Examkin

Tüm alıştırma soruları

423 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 361Soru →

A technician is remediating a enterprise workstation where the web browser frequently redirects to unauthorized ad portals and displays intrusive desktop notifications. What is the correct sequence of steps the technician should follow to remediate the web browser configuration?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence is: 1) Disconnect the workstation from the local network to isolate the system, 2) Inspect browser add-ons and uninstall unrecognized or suspicious extensions, 3) Clear the browser cache, cookies, and reset site notification permissions, and 4) Restore the default search engine, home page settings, and browser startup preferences.
The correct remediation sequence begins with system isolation to prevent further remote activity or secondary downloads. Next, the underlying cause of redirect behavior—malicious browser extensions—must be removed. Once the extensions are uninstalled, clearing the browser cache, cookies, and site notification permissions revokes rogue push notification access. Finally, restoring the search engine defaults and home page configuration establishes clean browser operation.

Adım Adım Çözüm

1
Isolate the compromised system from the network.
Stops ongoing data transfer and prevents further malicious script injection or remote adware downloads.
Isolation is the immediate standard practice when dealing with browser hijacking or malware symptoms.
2
Remove unauthorized or malicious browser extensions.
Eliminates the root vector overriding standard search requests and injecting pop-ups.
Extensions often hold persistent control over browser behavior.
3
Purge temporary internet files, tracking cookies, and clear push notification permissions.
Removes existing persistent session tokens and revokes rogue push notification approvals.
Pop-ups are frequently driven by lingering notification permissions and stored site data.
4
Reconfigure search engine defaults and home page settings to corporate standards.
Ensures clean browser launches going forward.
Hijackers frequently modify default search URLs and startup pages.

Anahtar Kavram

Web Browser Security and Hijacker Remediation Workflow
Tahmini Süre:1m 30s
Soru 362Soru →

A systems administrator detects active ransomware activity on a master workstation controlling live digital media encoding streams in a television broadcasting studio. Following the standard CompTIA 7-step malware removal process, in what precise chronological sequence should the administrator perform the following remediation steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence follows the CompTIA 7-step malware removal methodology: First, isolate the system by disconnecting network interfaces; second, disable System Restore and delete previous restore points; third, remediate the workstation by updating definitions offline and scanning in Safe Mode; fourth, re-enable System Restore and generate a clean restore point; fifth, educate the end user on security best practices.
CompTIA mandates a strict 7-step malware removal process: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate end user. Network isolation must precede all remediation to halt lateral propagation. Disabling System Restore deletes infected recovery snapshots. Remediating eradicates the active infection. System Restore is re-enabled only when the system is verified clean, followed finally by user education.

Adım Adım Çözüm

1
Isolate the infected workstation by disconnecting all wired and wireless network interfaces.
Prevents ransomware from communicating with command-and-control servers or spreading across network shares.
System isolation is Step 2 of CompTIA's process and must occur immediately after threat identification.
2
Disable Windows System Restore and delete existing restore snapshots.
Eliminates malware persistence mechanisms embedded in volume shadow copies.
Disabling System Restore is Step 3, preventing the system from automatically backing up infected files.
3
Boot into Safe Mode, apply offline anti-malware updates, and complete a full system scan.
Detects and quarantines active ransomware binaries and startup entries without active network reinfection.
System remediation is Step 4, using updated tools in a minimal environment to clear threats.
4
Turn System Restore back on and manually build a new clean system restore point.
Restores OS protection functionality with a confirmed malware-free recovery point.
Enabling System Restore is Step 6 and must strictly take place after successful scan remediation.
5
Provide targeted security awareness training to the broadcast engineer.
Improves user vigilance against social engineering, malicious email links, and drive-by downloads.
End-user education is Step 7, completing the malware remediation workflow.

Anahtar Kavram

CompTIA 7-Step Malware Removal Best Practices
Soru 363Soru →

A desktop support technician at an automotive assembly plant is responding to a workstation infected with rogue adware causing unexpected browser redirects. The technician has already identified and researched the malware symptoms. Arrange the subsequent remediation actions in the correct chronological order according to the standard CompTIA 7-step malware removal process.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the CompTIA 7-step malware remediation process: first quarantine the infected workstation, then disable System Restore, proceed with updating definitions and scanning for malware removal, re-enable System Restore and create a clean restore point, and finish by educating the end user.
The standard CompTIA 7-step malware removal framework mandates the following exact order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware definitions and scan/remove), 5. Schedule updates and enable auto-scans, 6. Enable System Restore and create a restore point, and 7. Educate the end user. The sequence from isolating the system to educating the user adheres strictly to this standard.

Adım Adım Çözüm

1
Quarantine the infected workstation
Network communication is terminated, isolating the rogue adware from the rest of the assembly plant network.
Step 2 of the CompTIA process prevents malware from spreading or contacting command-and-control servers.
2
Disable Windows System Restore
Existing restore points containing malicious files are deleted.
Step 3 prevents accidental reinfection if a restore point is restored in the future.
3
Update anti-malware signatures and perform full system scan
The rogue adware is identified and completely removed from the host.
Step 4 performs the core remediation and file cleanup using updated detection definitions.
4
Re-enable System Restore and create a fresh restore point
A clean, verified system baseline snapshot is preserved.
Step 6 re-establishes system protection only after verifying the machine is clean.
5
Educate the end user
The user learns best practices to prevent similar infections.
Step 7 is the final administrative action to reduce human security vulnerabilities.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Tahmini Süre:1m 30s
Soru 364Soru →

A user reports that a custom inventory management application freezes and stops responding whenever large database reports are executed. Place the troubleshooting steps in the correct order to identify and resolve the blocking process causing the application freeze.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct troubleshooting sequence is: 1) Open Task Manager using Ctrl + Shift + Esc to view resource usage, 2) Launch Resource Monitor from the Performance tab, 3) Right-click the non-responsive process and select Analyze Wait Chain, and 4) Terminate the specific blocking process identified in the wait chain tree.
The proper administrative workflow begins with establishing basic process visibility in Task Manager, advancing to Resource Monitor for detailed thread inspection, executing Analyze Wait Chain to discover dependent deadlocks, and finally terminating the blocking process to restore application functionality.

Adım Adım Çözüm

1
Press Ctrl + Shift + Esc to open Task Manager.
Task Manager opens, displaying basic system utilization metrics and identifying which processes are listed as 'Not Responding'.
Establishing initial diagnostic visibility allows the technician to confirm system state before performing deeper analysis.
2
Open Resource Monitor from the Performance tab.
Resource Monitor opens, granting access to process-level thread queues, disk activity, and wait chain analysis.
Task Manager shows summary data, but Resource Monitor provides the advanced thread analysis needed to diagnose process deadlocks.
3
Right-click the hanging process under the CPU tab and click Analyze Wait Chain.
A window opens displaying the process thread tree, highlighting any subordinate or sibling process holding locked resources.
Wait Chain Analysis pinpoints the precise secondary thread or process causing the primary application to freeze.
4
Select the blocking process PID shown in the wait tree and end the process.
The blocking thread releases locked handles, allowing the primary application to resume execution or close cleanly.
Targeting the specific blocking dependency resolves the deadlock without abruptly terminating un-saved application data unless necessary.

Anahtar Kavram

Process Wait Chain Analysis in Windows Resource Monitor
Soru 365Soru →

An IT technician is preparing a newly imaged Windows workstation for deployment in a corporate environment. To ensure defense-in-depth and follow workstation hardening best practices, place the following security configuration steps in the correct operational sequence, from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for workstation hardening is: First, install OS security patches. Second, secure built-in accounts and default administrative credentials. Third, disable unnecessary services, ports, and AutoRun features. Fourth, enforce local policy controls such as screen saver password locks and account lockout rules. Fifth, activate host-based firewall protection and enable full disk encryption.
Hardening follows a logical sequence: patching vulnerabilities first, securing baseline user/admin accounts second, minimizing attack surfaces (ports/services/autorun) third, enforcing screen saver lockouts and policy rules fourth, and finalizing with host firewall and full disk encryption protections.

Adım Adım Çözüm

1
Patch OS Vulnerabilities
Known software flaws are remediated prior to network exposure.
System updates prevent initial compromise of baseline software components.
2
Secure Account Baselines
Default administrative entry points are removed.
Disabling the Guest account and altering default admin details removes predictable attack targets.
3
Minimize Attack Surface
Unused communication ports and autorun vulnerabilities are closed.
Disabling unneeded services and automatic execution scripts prevents automated malware execution.
4
Enforce Local Security Policies
Inactivity locks and password lockout protections are active.
Enforcing screen saver timeouts and account lockouts mitigates physical access and brute-force threats.
5
Activate Host Boundary Protections & Encryption
Data at rest and host network traffic are shielded.
Enabling host firewalls and BitLocker completes defense-in-depth protection before full deployment.

Anahtar Kavram

Workstation Hardening Standard Operating Sequence
Soru 366Soru →

A tier-1 desktop technician is dispatched to handle an enterprise Windows 11 workstation that has been infected with rogue software generating persistent security alerts and attempting unauthorized network transmissions. Place the following remediation steps in the exact sequence required by the standard CompTIA 7-step malware removal procedure.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence for remediating the infected system according to the CompTIA 7-step malware removal process is: 1. Unplug physical network connections (Isolate system) -> 2. Disable System Protection (Disable System Restore) -> 3. Boot into Safe Mode and run anti-malware scans (Remediate system) -> 4. Configure automated recurring scans and updates (Schedule scans/updates) -> 5. Re-enable System Protection and create a fresh baseline restore point (Enable System Restore).
The CompTIA standard 7-step malware removal process follows a strict linear sequence: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware software; scan and use removal techniques), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate end users. Disconnecting network interfaces isolates the host (Step 2), followed by disabling System Restore to clear infected shadow copies (Step 3). System remediation via Safe Mode anti-malware scans follows (Step 4), after which automated update/scan routines are scheduled (Step 5). Finally, System Restore is safely re-enabled to establish a clean baseline point (Step 6).

Adım Adım Çözüm

1
Isolate the infected machine from the network.
Network communication is halted, containing malware propagation.
Isolation must occur immediately after identifying symptoms to protect adjacent network infrastructure.
2
Disable System Restore / System Protection.
All existing restore points containing latent malicious files are removed.
If System Restore remains enabled, infected system files stored within restore points can cause reinfection after cleanup.
3
Remediate the infected system using anti-malware tools.
Malware files, registry keys, and processes are detected and removed.
Remediation requires updating definitions and running thorough scans, often in Safe Mode to prevent active process tampering.
4
Schedule automatic scans and verify software updates.
System defensiveness is reinforced against prospective threat variants.
Establishing automated scan schedules ensures ongoing proactive monitoring and patch compliance.
5
Enable System Restore and create a clean restore point.
A reliable, uncorrupted recovery baseline is established.
System Restore must only be re-enabled after complete verification of malware removal to ensure the newly created restore point is uninfected.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 367Soru →

A user reports that a video rendering application unexpectedly closes with memory allocation errors on a Windows 11 workstation during high-load processing. Place the following troubleshooting steps in the correct logical order for a technician to isolate the root cause and resolve the performance crash.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins by observing real-time memory usage in Task Manager, checking Event Viewer System logs for Event ID 2004 resource exhaustion entries, inspecting the paging file configuration in Advanced System Properties, and finally reconfiguring the virtual memory to be automatically managed followed by a system reboot.
The correct troubleshooting workflow follows standardCompTIA methodology: first observe live performance metrics in Task Manager during symptom reproduction, second confirm diagnostic log evidence in Event Viewer (Event ID 2004 for resource exhaustion), third inspect the relevant control tool (Paging file settings in Advanced System Properties), and fourth apply the corrective change by enabling system-managed paging file sizing and restarting.

Adım Adım Çözüm

1
Monitor real-time system resource metrics in Task Manager.
Identifies immediate resource bottlenecks and confirms whether physical RAM utilization spikes to 100% during the workload.
Live diagnostic observation is the first step in verifying user-reported symptoms before modifying configuration settings.
2
Analyze historical system event logs in Event Viewer.
Locates Event ID 2004 logs generated by the Resource-Exhaustion-Detector, confirming virtual memory exhaustion.
Corroborating live observations with system logs verifies that Windows was unable to allocate virtual memory.
3
Inspect virtual memory settings in Advanced System Properties.
Reveals whether the paging file is set too low, disabled, or locked to a static custom size.
Checking configuration settings allows the technician to pinpoint misconfigured paging parameters causing the crash.
4
Apply virtual memory remediation and restart the computer.
Enables Windows to dynamically expand the page file on disk as memory demand increases during rendering operations.
Reconfiguring to system-managed paging file size directly resolves virtual memory allocation limits.

Anahtar Kavram

Troubleshooting Virtual Memory Exhaustion and Application Performance Crashes
Soru 368Soru →

A technician is using the Command Prompt in the Windows Recovery Environment (WinRE) to repair a legacy BIOS/MBR system that fails to boot after unexpected disk corruption. Place the following boot recovery commands in the correct sequential order to repair the Master Boot Record, partition boot sector, scan for Windows installations, and rebuild the boot configuration data.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with repairing the Master Boot Record (bootrec /fixmbr), followed by writing a new boot sector (bootrec /fixboot), scanning for Windows installations (bootrec /scanos), and finally rebuilding the Boot Configuration Data (bootrec /rebuildbcd).
The recovery process must logically proceed from low-level disk structures to higher-level OS configuration stores. First, bootrec /fixmbr fixes the disk's Master Boot Record. Second, bootrec /fixboot repairs the active partition boot sector. Third, bootrec /scanos identifies installed Windows systems. Fourth, bootrec /rebuildbcd reconstructs the Boot Configuration Data database and adds missing Windows entries.

Adım Adım Çözüm

1
Repair the MBR code
System partition MBR code is replaced with compatible Windows boot code.
The MBR contains the master boot code executed by legacy BIOS to find the active partition.
2
Repair the Partition Boot Sector
A new boot sector compatible with the Windows system is written.
The partition boot sector is called by the MBR to locate and run bootmgr.
3
Scan for OS installations
All disks are scanned for Windows installations compatible with the current OS.
Scanning identifies valid OS entries that need to be cataloged for boot loading.
4
Rebuild the BCD Store
The Boot Configuration Data store is completely rebuilt and updated.
Rebuilding the BCD incorporates identified OS installations into the boot menu choices.

Anahtar Kavram

Sequential repair of Windows legacy boot components using bootrec switches in WinRE
Soru 369Soru →

A desktop support technician at a regional meteorology research institute discovers that a Windows workstation used for weather radar monitoring has been infected with a rootkit trojan. The technician needs to execute the standard CompTIA seven-step malware remediation process. Place the following remediation steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the CompTIA 7-step malware remediation process: 1. Isolate the infected workstation (Quarantine), 2. Disable Windows System Restore, 3. Update anti-malware signatures and perform a full scan (Remediate), 4. Re-enable System Restore and create a clean restore point, 5. Train the user on security best practices (Educate user).
The correct order strictly follows the standard CompTIA malware removal procedure: Step 2 (Quarantine/Isolate), Step 3 (Disable System Restore), Step 4 (Remediate by updating definitions and scanning), Step 6 (Enable System Restore and create a restore point), and Step 7 (Educate the end user).

Adım Adım Çözüm

1
Identify and Quarantine the System
Workstation is isolated from the network to stop lateral movement.
Quarantining the system immediately follows identification.
2
Disable System Restore
Infected restore points are deleted so malware cannot reinfect the system via system recovery.
System Restore must be disabled before running cleanup tools.
3
Remediate the System
Anti-malware signatures are updated and scans remove the rootkit.
Remediation involves updating definitions and executing scan and removal techniques.
4
Enable System Restore and Create a Restore Point
A fresh, uninfected baseline restore point is established.
System Restore is re-enabled only after confirming the system is clean.
5
Educate the End User
User learns how the infection occurred and how to prevent recurrence.
User education is always the final step in standard malware remediation.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Soru 370Soru →

An IT technician is dispatched to handle a Windows 11 self-service airport check-in kiosk exhibiting malware symptoms, including unauthorized background network connections and browser redirects. Arrange the following remediation procedures in the correct sequential order according to the official CompTIA 7-step malware removal workflow, starting from the earliest step to be performed.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order follows CompTIA's 7-step malware removal process: 1. Disconnect network interfaces (Isolate), 2. Turn off System Protection (Disable System Restore), 3. Boot into Safe Mode and run remediation tools (Remediate), 4. Configure automated scans and OS updates (Schedule scans/updates), and 5. Re-enable System Protection and create a fresh restore point (Enable System Restore).
The correct sequence strictly follows the CompTIA 7-step malware remediation procedure. The technician must first isolate the system by disconnecting network interfaces (Step 2), disable System Restore to purge infected points (Step 3), remediate the system in Safe Mode (Step 4), schedule recurring scans and install updates (Step 5), and finally re-enable System Restore to establish a clean restore point (Step 6).

Adım Adım Çözüm

1
Isolate the infected device
Disconnecting network interfaces prevents C2 communication and lateral network movement.
Isolation is Step 2 of the CompTIA 7-step process, performed immediately after identifying symptoms.
2
Disable System Restore / System Protection
Prevents the OS from creating backups containing malware files and purges infected legacy restore points.
Disabling System Restore is Step 3 of the process, required before active scanning and removal.
3
Remediate infected systems
Removes malicious files and registry keys while operating in a minimal environment like Safe Mode.
Remediation is Step 4 of the process.
4
Schedule scans and update security software
Ensures antimalware signatures are current and sets up ongoing prevention mechanisms.
Scheduling scans and updating software is Step 5 of the process.
5
Enable System Restore and create a restore point
Restores system backup functionality and creates a confirmed clean state recovery point.
Re-enabling restore features is Step 6 of the process, performed only after verification of complete remediation.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Soru 371Soru →

An IT technician is tasked with applying baseline security controls to a newly provisioned standalone Windows computer before placing it into service. Place the following workstation hardening steps in the correct chronological order in which they should be executed from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order begins with securing account credentials (disabling Guest and changing default administrative passwords), followed by applying system updates and patches, disabling unneeded services and features to minimize the attack surface, and concluding with configuring local security policy controls.
The proper sequence for workstation hardening dictates securing account access first to prevent administrative exploitation, followed by updating and patching system software, disabling non-essential services and features to minimize attack vectors, and finally establishing local security policy thresholds.

Adım Adım Çözüm

1
Secure local account access
Default administrative credentials are changed and the Guest account is disabled.
Securing local administrative accounts prevents unauthorized privileged access while performing further system management.
2
Apply system updates and patches
The OS is fully updated with current security patches and malware definitions.
Known security vulnerabilities are remediated before applying system policies.
3
Minimize attack surface
Unused services, open network ports, and AutoRun capabilities are turned off.
Closing unused entry points restricts potential vectors for unauthorized network access or unauthorized media execution.
4
Enforce local security policies
Account lockout thresholds and screensaver password requirements are enabled.
Configuring local security policies establishes operational session security for everyday usage.

Anahtar Kavram

Workstation Hardening Procedural Sequence
Soru 372Soru →

A technician boots a UEFI-based Windows 11 computer into the Windows Recovery Environment (WinRE) command prompt to resolve a boot error caused by a corrupted Boot Configuration Data (BCD) store. Place the recovery steps in the correct chronological sequence to assign a drive letter to the EFI System Partition (ESP) and rebuild the boot files.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1. Launch the diskpart utility to inspect and manage disk volumes -> 2. Locate the hidden FAT32 EFI System Partition and execute assign letter=S to grant it a volume letter -> 3. Exit diskpart and run bcdboot C:\Windows /s S: /f UEFI to copy fresh boot files to the partition -> 4. Execute bootrec /rebuildbcd to scan all disks for Windows installations and rebuild the BCD configuration.
To repair boot files on a UEFI/GPT system, a technician must first open diskpart to inspect hidden volumes, assign a drive letter (such as S:) to the FAT32 EFI System Partition, exit diskpart to use bcdboot to copy fresh boot files to S:, and finish by executing bootrec /rebuildbcd to update the Boot Configuration Data store.

Adım Adım Çözüm

1
Start the disk management console
The command prompt enters the diskpart interactive shell.
Diskpart is needed to identify volume numbers and modify partition attributes not accessible via standard command prompt paths.
2
Select ESP and assign drive letter S:
The FAT32 system partition becomes accessible via drive path S:.
Command-line tools like bcdboot target specific drive letters when restoring UEFI boot structures.
3
Run bcdboot command
Fresh boot files are copied from C:\Windows into the S: partition formatted for UEFI firmware.
Recreating the main boot files restores missing or corrupted boot manager components.
4
Run bootrec /rebuildbcd
The Windows installation is detected and added to the newly restored BCD store.
Rebuilding the BCD store links the newly generated EFI boot files with the main OS partition.

Anahtar Kavram

EFI System Partition (ESP) identification and BCD repair sequence in WinRE
Soru 373Soru →

A technician is troubleshooting an enterprise accounting application that periodically freezes and crashes on a Windows 11 workstation. Arrange the troubleshooting steps in the correct order to systematically identify and isolate the root cause of the application crash.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: First, inspect the Event Viewer Application log for Event ID 1000 to gather crash details; second, open Resource Monitor and analyze the wait chain for process locks; third, perform a clean boot via System Configuration; fourth, restart and test the application in the isolated clean boot state.
Troubleshooting Windows application crashes requires a methodical progression from non-intrusive log inspection to active environmental isolation. First, inspecting Event Viewer for Event ID 1000 provides details about the faulting module. Second, using Resource Monitor's Analyze Wait Chain checks for active process blocks or deadlocks. Third, using System Configuration (msconfig) to disable non-Microsoft services establishes a controlled clean boot baseline. Finally, restarting and running the application in this clean boot environment confirms whether background software conflicts were the cause.

Adım Adım Çözüm

1
Gather crash telemetry from the Event Viewer Application log (Event ID 1000).
Obtains the specific faulting module path and error exception code.
Diagnostic investigation must start with baseline log analysis before modifying system configurations.
2
Examine process dependencies using Resource Monitor's Analyze Wait Chain feature.
Identifies whether the application process is locked waiting for a thread or secondary process.
Determines if live thread deadlocks or resource contention are causing application freezes.
3
Configure a clean boot state using System Configuration (msconfig) by hiding all Microsoft services and disabling remaining services and startup items.
Prepares the OS environment free of non-essential third-party services.
Isolates the core operating system and application from potential background software interference.
4
Reboot the system and execute the application to observe performance.
Determines if the crash recurs in the isolated environment.
Verifies whether third-party startup software or services were responsible for the application instability.

Anahtar Kavram

Windows Application Troubleshooting and Diagnostic Isolation Workflow
Soru 374Soru →

A cybersecurity technician at a automated logistics fulfillment hub is responding to a suspected malware infection on a inventory management workstation. Place the following remediation steps in the exact order required by the standard CompTIA malware removal procedure.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for malware remediation is: 1. Disconnect the affected workstation (Quarantine system), 2. Disable System Restore, 3. Update anti-malware signatures and scan (Remediate system), 4. Turn System Restore back on and generate a new restore point, 5. Conduct security awareness training with the workstation user.
The correct sequence follows the standard 7-step CompTIA malware remediation process: Quarantine the infected system, Disable System Restore, Remediate the system (update signatures and perform scans), Enable System Restore and create a restore point, and finally Educate the end user.

Adım Adım Çözüm

1
Isolate the compromised machine from the network.
The machine is quarantined, containing the malware outbreak.
Prevents lateral network spread.
2
Disable Windows System Restore.
Previous restore points containing infection files are deleted.
Ensures malware cannot survive or be restored from infected backup states.
3
Update antivirus definitions and scan the system.
Malicious software components are identified and quarantined/deleted.
Cleans active threats from memory and drive storage.
4
Re-enable System Restore and create a clean snapshot.
System protection is restored with a pristine baseline.
Establishes a clean point of recovery for future OS protection.
5
Provide end-user training.
The user understands risk factors and safe computing habits.
Reduces recurrence of malware infections caused by human error.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Soru 375Soru →

A cybersecurity technician at a regional credit union is responding to a Windows 11 workstation exhibiting unauthorized background outbound traffic and rogue spyware pop-ups. The technician has confirmed the presence of malware on the system. Place the standard CompTIA remediation steps in the correct chronological order to resolve the incident.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Quarantine the infected workstation by disconnecting network cables and disabling wireless adapters; 2) Disable System Restore in Windows settings; 3) Update anti-malware signatures and perform a comprehensive system scan; 4) Re-enable System Restore and generate a clean system restore point; 5) Provide end-user security awareness training.
The standard CompTIA 7-step malware removal process follows a specific lifecycle: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and use removal techniques), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the user. The correct ordering strictly adheres to this workflow by isolating the endpoint first, disabling restore snapshots prior to cleaning, running updated anti-malware tools, re-enabling restore features once clean, and finishing with end-user education.

Adım Adım Çözüm

1
Isolate the compromised system (Quarantine).
Network communication is severed, preventing lateral movement across the credit union network.
According to the CompTIA 7-step malware removal procedure, isolation/quarantine immediately follows identification.
2
Disable System Restore.
All existing restore points (which may contain infected files) are purged.
Disabling System Restore prevents Windows from accidentally restoring infected system files during recovery.
3
Remediate the system (Update engine and scan/remove malware).
Malware components are identified, quarantined, and deleted from the operating system.
Updating signature files first guarantees maximum detection capabilities before running removal scripts.
4
Enable System Restore and create a restore point.
A clean backup baseline is established for future operating system protection.
System protection should only be re-established after verification that all malicious software has been eliminated.
5
Educate the end user.
The workstation user learns safe browsing and email hygiene practices.
User education is the critical final step to prevent future vector exploitation.

Anahtar Kavram

CompTIA 7-step Malware Remediation Process
Soru 376Soru →

A desktop technician is responding to a suspected ransomware infection on a workstation used by a rare manuscripts archivist at a university library. The technician needs to execute the standard CompTIA malware removal process. Place the following remediation actions in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence for CompTIA malware removal is: 1) Disconnect the workstation from the network, 2) Disable Windows System Restore, 3) Update anti-malware signatures and perform a comprehensive system scan, 4) Re-enable System Restore and manually create a clean restore point, and 5) Provide security awareness guidance to the archivist.
CompTIA defines a strict 7-step malware removal procedure: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems (update definitions & scan/remove), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Arranging the actions following this standard workflow places network isolation first, followed by disabling restore features, executing scans/remediation, generating a new clean restore point, and concluding with user education.

Adım Adım Çözüm

1
Isolate the infected machine immediately
Network communication is terminated, stopping malware from spreading to library shares.
Isolation must occur right after identifying symptoms to protect adjacent network infrastructure.
2
Turn off System Restore in Windows
Existing restore points containing malware binaries are cleared.
Prevents accidental restoration of infected system files later.
3
Remediate by updating definitions and scanning
Malware files, registry keys, and active processes are identified and quarantined.
Ensures the anti-malware engine uses current threat signatures to eradicate the payload.
4
Enable System Restore and create a clean restore point
A known-good baseline recovery point is established.
Restores protection capabilities only after verifying the operating system is completely clean.
5
Educate the user
The archivist learns best practices to prevent similar future infections.
Finalizes the remediation lifecycle by addressing human risk factors.

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Tahmini Süre:1m 30s
Soru 377Soru →

A Windows 10 workstation experiences a Blue Screen of Death (BSOD) during boot pointing to a corrupted critical system file. The automated Startup Repair tool fails to resolve the issue. Place the troubleshooting steps in the correct chronological order to repair the system files using the Windows Recovery Environment (WinRE) Command Prompt.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with booting into WinRE and launching the Command Prompt, determining the offline Windows drive letter using diskpart or dir, running sfc with the /offbootdir and /offwindir flags, and finally rebooting the workstation normally to verify boot functionality.
To repair corrupted Windows boot files offline, a technician must first gain command-line access via WinRE. Before running repair utilities, the technician must verify which volume letter corresponds to the installed OS because WinRE drive letter mappings differ from normal operation. Next, running System File Checker requires explicit parameters (/offbootdir pointing to the boot partition and /offwindir pointing to the Windows directory) to scan the correct offline files. Finally, restarting the machine confirms whether the repairs allowed the operating system to boot normally.

Adım Adım Çözüm

1
Boot into WinRE and open Command Prompt
Establishes an un-booted environment where locked system files can be modified.
WinRE loads into a RAM disk (X: drive), freeing up the main OS partition for repair operations.
2
Determine the offline Windows drive letter
Identifies the correct drive assignment for the installed operating system.
WinRE does not always assign C: to the primary Windows partition, requiring manual volume verification.
3
Run sfc /scannow with /offbootdir and /offwindir switches
Scans the offline system partition and replaces damaged Windows system files.
Standard sfc /scannow without switches would only attempt to scan the WinRE temporary RAM drive instead of the corrupted OS installation.
4
Reboot the system
Tests system bootability.
Ensures that the replaced system files allow Windows to initialize normally.

Anahtar Kavram

Offline System File Repair in Windows Recovery Environment
Soru 378Soru →

A technician is troubleshooting a UEFI/GPT-based Windows 11 workstation that fails to start after a partition resizing attempt. The system displays a black screen with the error message indicating that the boot configuration data is missing. The technician boots the machine into the Windows Recovery Environment (WinRE) Command Prompt to manually reconstruct the EFI System Partition (ESP) structures. Place the correct troubleshooting steps in sequential order to repair the boot files.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct repair sequence requires identifying the EFI System Partition using diskpart, assigning it a temporary drive letter, exiting diskpart to access that drive volume, and running the bcdboot command targeting the new drive letter.
On UEFI systems utilizing GPT disks, startup information is contained within an unassigned FAT32 EFI System Partition (ESP). To repair corrupted BCD files manually, a technician must first open `diskpart` to locate and select the ESP volume, assign a temporary drive letter (e.g., `S:`), exit `diskpart`, and then execute `bcdboot C:\Windows /s S: /f UEFI` to write fresh system boot files to the partition.

Adım Adım Çözüm

1
Open diskpart to locate the hidden partition
Identifies the FAT32 volume representing the EFI System Partition (ESP).
On GPT/UEFI systems, boot files are stored on a separate hidden FAT32 partition rather than the main C: drive.
2
Assign a drive letter to the EFI partition
The hidden ESP becomes accessible under a specific drive letter such as S:.
Command-line repair utilities require a reachable drive path to write new boot files.
3
Exit diskpart utility
Returns control to the standard WinRE Command Prompt interface.
File structure operations and bcdboot utility execution must be executed outside of diskpart.
4
Run BCDBoot repair tool
Generates a clean Boot Configuration Data file and installs UEFI boot binaries to the ESP.
The bcdboot command extracts fresh startup files from C:\Windows and initializes the BCD on the target partition.

Anahtar Kavram

Rebuilding UEFI Boot Files and BCD via Diskpart and BCDBoot Utility
Soru 379Soru →

A point-of-sale (POS) terminal at an organic grocery cooperative is displaying persistent browser redirects and generating unauthorized outbound network traffic. An IT technician must resolve the malware infection using standard CompTIA remediation procedures. Place the following remediation actions in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of actions is: 1) Disconnect the Ethernet cable and disable all wireless interfaces, 2) Disable Windows System Protection to delete existing restore points, 3) Update anti-malware definitions and execute a comprehensive remediation scan in Safe Mode, 4) Re-enable Windows System Protection and create a fresh restore point, and 5) Conduct security awareness training with cashiers.
The official CompTIA 7-step malware remediation process follows a mandatory sequence: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Following this sequence prevents malware propagation across the network, purges infected system snapshots before cleaning, ensures complete removal of malicious payloads, establishes a verified clean recovery baseline, and reinforces preventive user behavior.

Adım Adım Çözüm

1
Quarantine the affected system from the network.
Network communication is terminated, preventing malware from spreading to other workstations or communicating with external command-and-control servers.
Isolation must occur immediately after identifying symptoms (Step 2 of the 7-step procedure).
2
Disable Windows System Protection / System Restore.
All existing restore points are deleted, clearing infected snapshots.
If System Restore remains enabled, malware files can remain saved inside hidden restore point files and re-infect the machine later (Step 3).
3
Update malware definitions and perform remediation scans.
Active malware components and infected binaries are identified and removed.
Remediation cleans the system environment (Step 4).
4
Re-enable System Protection and create a clean restore point.
System Protection is active again and captures a known-good system baseline.
Creating a restore point only after full cleaning ensures future restores revert to an uninfected state (Step 6).
5
Educate the end users.
Staff members learn safe browsing and email hygiene practices.
End-user education reduces human vulnerability to malware re-entry (Step 7).

Anahtar Kavram

CompTIA 7-Step Malware Removal Procedure
Tahmini Süre:1m 30s
Soru 380Soru →

A Windows workstation displays the error message 'Boot Configuration Data for your PC is missing or contains errors' upon powering on. A technician needs to manually repair the boot records and rebuild the BCD store using the Windows Recovery Environment (WinRE) Command Prompt. In which order should the technician execute these troubleshooting steps to resolve the boot failure?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence starts with accessing the WinRE Command Prompt via installation media, running bootrec /fixmbr to repair the MBR, running bootrec /fixboot to update the boot sector, executing bootrec /scan-os to detect Windows installations, and finally running bootrec /rebuildbcd to construct a fresh BCD store.
To repair a corrupt BCD file and bootloader issue, the technician must first gain command-line access via WinRE media. Next, core boot infrastructure must be repaired in order: fixing the MBR code, writing a clean volume boot sector, scanning for unlisted Windows OS installations, and finally executing the BCD rebuild operation to write valid entries back to disk.

Adım Adım Çözüm

1
Boot into Windows Recovery Environment (WinRE) via USB/DVD media and open Command Prompt.
Access to offline command-line repair tools is established.
When Windows fails to boot, offline recovery tools are required to repair system files and boot structures.
2
Run bootrec /fixmbr.
The Master Boot Record is updated without altering the partition table.
Ensures the basic system boot loader code is valid before repairing volume-level boot records.
3
Run bootrec /fixboot.
A new boot sector is written to the active system volume.
Allows the boot partition to properly load BOOTMGR.
4
Run bootrec /scan-os.
Identifies installed Windows operating systems not currently tracked in the BCD.
Confirms the OS partition is recognized before performing a BCD rebuild.
5
Run bootrec /rebuildbcd.
The BCD file is completely reconstructed with proper boot entries.
Restores the boot configuration entries required to launch the operating system successfully.

Anahtar Kavram

Rebuilding BCD and fixing boot structures using bootrec utility in WinRE
ÖncekiSayfa 19 / 22Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin