Examkin

Tüm alıştırma soruları

3551 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 2761Soru →

A desktop support technician is servicing a Windows workstation at a hotel reception desk that exhibits severe browser redirects, persistent pop-up advertising, and unauthorized outbound network traffic. The technician has confirmed the malware infection and physically disconnected the system's Ethernet cable to isolate it from the network. Which of the following actions should the technician perform NEXT according to standard malware removal procedures?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.

Cevap

Disable System Restore in Windows as the immediate next step following isolation.
According to the official CompTIA 7-step malware removal process, once malware symptoms are identified (Step 1) and the system is isolated from the network (Step 2), the technician must disable System Restore (Step 3) before attempting remediation. Disabling System Restore deletes existing restore points, ensuring that infected files stored in shadow copies cannot reinfect the workstation.

Adım Adım Çözüm

1
Identify malware symptoms
Confirmed malware symptoms (browser redirects, pop-ups, unauthorized traffic).
Establishes that the system is infected (Step 1).
2
Isolate the infected system
System disconnected from Ethernet network.
Prevents potential lateral movement of malware across the LAN (Step 2).
3
Disable System Restore
System restore points are turned off and existing restore points are purged.
Prevents malicious files and registry keys from being backed up into system restore points or restored automatically (Step 3).

Anahtar Kavram

CompTIA 7-Step Malware Remediation Procedure
Soru 2762Soru →

An IT security analyst is defining baseline workstation security standards to protect enterprise desktops against common attack vectors. Match each workstation security hardening control on the left with its corresponding risk mitigation objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Disabling NetBIOS over TCP/IP
Implementing Local Administrator Password Solution (LAPS)
Enforcing Application Allowlisting (AppLocker)
Configuring Screensaver Lock Timeout

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Disabling NetBIOS over TCP/IP matches with blocking LLMNR/NBT-NS spoofing; Implementing LAPS matches with mitigating lateral movement from reused local admin credentials; Enforcing Application Allowlisting matches with preventing execution of untrusted binaries; Configuring Screensaver Lock Timeout matches with preventing unauthorized session access to unattended devices.
Each security control targets a specific workstation vulnerability: disabling NetBIOS prevents broadcast name resolution spoofing; LAPS prevents credential reuse and lateral movement; AppLocker restricts binary execution to trusted software; screensaver timeout protects open physical sessions on idle machines.

Adım Adım Çözüm

1
Analyze the purpose of network protocol hardening controls
Disabling NetBIOS over TCP/IP eliminates unauthenticated broadcast name resolution traffic, neutralizing NBT-NS/LLMNR spoofing vectors.
Legacy protocols broadcast requests across the local subnet, which malicious actors on the segment can easily intercept.
2
Analyze local account privilege management solutions
LAPS ensures unique, randomized passwords for local administrator accounts on every endpoint.
If local administrator passwords are standard across machines, compromising one system leads to lateral movement across the entire network.
3
Analyze software execution restriction policies
AppLocker enforce allowlisting rules to block unauthorized executables, installers, and scripts.
Allowlisting operates on a default-deny principle, blocking malware or unauthorized software even if the user attempts to launch it.
4
Analyze physical and environmental workstation controls
Screensaver lock policies require user re-authentication after a set interval of system inactivity.
This control mitigates physical security risks when users leave their desks unattended without manually locking their operating system.

Anahtar Kavram

Workstation Hardening and Risk Mitigation
Soru 2763Soru →

An IT technician is troubleshooting a Windows 11 workstation used on the floor of an automated logistics fulfillment center. The workstation is exhibiting unauthorized background network requests and high CPU usage caused by an unrecognized process named sys_update.exe. The technician has confirmed a malware infection and disconnected the ethernet cable to isolate the system. According to the CompTIA 7-step malware removal process, which of the following actions should the technician take NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.

Cevap

The technician should disable System Restore in Windows as the immediate next step.
Under the CompTIA standard 7-step malware remediation process (1. Identify symptoms, 2. Isolate system, 3. Disable System Restore, 4. Remediate infected system, 5. Schedule scans/updates, 6. Enable System Restore and create restore point, 7. Educate end user), the technician has already completed steps 1 and 2. Step 3 explicitly specifies disabling System Restore before performing scans or updates to ensure restore points are not contaminated with malware.

Adım Adım Çözüm

1
Determine current progress in the 7-step malware removal process.
Step 1 (Identify malware symptoms) and Step 2 (Isolate the infected system) are complete.
Symptoms were identified and the physical network connection was severed.
2
Identify the mandatory next step prior to scanning.
Step 3 requires disabling System Restore.
Disabling System Restore prevents infected files from being archived in Windows shadow copies during malware removal.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 2764Soru →

A technician is troubleshooting a Windows 11 desktop that fails to boot following an unexpected shutdown during a system update. The computer uses UEFI firmware with a GPT disk structure. Upon starting, the system halts with a recovery screen displaying error code 0xc000000f, indicating that the Boot Configuration Data (BCD) file is missing or damaged. The technician boots the system into the Windows Recovery Environment (WinRE) Command Prompt. Which of the following commands is the most appropriate first step to regenerate the boot environment files on the EFI System Partition?

Cevabı ve açıklamayı göster

Cevap: bcdboot C:\Windows

Cevap

The command 'bcdboot C:\Windows' is the correct choice to repair missing or corrupted UEFI boot files and regenerate the BCD store.
The command 'bcdboot C:\Windows' is specifically designed to quickly create or repair the boot environment files on the EFI System Partition (ESP) for UEFI/GPT systems by pulling clean copies directly from the Windows OS directory.

Adım Adım Çözüm

1
Identify the system architecture and error type.
The system relies on UEFI firmware with GPT partitioning, and error code 0xc000000f indicates missing BCD/boot files.
UEFI systems rely on an EFI System Partition (ESP) formatted as FAT32 containing specific boot environment files rather than an MBR.
2
Select the utility designed to reconstruct UEFI boot files.
The BCDBoot command line tool copies boot files from the main Windows OS directory (C:\Windows) to the hidden EFI System Partition.
Executing 'bcdboot C:\Windows' creates a new BCD store and places necessary UEFI boot environment files into the ESP.

Anahtar Kavram

EFI System Partition (ESP) and BCD File Repair via BCDBoot Utility
Soru 2765Soru →

A IT support specialist at a municipal utility district is responding to a Windows 11 desktop computer that exhibits symptoms of a malware infection. The technician has confirmed the presence of malicious processes and has completely isolated the workstation from the network by disconnecting the Ethernet cable and disabling all wireless radios. Following CompTIA's standard 7-step malware removal procedure, which of the following actions should the technician take NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable Windows System Restore on the infected workstation.

Cevap

The technician should disable Windows System Restore on the infected workstation.
In CompTIA's standard 7-step malware remediation process, Step 3 requires disabling System Restore immediately after isolating the infected system (Step 2). Disabling System Restore deletes existing restore points, ensuring that infected copies of files cannot persist or be restored later.

Adım Adım Çözüm

1
Identify the current step completed in the CompTIA 7-step malware removal process.
Step 1 (Identify malware symptoms) and Step 2 (Isolate infected systems) have already been completed.
The scenario explicitly states symptoms were identified and the machine was isolated from Ethernet/Wi-Fi.
2
Determine the mandatory next step in the standard sequence.
Step 3 is to disable System Restore.
Disabling System Restore prevents infected files from being saved into restore points or restored unintentionally during cleanup.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Tahmini Süre:1m 0s
Soru 2766Soru →

A technician is troubleshooting a UEFI/GPT-based Windows 11 workstation that fails to start after a partition resizing attempt. The system displays a black screen with the error message indicating that the boot configuration data is missing. The technician boots the machine into the Windows Recovery Environment (WinRE) Command Prompt to manually reconstruct the EFI System Partition (ESP) structures. Place the correct troubleshooting steps in sequential order to repair the boot files.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct repair sequence requires identifying the EFI System Partition using diskpart, assigning it a temporary drive letter, exiting diskpart to access that drive volume, and running the bcdboot command targeting the new drive letter.
On UEFI systems utilizing GPT disks, startup information is contained within an unassigned FAT32 EFI System Partition (ESP). To repair corrupted BCD files manually, a technician must first open `diskpart` to locate and select the ESP volume, assign a temporary drive letter (e.g., `S:`), exit `diskpart`, and then execute `bcdboot C:\Windows /s S: /f UEFI` to write fresh system boot files to the partition.

Adım Adım Çözüm

1
Open diskpart to locate the hidden partition
Identifies the FAT32 volume representing the EFI System Partition (ESP).
On GPT/UEFI systems, boot files are stored on a separate hidden FAT32 partition rather than the main C: drive.
2
Assign a drive letter to the EFI partition
The hidden ESP becomes accessible under a specific drive letter such as S:.
Command-line repair utilities require a reachable drive path to write new boot files.
3
Exit diskpart utility
Returns control to the standard WinRE Command Prompt interface.
File structure operations and bcdboot utility execution must be executed outside of diskpart.
4
Run BCDBoot repair tool
Generates a clean Boot Configuration Data file and installs UEFI boot binaries to the ESP.
The bcdboot command extracts fresh startup files from C:\Windows and initializes the BCD on the target partition.

Anahtar Kavram

Rebuilding UEFI Boot Files and BCD via Diskpart and BCDBoot Utility
Soru 2767Soru →

A financial analyst at a credit union reports that their Windows 11 workstation is displaying unexpected pop-up notifications and security warnings. An IT technician confirms the system has active malware and immediately disconnects the Ethernet cable and disables the Wi-Fi adapter to quarantine the device. According to the standard CompTIA 7-step malware removal procedure, which of the following actions should the technician perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable Windows System Restore on the infected machine.

Cevap

Disable Windows System Restore on the infected machine.
According to the official CompTIA 7-step malware remediation procedure, once the malware symptoms are identified (Step 1) and the system is isolated from the network (Step 2), the immediate next step is to disable System Restore (Step 3). Disabling System Restore deletes previous restore points and prevents Windows from taking snapshots that contain infected files during the removal process.

Adım Adım Çözüm

1
Identify symptoms and confirm malware infection
The technician confirmed active malware presence based on pop-up warnings.
Step 1 of CompTIA's 7-step process is identifying malware symptoms.
2
Isolate the infected system
The technician disconnected network cables and disabled Wi-Fi.
Step 2 isolates the system to prevent network propagation.
3
Disable System Restore
System Restore protection is turned off and existing restore points are cleared.
Step 3 prevents malware from persisting within restore points or being saved during cleanup.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process
Tahmini Süre:1m 15s
Soru 2768Soru →

A desktop computer running Windows 10 hangs indefinitely at the loading screen with a spinning circle immediately after a forced hard reset during a software update. The technician boots the system into the Windows Recovery Environment (WinRE) to troubleshoot the startup issue caused by corrupt startup drivers or services. Which TWO of the following troubleshooting actions should the technician take to resolve this startup issue?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Boot the system into Safe Mode to uninstall recently updated drivers or disable problematic startup services.; Use System Restore from WinRE Advanced Options to roll back the system state to a restore point created before the update.

Cevap

The correct actions are booting into Safe Mode to uninstall problematic drivers/services and using System Restore from Advanced Options to revert system files to a known working restore point.
Booting into Safe Mode allows the technician to load a minimal set of drivers to disable or uninstall recently added updates causing the boot loop. Additionally, running System Restore from WinRE Advanced Options reverts system settings, drivers, and registry states to a functional state prior to the interrupted update.

Adım Adım Çözüm

1
Analyze the boot failure stage.
The spinning circle indicator confirms the bootloader (BOOTMGR/BCD) has successfully initialized, and the OS is hanging during the driver/service loading phase.
Identifying the exact phase of boot failure prevents executing unnecessary bootloader repair commands.
2
Select non-destructive software isolation steps.
Safe Mode allows targeted removal of problematic software or drivers, while System Restore safely reverts system state to prior configuration.
Both methods address OS-level driver and file corruption without performing destructive disk operations.

Anahtar Kavram

Isolating Windows startup hangs caused by driver and service corruption in WinRE.
Soru 2769Soru →

A point-of-sale (POS) terminal at an organic grocery cooperative is displaying persistent browser redirects and generating unauthorized outbound network traffic. An IT technician must resolve the malware infection using standard CompTIA remediation procedures. Place the following remediation actions in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of actions is: 1) Disconnect the Ethernet cable and disable all wireless interfaces, 2) Disable Windows System Protection to delete existing restore points, 3) Update anti-malware definitions and execute a comprehensive remediation scan in Safe Mode, 4) Re-enable Windows System Protection and create a fresh restore point, and 5) Conduct security awareness training with cashiers.
The official CompTIA 7-step malware remediation process follows a mandatory sequence: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Following this sequence prevents malware propagation across the network, purges infected system snapshots before cleaning, ensures complete removal of malicious payloads, establishes a verified clean recovery baseline, and reinforces preventive user behavior.

Adım Adım Çözüm

1
Quarantine the affected system from the network.
Network communication is terminated, preventing malware from spreading to other workstations or communicating with external command-and-control servers.
Isolation must occur immediately after identifying symptoms (Step 2 of the 7-step procedure).
2
Disable Windows System Protection / System Restore.
All existing restore points are deleted, clearing infected snapshots.
If System Restore remains enabled, malware files can remain saved inside hidden restore point files and re-infect the machine later (Step 3).
3
Update malware definitions and perform remediation scans.
Active malware components and infected binaries are identified and removed.
Remediation cleans the system environment (Step 4).
4
Re-enable System Protection and create a clean restore point.
System Protection is active again and captures a known-good system baseline.
Creating a restore point only after full cleaning ensures future restores revert to an uninfected state (Step 6).
5
Educate the end users.
Staff members learn safe browsing and email hygiene practices.
End-user education reduces human vulnerability to malware re-entry (Step 7).

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Tahmini Süre:1m 30s
Soru 2770Soru →

A systems administrator suspects that a network-connected Windows 11 workstation at a renewable energy research facility is infected with malware after observing unexpected outbound data transfers and rogue pop-up notifications. Following CompTIA's standard 7-step malware removal procedure, which of the following actions should the administrator take BEFORE initializing anti-malware scanning tools? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disconnect physical network cables and disable all wireless network interfaces on the affected workstation.; Disable System Restore in Windows to prevent infected files from being saved in system restore points.

Cevap

The administrator should disconnect physical network cables and disable all wireless network interfaces on the affected workstation, as well as disable System Restore in Windows to prevent infected files from being saved in system restore points.
According to CompTIA's 7-step malware removal procedure, once symptoms are identified (Step 1), the immediate subsequent actions required before remediation and scanning (Step 4) are isolating the infected system (Step 2) by disconnecting all network interfaces, and disabling System Restore (Step 3) to clear any restore points that might contain malicious files.

Adım Adım Çözüm

1
Identify malware symptoms
Malware infection suspected due to rogue pop-ups and unusual outbound traffic (Step 1 complete).
Recognizing signs of infection establishes the necessity for malware remediation.
2
Isolate the infected system
Disconnect Ethernet network cables and disable Wi-Fi/Bluetooth interfaces.
Isolating the system contains the infection, stopping it from spreading to other network devices or leaking data.
3
Disable System Restore
Turn off Windows System Restore functionality.
This deletes existing restore points, preventing malware from backing itself up into restore points or reinfecting the system later.

Anahtar Kavram

CompTIA 7-step malware removal procedure order of execution
Soru 2771Soru →

Following a sudden system power failure, a Windows 10 desktop computer using Legacy BIOS and MBR partitioning fails to boot, displaying the message "BOOTMGR is missing". A technician boots into the Windows Recovery Environment (WinRE) Command Prompt and verifies that the physical hard drive is recognized and the Master Boot Record is intact. Which of the following commands should the technician execute to write a new boot sector to the system partition?

Cevabı ve açıklamayı göster

Cevap: bootrec /fixboot

Cevap

The technician should execute the `bootrec /fixboot` command.
The command `bootrec /fixboot` writes a new boot sector onto the system partition using a boot sector compatible with Windows. This resolves the "BOOTMGR is missing" error by restoring the boot code responsible for invoking the Windows Boot Manager.

Adım Adım Çözüm

1
Diagnose the boot failure error message.
The message "BOOTMGR is missing" on an MBR system indicates that the volume boot sector code on the system partition is missing, corrupted, or incompatible.
Identifying whether the issue lies in the MBR, boot sector, BCD database, or system files narrows down the proper repair command.
2
Select the correct `bootrec` command switch in WinRE Command Prompt.
Executing `bootrec /fixboot` writes a fresh Windows-compatible boot sector onto the active system partition.
This specific command repairs the partition volume boot code needed to locate and load BOOTMGR upon startup.

Anahtar Kavram

Repairing Volume Boot Code with Bootrec in Windows Recovery Environment
Tahmini Süre:1m 30s
Soru 2772Soru →

A desktop support technician is troubleshooting a Windows 11 workstation used by a CAD drafter at an architectural design firm. The computer exhibits unauthorized pop-up windows and modified browser search engine settings. The technician has confirmed the presence of malware and disconnected the physical network cable to isolate the system. Which of the following is the NEXT step the technician should take according to the standard CompTIA malware removal procedures?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.

Cevap

Disable System Restore in Windows.
According to CompTIA's standard 7-step malware remediation procedure (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans/updates, 6. Enable System Restore & create restore point, 7. Educate end user), the immediate step following isolation of the infected system is disabling System Restore. Disabling System Restore purges existing system protection snapshots, ensuring infected system files cannot persist or be restored later.

Adım Adım Çözüm

1
Identify the current stage within CompTIA's 7-step malware removal process.
The technician has completed Step 1 (Identify malware symptoms) and Step 2 (Isolate infected systems).
Determining the completed steps establishes where the technician is in the mandatory order of operations.
2
Determine the required third step of the removal process.
Step 3 requires disabling System Restore in Windows.
Disabling System Restore clears existing restore points and prevents malware from surviving remediation by concealing infected copies inside Windows restore points.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 2773Soru →

A technician is troubleshooting a Windows 10 workstation that enters a continuous reboot loop displaying a stop error (BSOD) immediately after the Windows splash screen appears. The issue began right after a user installed an updated video card driver. The technician boots the system into the Windows Recovery Environment (WinRE). Which of the following is the most appropriate action to take first to resolve the startup failure?

Cevabı ve açıklamayı göster

Cevap: Boot the system into Safe Mode and roll back the display adapter driver using Device Manager.

Cevap

Boot the system into Safe Mode and roll back the display adapter driver using Device Manager.
Because the system crashes during kernel initialization right after a driver update, entering Safe Mode allows Windows to start using generic base drivers. Once logged in under Safe Mode, the technician can access Device Manager and revert the display adapter driver to its previous functional state.

Adım Adım Çözüm

1
Identify the root cause of the startup failure.
The BSOD during startup following a driver update indicates a kernel-level driver incompatibility rather than a damaged boot file or hardware disk failure.
Understanding the timeline (occurring immediately after a driver update) isolates the fault to the updated display driver.
2
Select the appropriate recovery environment option to bypass the faulty driver.
Booting into Safe Mode loads basic display drivers (VGA/GOP) instead of the corrupted third-party graphics driver.
Safe Mode prevents non-essential drivers from loading, allowing Windows to boot successfully into a basic desktop state.
3
Remediate the driver issue.
Device Manager is opened to select the graphics card properties and execute 'Roll Back Driver'.
Rolling back reinstates the previously working driver version and resolves the boot loop.

Anahtar Kavram

Troubleshooting Windows Driver-Induced Boot Crashes via Safe Mode
Soru 2774Soru →

An IT technician at a pharmaceutical testing laboratory is responding to a Windows workstation that exhibits heavy background network activity, unauthorized pop-up windows, and degraded performance. The technician confirms the presence of malware. Which TWO of the following actions should the technician take NEXT prior to initiating anti-malware remediation tools?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disconnect the workstation's Ethernet cable and disable Wi-Fi adapters.; Disable Windows System Restore (System Protection) on the infected workstation.

Cevap

The technician must isolate the infected system by disconnecting network interfaces and disable Windows System Restore prior to executing malware remediation.
According to CompTIA's standard 7-step malware removal procedure (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate, 5. Schedule scans/updates, 6. Enable System Restore, 7. Educate end user), immediately after identifying the malware symptoms, the technician must isolate the infected system (unplug network interfaces) and disable Windows System Restore before scanning or attempting removal.

Adım Adım Çözüm

1
Identify malware symptoms
Malware presence confirmed based on network activity, pop-ups, and performance degradation.
Completes Step 1 of CompTIA's 7-step malware removal process.
2
Isolate the infected system
The computer is disconnected from Ethernet and Wi-Fi networks.
Prevents lateral malware movement across the local subnet (Step 2).
3
Disable System Restore
System protection is turned off and previous restore points are cleared.
Prevents the OS from creating backups containing malicious executable files (Step 3).

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure: Step 2 (Isolate) and Step 3 (Disable System Restore) must occur before Step 4 (Remediate).
Soru 2775Soru →

A Windows workstation displays the error message 'Boot Configuration Data for your PC is missing or contains errors' upon powering on. A technician needs to manually repair the boot records and rebuild the BCD store using the Windows Recovery Environment (WinRE) Command Prompt. In which order should the technician execute these troubleshooting steps to resolve the boot failure?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence starts with accessing the WinRE Command Prompt via installation media, running bootrec /fixmbr to repair the MBR, running bootrec /fixboot to update the boot sector, executing bootrec /scan-os to detect Windows installations, and finally running bootrec /rebuildbcd to construct a fresh BCD store.
To repair a corrupt BCD file and bootloader issue, the technician must first gain command-line access via WinRE media. Next, core boot infrastructure must be repaired in order: fixing the MBR code, writing a clean volume boot sector, scanning for unlisted Windows OS installations, and finally executing the BCD rebuild operation to write valid entries back to disk.

Adım Adım Çözüm

1
Boot into Windows Recovery Environment (WinRE) via USB/DVD media and open Command Prompt.
Access to offline command-line repair tools is established.
When Windows fails to boot, offline recovery tools are required to repair system files and boot structures.
2
Run bootrec /fixmbr.
The Master Boot Record is updated without altering the partition table.
Ensures the basic system boot loader code is valid before repairing volume-level boot records.
3
Run bootrec /fixboot.
A new boot sector is written to the active system volume.
Allows the boot partition to properly load BOOTMGR.
4
Run bootrec /scan-os.
Identifies installed Windows operating systems not currently tracked in the BCD.
Confirms the OS partition is recognized before performing a BCD rebuild.
5
Run bootrec /rebuildbcd.
The BCD file is completely reconstructed with proper boot entries.
Restores the boot configuration entries required to launch the operating system successfully.

Anahtar Kavram

Rebuilding BCD and fixing boot structures using bootrec utility in WinRE
Soru 2776Soru →

An IT support specialist at an esports venue is troubleshooting a Windows 11 video production workstation that is displaying unexpected pop-up warnings and suffering from degraded system performance. The specialist confirms the presence of active malware and immediately disconnects the Ethernet cable and disables all wireless network adapters to isolate the host. According to standard CompTIA malware removal procedures, which of the following actions should the specialist perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable Windows System Restore on the infected workstation.

Cevap

Disable Windows System Restore on the infected workstation.
According to CompTIA's official 7-step malware remediation process (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate, 5. Schedule scans/updates, 6. Enable System Restore, 7. Educate end user), once the infected machine is isolated from the network (Step 2), the immediate next requirement is to disable System Restore (Step 3). This removes existing restore points so infected system files cannot linger or be restored later.

Adım Adım Çözüm

1
Identify the current step in the CompTIA 7-step malware removal process.
The technician has completed Step 1 (Identify malware symptoms) and Step 2 (Isolate infected systems by disconnecting network interfaces).
Correct progression through the procedure requires completing steps in sequential order.
2
Determine the mandatory action required for Step 3.
Step 3 dictates disabling System Restore in Windows.
Disabling System Restore purges existing restore points and prevents Windows from automatically caching malicious files into system restore archives during cleanup.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process
Soru 2777Soru →

A system administrator encounters a 'Missing operating system' error message upon starting a legacy BIOS-based desktop computer with a Master Boot Record (MBR) partition scheme. After booting into the Windows Recovery Environment (WinRE) Command Prompt, the administrator confirms that all storage drives and system partitions are physically healthy and detected. Which command-line entry should the administrator execute first to overwrite the corrupted boot code on the system partition without altering existing partition tables?

Cevabı ve açıklamayı göster

Cevap: bootrec /fixmbr

Cevap

The administrator should run bootrec /fixmbr to overwrite the corrupted Master Boot Record code on the system partition without affecting existing partitions.
Executing bootrec /fixmbr writes a Master Boot Record compatible with the installed Windows operating system to the system partition. This directly resolves 'Missing operating system' errors caused by corrupted MBR code without modifying or wiping existing partition tables.

Adım Adım Çözüm

1
Analyze the error symptom and system architecture
The symptom 'Missing operating system' on a legacy BIOS/MBR system indicates that the system BIOS loaded the MBR code, but the MBR code itself is corrupted or invalid and cannot locate/hand off control to the active partition boot sector.
Identifying legacy MBR boot stages narrows down the necessary repair utility to bootrec switches targeting the master boot code.
2
Evaluate bootrec repair switches
The switch /fixmbr writes an MBR-compatible master boot code to the system partition without altering partition tables.
This directly fixes the damaged MBR bootstrap code while preserving partition layout and volume structures.

Anahtar Kavram

Troubleshooting Windows OS Startup and Boot Errors using bootrec switches
Tahmini Süre:1m 15s
Soru 2778Soru →

A desktop support technician at a maritime shipping terminal is responding to a Windows workstation exhibiting active ransomware symptoms. Place the following CompTIA standard malware remediation actions in the correct order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of steps is: 1. Disconnect the workstation's network cable and disable wireless interfaces. 2. Turn off Windows System Restore. 3. Update anti-malware definitions and execute a complete remediation scan. 4. Re-enable Windows System Restore and create a clean restore point. 5. Provide security awareness guidance to the terminal operator on phishing prevention.
According to CompTIA's 7-step malware removal procedure, the technician must first isolate the system from the network to stop lateral spread. Next, System Restore must be disabled so that infected files are not retained in system restore points. Once disabled, the technician updates anti-malware signatures and remediates the computer. After confirming remediation, System Restore is re-enabled and a new restore point is generated. Finally, educating the end user prevents recurrence.

Adım Adım Çözüm

1
Isolate the infected device.
Prevents ransomware from scanning network shares or propagating across the port terminal network.
CompTIA Step 2 requires network isolation before performing any changes or scans on the host.
2
Disable System Restore.
Prevents Windows from saving infected binaries or encrypted state into system restore points.
CompTIA Step 3 requires turning off System Restore prior to cleaning the system.
3
Remediate the infected system.
Cleans the malware files from the hard drive and memory.
CompTIA Step 4 involves updating anti-malware software and scanning/removing malicious content.
4
Enable System Restore and generate a clean restore point.
Creates a valid, uninfected system snapshot for future rollback capabilities.
CompTIA Step 6 ensures system protection is restored only after infection removal is confirmed.
5
Educate the end user.
Reduces the likelihood of repeated infection through social engineering vectors.
CompTIA Step 7 completes the standard malware removal workflow.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process
Tahmini Süre:1m 15s
Soru 2779Soru →

A Windows workstation fails to boot after a failed third-party hardware driver update, repeatedly freezing during the initial Windows boot splash screen. A technician accesses the Windows Recovery Environment (WinRE) Command Prompt to diagnose and resolve the boot failure offline. Which TWO command-line actions or utilities should the technician use to resolve the corrupted driver issue and allow the operating system to start successfully? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows to verify and repair system files in the offline installation.; Use bcdedit /set {default} safeboot minimal to force the system to launch in Safe Mode on the next startup.

Cevap

The correct troubleshooting actions are executing the System File Checker command with offline directory parameters to replace corrupted files and configuring BCDedit to force the workstation into Safe Mode to isolate and remove the faulty driver.
When Windows fails during the driver loading phase, running System File Checker with offline flags (/offbootdir and /offwindir) allows WinRE to replace damaged binaries. Concurrently, setting the safeboot minimal flag via BCDedit forces Windows into Safe Mode on the next reboot, which bypasses non-essential third-party drivers and allows the technician to log in and uninstall the offending update.

Adım Adım Çözüm

1
Identify the cause of the boot failure.
The failure occurs during driver initialization after a driver update, pointing to corrupt system files or a third-party driver conflict.
Isolating whether the boot failure is caused by boot loader corruption versus driver/system file corruption dictates the appropriate repair commands.
2
Run System File Checker targeted at the offline target Windows installation directory.
The utility scans integrity of system files on C:\Windows and replaces corrupted system binaries without booting into full Windows.
Standard sfc /scannow requires offline flags (/offbootdir and /offwindir) when executed from WinRE command prompt.
3
Configure the system to boot into Safe Mode using BCDedit.
The default boot loader configuration is updated with the safeboot minimal flag.
Safe Mode loads only core system drivers, bypassing the corrupted third-party driver and granting access to Device Manager for driver rollback.

Anahtar Kavram

Offline System File Repair and Boot Configuration Manipulation in WinRE
Soru 2780Soru →

A front desk supervisor at a boutique hotel reports that a Windows 11 workstation is displaying unexpected rogue security pop-ups and attempting unauthorized outbound network traffic. An IT technician immediately disconnects the workstation's Ethernet cable to isolate the system. According to CompTIA's standard 7-step malware remediation process, which action should the technician take NEXT?

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.

Cevap

Disable System Restore in Windows.
According to CompTIA's official 7-step malware removal procedure, after identifying symptoms (Step 1) and isolating the infected system (Step 2), the immediate next action is to disable System Restore (Step 3). Disabling System Restore prevents Windows from preserving infected system files in restore points.

Adım Adım Çözüm

1
Identify completed steps in the CompTIA 7-step malware remediation process.
Malware symptoms were identified (Step 1) and the system was isolated from the network by pulling the network cable (Step 2).
Determining the current progress pinpoints the required sequential action.
2
Select the mandatory next step following isolation.
Step 3 requires disabling System Restore in Windows.
Disabling System Restore prevents Windows from backing up malware-infected system files into recovery snapshots.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
ÖncekiSayfa 139 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin