Which of the following actions should the technician perform NEXT according to the standard CompTIA malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Schedule recurring automatic anti-malware updates and system scans.

Cevap

Schedule recurring automatic anti-malware updates and system scans.
The CompTIA 7-step malware remediation process follows a strict sequential order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware, scan/remove), 5. Schedule updates and scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since Step 4 has just been completed, the technician must proceed to Step 5 by scheduling recurring automatic updates and scans.

Adım Adım Çözüm

1
Review current progress in the CompTIA 7-step malware remediation process.
Steps 1 (Identify), 2 (Quarantine), 3 (Disable System Restore), and 4 (Remediate/Update/Scan) have been completed.
Determines the current phase of remediation.
2
Identify Step 5 of the remediation methodology.
Step 5 dictates scheduling recurring updates and automatic scans to prevent future reinfection.
Maintains ongoing protection on the remediated host.
3
Select the option that matches Step 5.
Scheduling recurring anti-malware updates and system scans is selected.
Matches the official CompTIA standard operating procedure.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process Order
Soru 2752Soru →

A systems administrator is configuring local security policies for standalone Windows workstations deployed in a public library's computer lab. Which TWO of the following administrative actions should the technician perform to reduce the attack surface and harden these workstations against unauthorized access?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable the built-in local Guest account.; Configure AutoPlay and AutoRun settings to disabled for all removable drives.

Cevap

The technician should disable the built-in local Guest account and disable AutoPlay/AutoRun settings for all removable drives.
Hardening standalone workstations in public or shared spaces requires limiting unauthorized default access and preventing automated execution of external media. Disabling the local Guest account removes an unneeded login vector, and turning off AutoPlay/AutoRun prevents untrusted USB devices from launching malicious code upon insertion.

Adım Adım Çözüm

1
Identify default account vulnerabilities
Disabling the default local Guest account restricts unnecessary local access vectors for anonymous users.
Hardening best practices mandate removing or disabling unneeded default accounts to reduce potential entry points.
2
Configure media execution controls
Disabling AutoPlay/AutoRun stops code execution when removable storage devices are connected.
Publicly accessible kiosks are vulnerable to malicious USB drives carrying autorun payloads.

Anahtar Kavram

Workstation Hardening via Account Controls and Removable Media Policies
Tahmini Süre:1m 30s
Soru 2753Soru →

A desktop technician is responding to a suspected ransomware infection on a workstation used by a rare manuscripts archivist at a university library. The technician needs to execute the standard CompTIA malware removal process. Place the following remediation actions in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence for CompTIA malware removal is: 1) Disconnect the workstation from the network, 2) Disable Windows System Restore, 3) Update anti-malware signatures and perform a comprehensive system scan, 4) Re-enable System Restore and manually create a clean restore point, and 5) Provide security awareness guidance to the archivist.
CompTIA defines a strict 7-step malware removal procedure: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems (update definitions & scan/remove), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Arranging the actions following this standard workflow places network isolation first, followed by disabling restore features, executing scans/remediation, generating a new clean restore point, and concluding with user education.

Adım Adım Çözüm

1
Isolate the infected machine immediately
Network communication is terminated, stopping malware from spreading to library shares.
Isolation must occur right after identifying symptoms to protect adjacent network infrastructure.
2
Turn off System Restore in Windows
Existing restore points containing malware binaries are cleared.
Prevents accidental restoration of infected system files later.
3
Remediate by updating definitions and scanning
Malware files, registry keys, and active processes are identified and quarantined.
Ensures the anti-malware engine uses current threat signatures to eradicate the payload.
4
Enable System Restore and create a clean restore point
A known-good baseline recovery point is established.
Restores protection capabilities only after verifying the operating system is completely clean.
5
Educate the user
The archivist learns best practices to prevent similar future infections.
Finalizes the remediation lifecycle by addressing human risk factors.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Tahmini Süre:1m 30s
Soru 2754Soru →

An IT technician is preparing a standard workstation baseline image for remote customer support representatives. Company security policy requires hardening local user account settings to mitigate credential harvesting and unauthorized local access. Which of the following configuration steps should the technician perform to meet this security baseline requirement?

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and rename the built-in local Administrator account.

Cevap

Disable the built-in Guest account and rename the built-in local Administrator account.
Hardening default local accounts requires disabling unneeded accounts like Guest and renaming well-known default accounts like Administrator. This eliminates easy entry points for unauthorized users and disrupts automated password brute-force scripts targeting standard account names.

Adım Adım Çözüm

1
Identify local account security risks
Default local accounts (such as Administrator and Guest) present known attack vectors for brute-force attacks and unauthorized access.
Attackers target well-known account names to gain initial access or elevate privileges on a machine.
2
Apply local account hardening best practices
Disable the built-in Guest account so it cannot be used for logon sessions, and rename the default Administrator account to a non-standard name.
This enforces principle of least privilege and obscures default administrative account identifiers.

Anahtar Kavram

Workstation Account Hardening
Soru 2755Soru →

A Windows workstation connected to a corporate domain fails to launch the operating system after an improper system shutdown. Upon power-on, the screen displays the error message 'BOOTMGR is missing'. The computer utilizes a legacy Master Boot Record (MBR) disk partition layout. Which TWO command-line utilities and switches should an IT support technician execute inside the Windows Recovery Environment (WinRE) Command Prompt to write a new system partition boot sector and scan all disks for compatible Windows installations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: bootrec /fixboot; bootrec /scanos

Cevap

The correct utilities to execute are 'bootrec /fixboot' to write a new boot sector and 'bootrec /scanos' to search all disks for compatible operating system installations.
The command 'bootrec /fixboot' writes a new boot sector to the system partition, resolving issues where BOOTMGR is corrupted or missing. The command 'bootrec /scanos' scans all disks for Windows installations compatible with the current OS and displays any entries missing from the Boot Configuration Data store.

Adım Adım Çözüm

1
Identify the startup error cause
Recognize 'BOOTMGR is missing' on MBR disks indicates a corrupted volume boot record or missing boot files.
Understanding the specific phase of legacy MBR startup failure directs the correct utility selection.
2
Select the boot sector repair switch
Identify 'bootrec /fixboot' as the command to write a fresh volume boot sector.
The /fixboot switch writes a compatible system partition boot sector without overwriting the master partition table.
3
Select the OS scanning switch
Identify 'bootrec /scanos' as the command to scan all drives for Windows installations.
The /scanos switch locates Windows installations not currently listed in the Boot Configuration Data (BCD) store.

Anahtar Kavram

Repairing Windows Boot Configuration Data and boot sectors using bootrec commands in WinRE
Soru 2756Soru →

A desktop computer configured with a primary NVMe SSD containing the Windows operating system and a secondary SATA storage drive fails to boot following a motherboard firmware update. The display shows the error message "Boot Device Not Found." Upon accessing the UEFI setup utility, the technician confirms that both drives are properly recognized and detected as healthy. Which of the following is the MOST appropriate next step to resolve this startup issue?

Cevabı ve açıklamayı göster

Cevap: Verify the UEFI boot priority list and set the NVMe SSD as the primary boot device.

Cevap

Verify the UEFI boot priority list and set the NVMe SSD as the primary boot device.
The correct action is to verify the UEFI boot priority list and select the NVMe SSD as the primary boot device. Motherboard firmware updates frequently clear custom settings and reset boot options to factory defaults. When a secondary data drive is prioritized over the operating system drive, UEFI cannot locate the boot partition and displays a 'Boot Device Not Found' error.

Adım Adım Çözüm

1
Analyze the error message and scenario context
Identified that the hardware was detected as healthy after a firmware update, indicating the storage drive itself has not failed.
Motherboard firmware (UEFI/BIOS) updates often reset system settings to defaults, including storage controller boot order priorities.
2
Access UEFI/BIOS settings to inspect boot configuration
Located the boot order list where the secondary SATA drive or non-boot device was placed ahead of the primary OS drive.
If the system attempts to boot from a secondary drive without an operating system, it returns a 'Boot Device Not Found' error.
3
Reorder the boot devices and save configuration
Set the NVMe SSD containing the Windows OS manager as boot option #1 and saved changes.
Correcting the boot sequence allows UEFI to locate the Windows Boot Manager on the primary drive and initialize Windows normally.

Anahtar Kavram

UEFI Boot Order Configuration
Tahmini Süre:1m 30s
Soru 2757Soru →

A Windows 10 workstation experiences a Blue Screen of Death (BSOD) during boot pointing to a corrupted critical system file. The automated Startup Repair tool fails to resolve the issue. Place the troubleshooting steps in the correct chronological order to repair the system files using the Windows Recovery Environment (WinRE) Command Prompt.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with booting into WinRE and launching the Command Prompt, determining the offline Windows drive letter using diskpart or dir, running sfc with the /offbootdir and /offwindir flags, and finally rebooting the workstation normally to verify boot functionality.
To repair corrupted Windows boot files offline, a technician must first gain command-line access via WinRE. Before running repair utilities, the technician must verify which volume letter corresponds to the installed OS because WinRE drive letter mappings differ from normal operation. Next, running System File Checker requires explicit parameters (/offbootdir pointing to the boot partition and /offwindir pointing to the Windows directory) to scan the correct offline files. Finally, restarting the machine confirms whether the repairs allowed the operating system to boot normally.

Adım Adım Çözüm

1
Boot into WinRE and open Command Prompt
Establishes an un-booted environment where locked system files can be modified.
WinRE loads into a RAM disk (X: drive), freeing up the main OS partition for repair operations.
2
Determine the offline Windows drive letter
Identifies the correct drive assignment for the installed operating system.
WinRE does not always assign C: to the primary Windows partition, requiring manual volume verification.
3
Run sfc /scannow with /offbootdir and /offwindir switches
Scans the offline system partition and replaces damaged Windows system files.
Standard sfc /scannow without switches would only attempt to scan the WinRE temporary RAM drive instead of the corrupted OS installation.
4
Reboot the system
Tests system bootability.
Ensures that the replaced system files allow Windows to initialize normally.

Anahtar Kavram

Offline System File Repair in Windows Recovery Environment
Soru 2758Soru →

A user reports that following an abrupt power failure, a desktop computer fails to start and displays the error message 'Operating System Not Found' on a black screen. An IT technician boots the computer into the Windows Recovery Environment (WinRE) Command Prompt and confirms that the system uses a Master Boot Record (MBR) partition scheme. Diagnostics indicate that the partition structure is undamaged, but the boot loader code located in the MBR is corrupted. Which command should the technician run to write a new master boot record to the system partition without altering the existing partition table?

Cevabı ve açıklamayı göster

Cevap: bootrec /fixmbr

Cevap

The command 'bootrec /fixmbr' should be executed to write a new MBR-compatible Master Boot Record to the system partition.
Executing 'bootrec /fixmbr' writes a standard, uncorrupted Master Boot Record code to the system disk, fixing startup errors caused by corrupted MBR code without disturbing the partition table.

Adım Adım Çözüm

1
Identify the root cause from the scenario symptoms and diagnostics.
The system fails to locate the OS due to corrupted Master Boot Record code on an MBR-partitioned disk after a sudden shutdown.
Understanding the specific boot stage failure distinguishes MBR boot code corruption from BCD store, boot sector, or file system corruption.
2
Select the specific bootrec parameter targeted at Master Boot Record code replacement.
The '/fixmbr' switch overwrites only the master boot record code while keeping the existing partition table intact.
Using '/fixmbr' resolves the 'Operating System Not Found' error without risking data loss on existing drive partitions.

Anahtar Kavram

Master Boot Record (MBR) Repair via Bootrec Utility
Soru 2759Soru →

A desktop technician at a tax advisory firm is responding to a Windows 11 workstation displaying rogue security pop-ups and redirected web searches. The technician has confirmed the presence of malware. Following the standard CompTIA 7-step malware remediation process, which of the following actions should the technician take PRIOR to initiating anti-malware scans and system remediation? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disconnect the workstation from both wired Ethernet and wireless networks.; Disable Windows System Restore to purge existing system restore points.

Cevap

Disconnect the workstation from both wired Ethernet and wireless networks, and disable Windows System Restore to purge existing restore points.
According to the official CompTIA 7-step malware removal process, after identifying malware symptoms (Step 1), the technician must isolate the infected machine from all network connections (Step 2) and disable System Restore in Windows (Step 3) prior to running anti-malware scans and remediation tools (Step 4). Disconnecting all network interfaces stops lateral movement and external communication. Disabling System Restore purges saved restore points that could hold infected copies of files.

Adım Adım Çözüm

1
Determine current step within the CompTIA 7-step malware remediation workflow.
Malware symptoms have already been identified (Step 1). The next mandatory steps before remediation (Step 4) are Isolation (Step 2) and Disabling System Restore (Step 3).
CompTIA defines standard remediation order as: 1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate (update signatures & scan), 5. Schedule scans/updates, 6. Enable System Restore & create restore point, 7. Educate end user.
2
Perform system isolation.
Unplug the network cable and turn off Wi-Fi/Bluetooth connections.
Containment stops network propagation and command-and-control channel traffic.
3
Disable System Restore in Windows.
All restore points containing malware snapshots are removed.
Ensures infected files cannot be restored later by System Restore.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Procedure
Soru 2760Soru →

A workstation support technician at a pharmaceutical logistics facility is troubleshooting a Windows 11 workstation infected with a Trojan. The system has already been isolated from the network, and System Restore has been disabled. Which of the following actions should the technician take NEXT as part of the remediation process? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the local anti-malware signatures and scan engine to the latest available definitions.; Execute a thorough anti-malware scan using specialized tools to quarantine identified threats.

Cevap

The technician should update the local anti-malware signatures and scan engine, and execute a thorough anti-malware scan using specialized tools to quarantine identified threats.
According to the CompTIA 7-step malware remediation process, once the system is isolated (Step 2) and System Restore is disabled (Step 3), the technician must proceed to Step 4: Remediate the infected systems. Step 4 requires two key actions: first, updating the anti-malware signatures and engines, and second, executing a full scan using anti-malware tools to quarantine and remove the infection.

Adım Adım Çözüm

1
Identify the current phase of the CompTIA 7-step malware removal process.
The system has been identified (Step 1), isolated (Step 2), and System Restore has been disabled (Step 3). The next sequential phase is Step 4: Remediate the infected systems.
Remediation must follow isolation and disabling restore points to prevent malware from persisting in backups or spreading.
2
Determine the mandatory sub-steps required for system remediation (Step 4).
Step 4 consists of (a) updating anti-malware signatures/software and (b) scanning and using removal techniques (e.g., Safe Mode or standalone tools).
Outdated signatures may miss active malware variants, making an immediate update essential prior to running the scan.
3
Evaluate the choices to select the two actions corresponding to Step 4.
Updating anti-malware signatures and executing a thorough anti-malware scan are the correct next remediation steps.
Re-enabling System Restore (Step 6) and educating the end user (Step 7) are post-remediation steps.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process - Step 4: Remediate Infected Systems
Tahmini Süre:1m 30s
ÖncekiSayfa 138 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin