Examkin

Tüm alıştırma soruları

3551 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 1221Soru →

A technician is troubleshooting a desktop computer that experiences sudden thermal shutdowns during high CPU processing tasks. The technician suspects improper thermal interface material application and heatsink mounting. Place the following remediation steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct troubleshooting sequence begins with gathering baseline temperature metrics in UEFI/BIOS, discharging flea power after removing power cables, detaching and cleaning the CPU/heatsink surfaces, applying new thermal paste and securing the cooler, and finally stress testing the system to verify thermal stability.
CompTIA hardware troubleshooting methodology requires establishing baseline symptoms first (UEFI hardware monitoring), ensuring safety by cutting power and draining flea power second, performing physical surface preparation and reinstallation third, and finally verifying repair integrity under load.

Adım Adım Çözüm

1
Check baseline metrics in UEFI/BIOS
Confirms abnormal idle/load temperatures prior to disassembly.
Establishes a diagnostic baseline according to CompTIA troubleshooting methodology.
2
Disconnect power and drain flea power
Prevents electrical shock and damage to sensitive internal motherboard circuitry.
Safety procedures mandate complete power removal before physical component handling.
3
Unmount cooling unit and clean contact surfaces
Removes old, dried, or improperly applied thermal paste.
Clean metallic surfaces are necessary for optimal thermal transfer.
4
Reapply thermal paste and reinstall heatsink
Restores efficient heat dissipation path from CPU die to heatsink fins.
Correct compound volume and even mounting pressure eliminate thermal gaps.
5
Reboot system and perform load testing
Verifies that CPU temperatures stay within safe operating limits under full load.
Confirming full functionality under stress ensures permanent resolution.

Anahtar Kavram

CPU Thermal Management and Safe Component Replacement Procedures
Tahmini Süre:1m 30s
Soru 1222Soru →

A Tier 2 support technician is assigned an escalated incident regarding a department-wide network authentication failure. The technician isolates the root cause to an expired digital certificate on the enterprise RADIUS server, installs a renewed certificate, and verifies connectivity by successfully authenticating a test account. The technician then enters detailed technical notes into the work history field describing the issue, root cause, and remediation steps. To strictly follow standard ticketing system workflow and ITIL operational practices, which of the following actions must the technician complete NEXT prior to transitioning the ticket to the Closed state?

Cevabı ve açıklamayı göster

Cevap: Obtain explicit confirmation from the affected users or designated department point of contact that normal service has been restored.

Cevap

Obtain explicit confirmation from the affected users or designated department point of contact that normal service has been restored.
In standardized ticketing workflows, once technical resolution and internal testing are complete, the technician must verify service restoration with the impacted end user or business unit representative. Only after user verification is logged should the ticket be formally transitioned to Closed status.

Adım Adım Çözüm

1
Identify the current stage of the ticket lifecycle.
The technician has performed technical troubleshooting, applied the resolution (certificate renewal), verified functionality using a test account, and documented technical work notes.
Establishing the current workflow step determines what requirement remains before ticket finalization.
2
Evaluate standard ITIL and CompTIA ticketing workflow closure criteria.
Before moving an incident ticket from Resolved to Closed, the service desk standard operating procedure requires user confirmation of service restoration and user satisfaction verification.
Technician-side testing verifies functional repair, but user verification ensures business functionality is restored without secondary issues.
3
Select the correct mandatory next step in the workflow.
Contact the end user or client representative to obtain formal verification of resolution before setting the ticket state to Closed.
Closing tickets without end-user verification leads to premature closure of incomplete issues.

Anahtar Kavram

Incident Lifecycle and Ticket Closure Verification Workflow
Tahmini Süre:1m 30s
Soru 1223Soru →

A systems administrator is configuring local security policies on standalone Windows 11 Pro workstations in a multi-user clinical environment. Management requires that when a workstation is locked or restarted, the sign-in screen must not display the account name or email address of the user who previously logged in. Which setting within Local Security Policy (`secpol.msc`) must the administrator enable to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: Interactive logon: Don't display last signed-in

Cevap

Interactive logon: Don't display last signed-in
Enabling 'Interactive logon: Don't display last signed-in' within Local Security Policy (`secpol.msc` under Local Policies > Security Options) ensures Windows will not display the username, full name, or email address of the account that last signed in. This requires any user approaching the workstation to type both their username and password to log in.

Adım Adım Çözüm

1
Identify the administrative tool needed for local security configuration.
Open Local Security Policy (`secpol.msc`).
Security policy configurations for local account display and interactive logon are managed within Local Security Policy.
2
Navigate to the Security Options policy container.
Expand Local Policies and select Security Options.
Security Options contains policies governing interactive logon behaviors and User Account Control parameters.
3
Locate and configure the target logon privacy policy.
Enable 'Interactive logon: Don't display last signed-in'.
Enabling this setting ensures that the sign-in screen remains blank until a user explicitly enters their full credentials.

Anahtar Kavram

Local Security Policy Interactive Logon Settings
Soru 1224Soru →

A system administrator is troubleshooting a hung application named app_service.exe on a Windows workstation. Working exclusively from an elevated Command Prompt, the administrator needs to identify the Process Identifier (PID) of the non-responsive process and then forcefully terminate it along with any child processes it launched. Which of the following commands should the administrator use to accomplish these tasks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: tasklist /fi "imagename eq app_service.exe"; taskkill /pid [PID] /f /t

Cevap

The administrator should run 'tasklist /fi "imagename eq app_service.exe"' to identify the PID, followed by 'taskkill /pid [PID] /f /t' to terminate the process and its child processes.
To identify the process PID from the command line, the tasklist utility with the filter flag (/fi) is used to locate 'imagename eq app_service.exe'. To forcefully terminate that process along with all of its child processes, the taskkill command with the /pid flag, /f (force), and /t (tree) flags must be executed.

Adım Adım Çözüm

1
Filter running processes by name using the tasklist command
Obtain the Process Identifier (PID) corresponding to app_service.exe
Before killing a specific hung process safely by PID, its process ID must be identified from the running tasks list.
2
Execute taskkill specifying the PID, /f (force), and /t (tree/child processes)
Forcefully terminate app_service.exe and all child processes created by it
The /f flag overrides unresponsive states to force closure, while /t ensures sub-processes spawned by the application are also closed.

Anahtar Kavram

Identifying and terminating processes via Windows Command Line using TASKLIST and TASKKILL
Soru 1225Soru →

A system administrator needs to implement WPA3-Enterprise security on an office wireless network to replace an outdated setup. Which TWO of the following authentication components and protocols are required to support a WPA3-Enterprise deployment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Centralized authentication server using RADIUS; IEEE 802.1X framework for network access control

Cevap

The required components for WPA3-Enterprise are a centralized RADIUS authentication server and the IEEE 802.1X access control framework.
WPA3-Enterprise requires both an IEEE 802.1X access control framework and a centralized authentication server (such as RADIUS) to authenticate users individually rather than using a single shared passphrase.

Adım Adım Çözüm

1
Identify the authentication framework required for enterprise wireless security.
Enterprise modes use IEEE 802.1X to manage network access control and pass authentication packets between client devices and the backend server.
802.1X provides the standard structure for enterprise-grade wireless access control.
2
Determine the server component required for user credential verification.
A RADIUS server is used to maintain and check individual user credentials (or certificates) rather than relying on a shared key.
Centralized credential verification allows individual user account auditing and revocation.

Anahtar Kavram

WPA3-Enterprise Security Requirements
Soru 1226Soru →

A field technician responds to a service ticket at a retail store where a thermal receipt printer feeds paper correctly but prints completely blank receipts after a cashier replaced the paper roll. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The thermal paper roll was loaded backward, placing the non-heat-sensitive side toward the thermal printhead.

Cevap

The thermal paper roll was loaded backward, placing the non-heat-sensitive side toward the thermal printhead.
Direct thermal printers use a heated printhead to create images on specially treated, heat-sensitive paper. The chemical coating is only applied to one side of the paper roll. If the roll is inserted upside down, the heating elements contact the uncoated back of the paper, resulting in completely blank receipts while the mechanical feed functions normally.

Adım Adım Çözüm

1
Analyze thermal printing mechanics
Identify that direct thermal printing relies on precise contact between the heated printhead pins and the coated side of heat-sensitive paper without using ink or toner.
Understanding technology-specific mechanisms helps isolate hardware from paper issues.
2
Evaluate the reported symptom
Note that the printer feeds paper normally, indicating mechanical movement and data transmission are working, but no text renders.
This rules out connectivity or motor failures.
3
Determine root cause following recent maintenance context
Since the issue immediately followed a paper roll replacement, loading thermal paper upside down or backward is the primary cause of blank output.
Only one side of direct thermal paper is treated with heat-reactive dye.

Anahtar Kavram

Direct Thermal Printer Operation and Media Orientation
Soru 1227Soru →

A human resources manager receives an urgent phone call from an individual claiming to be a senior network administrator from the corporate help desk. The caller states that an emergency security patch must be applied immediately to the manager's account to prevent a critical data leak, requiring the manager to read back a one-time passcode sent via SMS and approve an incoming multi-factor authentication (MFA) push notification. After the manager complies, an unauthorized user registers a new authentication device and accesses sensitive personnel records. Which of the following social engineering threat types best describes the attack vector used in this scenario?

Cevabı ve açıklamayı göster

Cevap: Pretexting

Cevap

Pretexting is the correct social engineering attack type described in the scenario.
Pretexting occurs when an attacker invents a scenario (the pretext) and assumes a fraudulent identity—such as a corporate help desk technician—to build trust and trick a targeted employee into granting unauthorized access or revealing sensitive verification codes.

Adım Adım Çözüm

1
Analyze the attack vector and communication method presented in the scenario.
The attacker established a fraudulent role (help desk technician) and backstory (emergency security patching) over a voice communication line to manipulate the victim.
Identifying the caller's manipulation tactic helps differentiate between active social interaction vectors and automated/technical attacks.
2
Evaluate the victim's interaction and the resulting compromise.
The victim was duped into disclosing a dynamic multi-factor authentication SMS code and approving an MFA prompt based on the deceptive scenario.
Pretexting relies on creating trust through a realistic narrative (pretext) to convince targets to bypass standard security procedures.
3
Match the observed attack behaviors against CompTIA threat classifications.
Creating an elaborate fake scenario and impersonating authority figures to trick an employee into revealing authentication credentials defines pretexting (specifically vishing/pretexting).
Distinguishing pretexting from passive observation or technical exploitation ensures proper security awareness training and incident reporting.

Anahtar Kavram

Social Engineering Principles and Pretexting Identification
Soru 1228Soru →

A technician is tasked with removing a malware infection from a workstation. According to the standard CompTIA 7-step malware remediation process, in what sequence should the technician perform the following steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence following the CompTIA 7-step malware removal process is: Quarantine the infected system -> Disable System Restore in Windows -> Remediate the infected system by updating anti-malware software and scanning -> Enable System Restore and create a new restore point -> Educate the end user.
The standard CompTIA 7-step malware removal process follows a specific order: 1. Identify malware symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware / scan and remove), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Arranging the actions starting with quarantine and ending with user education strictly aligns with this methodology.

Adım Adım Çözüm

1
Isolate the compromised computer from the network.
System is quarantined, preventing malware spread.
Quarantine is step 2 of the remediation framework.
2
Disable System Restore.
Prevents Windows from saving infected files in restore points.
Disabling System Restore is step 3 of the remediation framework.
3
Update signatures and perform malware removal.
Infected files are identified, cleaned, or deleted.
Remediation is step 4 of the remediation framework.
4
Re-enable System Restore and create a clean restore point.
Restores system protection capabilities with clean state.
Enabling System Restore is step 6 of the remediation framework.
5
Provide security awareness guidance to the user.
Reduces future infection risks.
User education is step 7 (the final step) of the remediation framework.

Anahtar Kavram

CompTIA 7-step Best Practice Methodology for Malware Remediation
Soru 1229Soru →

A systems technician is addressing two hardware tickets regarding computer displays in an enterprise environment:

1. Ticket A: A desktop user upgraded to a 4K monitor, but the screen constantly flickers and drops signal when set to 4K resolution at 60 Hz over a legacy HDMI cable. The monitor displays standard 1080p fine.
2. Ticket B: A mobile user has an ultraportable laptop with a completely dark OLED screen. A desktop support intern suggests replacing the screen's backlight inverter board to restore brightness.

Which of the following troubleshooting statements and resolution steps are CORRECT? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Replacing the inverter board will not resolve the dark laptop screen because OLED displays feature self-emissive pixels and do not use a backlight or inverter board.; The 4K resolution flickering is likely caused by inadequate cable bandwidth, requiring an upgrade to an Ultra High Speed HDMI (HDMI 2.1) cable.

Cevap

Replacing the inverter board will not resolve the dark laptop screen because OLED displays do not use backlight inverters, and the 4K monitor flickering is caused by insufficient video cable bandwidth requiring an upgraded HDMI cable.
The correct statements recognize two fundamental hardware principles: OLED screens do not use backlight inverter boards because each pixel generates its own light, and driving high resolutions like 4K at 60 Hz requires high-bandwidth video cables like Ultra High Speed HDMI cables.

Adım Adım Çözüm

1
Analyze the OLED laptop display symptom.
Recognize that OLED (Organic Light-Emitting Diode) technology utilizes self-emissive pixels rather than a CCFL backlight array.
Because OLED displays do not have backlights, they do not utilize backlight inverter boards. Attempting to replace an inverter on an OLED display is impossible.
2
Analyze the 4K display flickering symptom.
Determine that 4K at 60 Hz requires up to 18 Gbps (HDMI 2.0) or 48 Gbps (HDMI 2.1) of data throughput.
Legacy HDMI cables lack the required shielding and clock speeds for high bandwidth, causing signal degradation and flickering at higher resolutions while functioning at lower resolutions like 1080p.

Anahtar Kavram

Display Technologies (OLED vs LCD) and Cable Bandwidth Constraints
Soru 1230Soru →

A technician is tasked with upgrading a company-owned workstation from 64-bit Windows 10 Home to 64-bit Windows 11 Pro. The user requires that all personal files, application data, and localized settings remain intact after the transition. Which of the following installation methods should the technician use to fulfill this request?

Cevabı ve açıklamayı göster

Cevap: Perform an in-place upgrade by entering a valid Windows 11 Pro product key within the Windows Activation settings.

Cevap

Perform an in-place upgrade by entering a valid Windows 11 Pro product key within the Windows Activation settings.
Performing an in-place upgrade by updating the product key directly in Windows Activation allows a smooth transition from Windows 10 Home to Windows 11 Pro of the same 64-bit architecture, fully preserving installed applications, configuration preferences, and personal files.

Adım Adım Çözüm

1
Evaluate the current operating system architecture and target edition.
The system currently runs 64-bit Windows 10 Home and needs to move to 64-bit Windows 11 Pro while preserving user files and settings.
Matching 64-bit architectures support direct in-place edition upgrades without needing a full system reinstall.
2
Select the correct upgrade path method.
Entering the Pro product key in Windows Activation upgrades the edition directly while retaining all applications and personal data.
In-place edition upgrades modify system components and unlock Pro features seamlessly without data loss.

Anahtar Kavram

Windows OS Edition Upgrade Paths
Soru 1231Soru →

An IT technician is tasked with decommissioning sensitive magnetic hard drives following standard organizational security procedures. Place the following hardware disposal steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for drive disposal is: 1) Log the hard drive serial numbers in the inventory asset management database, 2) Degauss the magnetic hard drives to neutralize data stored on the platters, 3) Pass the sanitized hard drives through a physical shredder, and 4) Obtain and archive a Certificate of Destruction for regulatory compliance.
The secure decommissioning process begins with administrative logging of serial numbers to maintain audit capability. Magnetic degaussing follows to sanitize data content. Physical shredding then destroys the hardware itself. Finally, obtaining and archiving the Certificate of Destruction validates the completed process for compliance records.

Adım Adım Çözüm

1
Identify the initial chain-of-custody administrative requirement.
Documenting serial numbers in the asset database establishes an audit trail before any physical or logical modification.
Tracking must precede destruction so the organization knows which assets are being processed.
2
Perform initial data sanitization on the magnetic media.
Degaussing disrupts the magnetic domains on the platters, sanitizing the stored data.
Sanitizing media prior to physical transport or shredding minimizes data exposure risks.
3
Execute physical destruction of the hardware.
Industrial shredding destroys the physical integrity of the platters and drive electronics.
Physical destruction prevents drive reconstruction.
4
Finalize compliance documentation.
A Certificate of Destruction is generated and logged for legal and regulatory audit purposes.
Final documentation completes the disposal lifecycle and proves compliance.

Anahtar Kavram

Chain of Custody and Secure Hardware Disposal Lifecycle
Soru 1232Soru →

A desktop support technician arrives at an executive office to resolve an urgent local printer issue required for an upcoming board presentation. Upon arrival, the executive is visibly agitated, venting about previous helpdesk delays and demanding that the technician immediately fix a personal tablet's email connectivity issue before looking at the printer. In addition, highly sensitive employee salary spreadsheets are displayed on the executive's monitor and printed papers lie open on the desk. Which of the following is the most appropriate course of action for the technician to take?

Cevabı ve açıklamayı göster

Cevap: Actively listen to the executive's concerns without interrupting, politely request that the executive lock or cover the confidential documents, prioritize resolving the ticketed printer issue, and offer to open a new support ticket for the personal device.

Cevap

Maintain a calm and professional demeanor, actively listen without interrupting, ask the user to secure confidential materials, prioritize the ticketed printer task, and set proper expectations for secondary requests.
The correct response demonstrates all key elements of CompTIA professional interaction guidelines: active listening without interrupting, maintaining a calm and non-defensive tone, respecting customer privacy by prompting the user to secure confidential salary documents, focusing on the high-priority business task, and setting proper expectations by creating a separate ticket for additional requests.

Adım Adım Çözüm

1
De-escalate the user and practice active listening
The technician listens attentively to the customer's frustration without interrupting or offering defensive excuses, building rapport and understanding.
De-escalating an irate user requires validating their concerns and maintaining a professional, empathetic demeanor.
2
Address data privacy and confidentiality appropriately
The technician asks the user to minimize screen content or cover physical documents containing sensitive information.
Technicians must respect customer privacy and confidential data, ensuring the customer retains control of their own sensitive files rather than touching their property without permission.
3
Scope work and set expectations
The technician completes the urgent, business-critical printer repair first and offers to create a separate ticket for the out-of-scope personal device.
Setting clear expectations ensures primary SLA requirements are met while providing a structured path to address additional user requests.

Anahtar Kavram

CompTIA Professional Communication Standards, Active Listening, Data Confidentiality, and Expectation Management
Tahmini Süre:2m 0s
Soru 1233Soru →

A help desk technician is setting up a specialized Windows 11 workstation connected to an isolated laboratory network. According to organizational security policy, the workstation must communicate with local devices on the 10.1.5.0/24 subnet, must be prevented from attempting to route any traffic outside of its local network segment, and must keep network discovery disabled to remain hidden from other endpoints on the local segment.

Which TWO configuration actions should the technician perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a static IPv4 address and subnet mask on the ethernet adapter properties while leaving the default gateway field blank; Set the network location profile for this network connection to Public within Windows Network & internet settings

Cevap

The technician should configure a static IPv4 address and subnet mask while leaving the default gateway empty, and set the network location profile to Public.
Leaving the default gateway address field blank ensures that the Windows host will not send traffic off the local 10.1.5.0/24 subnet. Additionally, designating the network connection as Public in Windows settings activates the restrictive network profile that turns off network discovery and file sharing.

Adım Adım Çözüm

1
Identify how to restrict network communication strictly to the local subnet on a Windows client.
Leaving the default gateway unconfigured prevents the host from attempting to forward packets to remote subnets or internet destinations.
The default gateway provides the IP address of the local router used to reach outside networks.
2
Identify how to disable network discovery and hide the endpoint on the local segment.
Configuring the network location profile as Public disables network discovery and network file/printer sharing by default.
Windows network location profiles (Private vs. Public) govern Windows Firewall rules and discovery behaviors for connected interfaces.

Anahtar Kavram

Windows client IP address properties and network location profile settings
Soru 1234Soru →

A help desk technician is servicing a Windows system that continuously displays blue screen errors following a failed feature update and an unverified graphics driver installation. Initial diagnostics indicate that both critical operating system binaries and the local component store have suffered data corruption. Which of the following troubleshooting steps should the technician take to repair the component store, replace damaged system files, and restore driver stability? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute dism /online /cleanup-image /restorehealth from an elevated command prompt prior to running system file scans.; Boot the system into Safe Mode and use Device Manager to roll back the display driver to its previously installed version.

Cevap

The technician must first execute DISM with the RestoreHealth switch to repair the local component store, and use Safe Mode along with Device Manager to roll back the unstable graphics driver.
Executing DISM with the RestoreHealth switch repairs the Windows Component Store image using online or local repair sources, ensuring System File Checker has valid file payloads available. Additionally, booting into Safe Mode allows the technician to bypass active driver crashes and use Device Manager to roll back to a known-working device driver.

Adım Adım Çözüm

1
Repair the local Component Store using DISM
Executes 'dism /online /cleanup-image /restorehealth' to fix payload files in WinSxS using Windows Update as a reference source.
SFC relies on the WinSxS store to copy healthy replacements of corrupted system files. If the store itself is corrupt, DISM must fix it first.
2
Run System File Checker (SFC)
Executes 'sfc /scannow' to verify system integrity and repair damaged OS files using the newly validated component store.
With a healthy component store, SFC can successfully repair missing or corrupted system files.
3
Resolve driver instability via Safe Mode
Boots into Windows Safe Mode and uses Device Manager to perform a driver rollback on the graphics adapter.
Safe Mode prevents problematic third-party drivers from loading, allowing the technician to restore the previously working driver version safely.

Anahtar Kavram

Windows Repair Sequence and Driver Recovery
Soru 1235Soru →

A systems administrator is troubleshooting a Windows 11 workstation that experiences severe performance degradation and random crashes caused by an unknown third-party startup program. The administrator needs to temporarily start the system with all non-Microsoft background services disabled at boot time without individually changing the startup type of each service in the Services console. Which administrative tool should the administrator use to achieve this task?

Cevabı ve açıklamayı göster

Cevap: System Configuration (msconfig.exe)

Cevap

System Configuration (msconfig.exe) is the correct tool to use because it provides an easy way to hide all Microsoft services and disable remaining third-party services in bulk for diagnostic troubleshooting.
The System Configuration utility (msconfig.exe) is designed specifically for troubleshooting boot and startup issues. Under its Services tab, administrators can select 'Hide all Microsoft services' and click 'Disable all' to easily initiate a selective startup environment without permanently modifying service configurations.

Adım Adım Çözüm

1
Identify the diagnostic requirement.
The requirement is to isolate third-party background services by performing a selective startup without altering individual service startup configurations permanently.
Manually changing service configurations in services.msc is prone to error and time-consuming.
2
Evaluate Windows Administrative tools.
System Configuration (msconfig.exe) features a 'Services' tab with a 'Hide all Microsoft services' checkbox and a 'Disable all' option, specifically designed for clean boot troubleshooting.
This tool simplifies diagnostic startup procedures by temporarily disabling third-party components.

Anahtar Kavram

Using System Configuration (msconfig) for Selective Boot and Service Isolation
Soru 1236Soru →

A network technician is assigned to physically secure desktop computers located in a publicly accessible library area. Recent audits revealed that unauthorized users have been plugging hardware keyloggers into open USB ports on the back of the computer towers. The technician needs to prevent unauthorized physical connections to these ports without replacing the existing computer cases or restricting user access to connected peripherals. Which of the following physical security controls should the technician implement?

Cevabı ve açıklamayı göster

Cevap: Install physical USB port locks in all empty USB ports.

Cevap

Install physical USB port locks in all empty USB ports.
Installing physical USB port locks (or port blockers) directly prevents unauthorized insertion of hardware keyloggers and rogue USB storage devices into empty interface ports on the workstation.

Adım Adım Çözüm

1
Identify the physical security threat in the scenario.
The primary threat is unauthorized physical access to open hardware interfaces (USB ports) on computer towers in a public space.
An attacker can insert rogue hardware keyloggers or flash drives into exposed ports to compromise systems.
2
Evaluate the control options against the specific requirement to block port access without altering computer cases.
USB port locks directly block empty USB slots using a specialized key mechanism, effectively disabling physical hardware insertions.
This target-specific control prevents unauthorized device insertion while allowing existing keyboard and mouse connections to function.

Anahtar Kavram

Physical USB Port Blockers and Interface Security
Soru 1237Soru →

A security technician is configuring group policies for Windows 11 Pro workstations in a finance department. To prevent background malware from interacting with or capturing keystrokes during privilege escalation requests, the technician must enforce a policy that dims the screen and isolates the elevation prompt from the interactive user desktop. Which User Account Control (UAC) security policy setting directly controls this behavior?

Cevabı ve açıklamayı göster

Cevap: User Account Control: Switch to the secure desktop when prompting for elevation

Cevap

The setting 'User Account Control: Switch to the secure desktop when prompting for elevation' is responsible for dimming the screen and displaying elevation requests in an isolated session protected from background software.
Enabling 'User Account Control: Switch to the secure desktop when prompting for elevation' transfers control to a separate desktop context running as SYSTEM. This dims the screen and prevents untrusted user-mode applications or malware from taking screenshots, capturing input, or clicking buttons automatically on the UAC prompt.

Adım Adım Çözüm

1
Identify the security requirement described in the scenario
The requirement is to isolate elevation prompts from background processes and malware to prevent keystroke logging or UI spoofing during escalation.
UAC provides a feature called the Secure Desktop, which runs under system privileges and blocks unauthorized process interaction.
2
Evaluate the Local Security Policy settings related to UAC prompt rendering
The policy 'User Account Control: Switch to the secure desktop when prompting for elevation' specifically governs whether the desktop transitions to this protected display mode.
Disabling this policy allows prompts to appear on the standard interactive desktop without screen dimming, increasing vulnerability to malicious background scripts.

Anahtar Kavram

Windows UAC Secure Desktop Isolation
Tahmini Süre:1m 0s
Soru 1238Soru →

A desktop technician is reviewing Windows User Account Control (UAC) settings across company workstations. Which TWO of the following statements correctly describe default UAC prompt behaviors for user accounts on Windows systems? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Standard user accounts are required to enter administrator credentials when attempting actions that require elevated rights.; Administrator accounts operating under the default UAC notification level are prompted on the Secure Desktop when programs attempt to make changes.

Cevap

Standard user accounts must enter administrative credentials to perform elevated actions, and administrative accounts under default UAC settings receive confirmation prompts on the Secure Desktop when applications request system changes.
Under Windows User Account Control (UAC), standard user accounts are required to provide administrator credentials to elevate privileges. Additionally, accounts in the local Administrators group operate with a split access token by default, meaning software elevation requests trigger a prompt on the dimmed Secure Desktop requiring user confirmation.

Adım Adım Çözüm

1
Analyze standard user UAC behavior in Windows.
Standard users lack elevated access tokens; UAC enforces Over-the-Shoulder (OTS) authentication requiring an administrator password.
Prevents unauthorized standard users from making administrative system changes.
2
Analyze administrator account default UAC behavior in Windows.
Administrators log in with a filtered standard user token; UAC prompts on the Secure Desktop (Admin Approval Mode) when software requests full administrative rights.
Prevents unauthorized background scripts or malware from elevating silently without user awareness.

Anahtar Kavram

Windows User Account Control (UAC) Account Elevation Behaviors
Soru 1239Soru →

A cybersecurity support technician is dispatched to remediate a corporate desktop that is actively displaying unauthorized ransomware warnings and generating rogue outbound connections. In what sequence should the technician perform the following incident response steps to ensure complete malware eradication according to standard CompTIA guidelines?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order follows the CompTIA 7-step malware removal process: (1) Quarantine the system by disconnecting network cables/Wi-Fi, (2) Disable System Restore, (3) Remediate the system by updating signatures and scanning in Safe Mode, (4) Schedule updates and recurring scans, (5) Re-enable System Restore and create a restore point, and (6) Educate the end user.
The CompTIA 7-step malware remediation process specifies an exact operational sequence: 1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan/remove), 5. Schedule updates and recurring scans, 6. Enable System Restore and create restore point, and 7. Educate end user.

Adım Adım Çözüm

1
Isolate the workstation (Quarantine)
Network communication is terminated, stopping malware propagation and command-and-control communication.
Step 2 of the CompTIA process dictates quarantining the system immediately after symptom identification.
2
Disable System Restore
System Restore points are cleared, eliminating stored copies of the malware.
Step 3 prevents infected files from being cached or restored later.
3
Remediate the system
Anti-malware definitions are updated and malicious files/registry keys are detected and removed.
Step 4 involves updating security tools and running deep scans to clean the operating system.
4
Schedule updates and scans
Automated security maintenance tasks are established.
Step 5 ensures ongoing preventative maintenance.
5
Enable System Restore and create a clean restore point
System recovery capabilities are restored using a known-clean baseline state.
Step 6 re-establishes OS backup functionality only after confirming system health.
6
Educate the user
The end user learns risk mitigation techniques to avoid future infections.
Step 7 finishes the remediation lifecycle by addressing human vulnerabilities.

Anahtar Kavram

CompTIA 7-Step Best-Practice Malware Removal Process
Soru 1240Soru →

An IT administrator is configuring a high-security corporate wireless network for a firm's mobile workforce. Corporate policy mandates mutual authentication using client and server digital certificates integrated with a central RADIUS server. Additionally, legacy non-domain mobile devices that only support shared passphrases must be accommodated on a segregated network segment using current security standards. Which TWO of the following configuration choices must the administrator implement to satisfy all policy requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure WPA3-Enterprise utilizing EAP-TLS authentication for the corporate wireless network; Deploy a dedicated SSID for legacy devices utilizing WPA3-Personal with Simultaneous Authentication of Equals (SAE) assigned to an isolated VLAN

Cevap

The administrator must implement WPA3-Enterprise utilizing EAP-TLS authentication for corporate clients, and deploy a dedicated SSID using WPA3-Personal (SAE) on an isolated VLAN for non-domain passphrase devices.
WPA3-Enterprise configured with EAP-TLS satisfies the mutual certificate authentication requirement because EAP-TLS explicitly requires both server-side and client-side digital certificates. WPA3-Personal with SAE on an isolated VLAN provides modern passphrase security and logical traffic separation for non-domain devices without resorting to deprecated encryption algorithms.

Adım Adım Çözüm

1
Evaluate enterprise authentication protocols against the requirement for mutual certificate authentication.
Select EAP-TLS under WPA3-Enterprise.
EAP-TLS is the standard EAP type that mandates digital certificates on both the RADIUS server and the client machine for mutual authentication.
2
Evaluate options for passphrase-based clients needing network isolation.
Select WPA3-Personal (SAE) on a separate VLAN.
SAE provides strong key exchange for passphrase-authenticated clients while VLAN isolation ensures non-domain devices remain segregated from corporate assets without relying on weak legacy ciphers like TKIP.

Anahtar Kavram

Wireless Security Protocols and Enterprise Authentication Mechanisms
Tahmini Süre:2m 0s
ÖncekiSayfa 62 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin