Tüm alıştırma soruları

3551 soru

Soru 1401Soru

A system administrator needs to remotely restart an unresponsive remote Windows workstation named FINANCE-PC02 after 120 seconds and display a message to any logged-in user explaining the reboot reason. Which of the following commands should the administrator execute from an elevated Command Prompt to accomplish this task?

Cevabı ve açıklamayı göster

Cevap: shutdown /r /m \\FINANCE-PC02 /t 120 /c "Scheduled maintenance reboot"

Cevap

The command 'shutdown /r /m \\FINANCE-PC02 /t 120 /c "Scheduled maintenance reboot"' correctly initiates a remote restart with a 120-second timer and user notification.
The shutdown command with the /r switch specifies a system restart. The /m flag directs the command to a target remote computer on the network (\\FINANCE-PC02), while /t 120 sets a countdown timer of 120 seconds before initiating the reboot, and /c attaches a comment string presented to active users.

Adım Adım Çözüm

1
Identify the primary Windows command line tool for system power and restart control.
The Windows native CLI utility is 'shutdown.exe'.
Windows uses shutdown for local and remote computer reboots and shutdowns.
2
Select the correct switch parameters for remote execution, restart action, delay, and message.
/r specifies restart, /m targets a remote workstation, /t defines the delay in seconds, and /c adds the user message.
Combining shutdown /r /m \\FINANCE-PC02 /t 120 /c provides the exact desired functionality.

Anahtar Kavram

Windows Shutdown Command Line Options
Tahmini Süre:1m 0s
Soru 1402Soru

A desktop support technician is deploying a new productivity application to workstations located in a secure, isolated network segment with restricted outbound Internet access. When the technician launches the small executable setup file downloaded from the software vendor's website, the setup wizard opens but immediately fails with a network connection error. Standard offline software installation packages install successfully on these same machines. Which of the following is the most likely cause of this installation failure?

Cevabı ve açıklamayı göster

Cevap: The setup executable is a stub bootstrapper that requires active Internet connectivity to download the full installation files.

Cevap

The setup executable is a web-based bootstrapper requiring outbound Internet access to download the application payload.
Many software vendors provide web installers (stub or bootstrapper executables) that are very small in file size. When launched, these bootstrappers connect over the Internet to vendor repository servers to download the latest application payload and prerequisites. In a secure network segment with blocked outbound Internet access, the bootstrapper cannot retrieve these files, leading to a network connection failure. The solution is to download and deploy the complete offline or standalone installer package.

Adım Adım Çözüm

1
Analyze the symptoms described in the scenario.
The installation file is small in size, opens initially, but throws a network connection error in a network segment without outbound Internet access.
Identifying that the error specifically relates to network connectivity isolates network-dependent components.
2
Compare web-based installer (bootstrapper) behavior against offline standalone installers.
Web bootstrappers download necessary payload files dynamically during execution, whereas offline installers contain all required binaries embedded within the setup package.
Determining application installation package requirements is critical for isolated environments.
3
Select the resolution or underlying cause matching the network dependency.
Obtaining the full offline/standalone installer package allows successful installation without outbound Internet access.
Offline installers eliminate external web dependencies during setup.

Anahtar Kavram

Application Installation Methods (Web/Bootstrapper vs. Standalone/Offline Installers)
Soru 1403Soru

A technician has isolated a Windows workstation after detecting a malware infection. Before initiating the anti-malware remediation scan, which TWO actions should the technician take according to the standard CompTIA malware remediation process? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows.; Update the local anti-malware software signature definitions.

Cevap

The technician should disable System Restore in Windows and update the local anti-malware software signature definitions prior to running the scan.
According to the CompTIA 7-step malware remediation process, once an infected system has been quarantined (Step 2), the technician must disable System Restore (Step 3) so that infected system files are not preserved in Windows restore points. Next, before executing the anti-malware scan (Step 4), the technician must update the malware signature definitions to ensure the scanner can recognize the latest threats.

Adım Adım Çözüm

1
Identify the current stage of the CompTIA 7-step malware remediation process.
The device has already been isolated/quarantined (Step 2).
Determining the current phase dictates which pre-scan steps must be completed next.
2
Select the required actions before launching an anti-malware scan.
Step 3 requires disabling System Restore, and the initial phase of Step 4 requires updating antivirus signatures.
Disabling System Restore prevents malware from being preserved in system restore snapshots, and updated definitions ensure full threat detection coverage.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process - Pre-Scan Preparation
Soru 1404Soru

An IT technician is preparing to decommission a server rack containing magnetic tape backup cartridges, traditional SATA hard disk drives (HDDs), and NVMe solid-state drives (SSDs). The technician plans to use a commercial high-intensity degaussing unit as a single sanitization step for all drives prior to off-site disposal. Which of the following statements best evaluates the effectiveness of this proposed sanitization plan?

Cevabı ve açıklamayı göster

Cevap: Degaussing will successfully sanitize the magnetic tapes and HDDs by disrupting their magnetic domains, but it will leave data completely intact on the NVMe SSDs because flash storage is unaffected by magnetic fields.

Cevap

Degaussing will successfully sanitize the magnetic tapes and HDDs by disrupting their magnetic domains, but it will leave data completely intact on the NVMe SSDs because flash storage is unaffected by magnetic fields.
Degaussing exposes magnetic storage media—such as hard disk drives and magnetic tapes—to a strong magnetic field, which disrupts the magnetic alignment of stored bits and renders the data completely unrecoverable. However, NVMe solid-state drives rely on flash memory microchips that store data via electrical charges inside floating-gate transistors. Because flash drives contain no magnetic components, degaussing leaves all data on the SSDs completely intact and fully accessible.

Adım Adım Çözüm

1
Categorize the media types present in the decommissioning project by their underlying storage technology.
Magnetic tapes and HDDs use magnetic storage tracks; NVMe SSDs use non-volatile flash memory (semiconductor circuit technology).
Data sanitization tools act differently based on the physical properties of the storage medium.
2
Analyze the physical mechanism of degaussing.
Degaussing generates a high-energy magnetic field that neutralizes and randomizes the magnetic alignments on magnetic media, permanently destroying data and internal drive timing tracks.
Determines which media types can be rendered unrecoverable via electromagnetic demagnetization.
3
Evaluate the impact of degaussing on solid-state (flash) storage.
Because SSDs retain data through trapped electrical charges in transistor gates rather than magnetic fields, degaussing has zero sanitization effect on NVMe SSDs.
Identifies why the technician's single-pass degaussing plan fails compliance requirements for flash-based drives, requiring alternative methods such as physical shredding, cryptographic erasure, or specialized software purge commands (e.g., NVMe Sanitize).

Anahtar Kavram

Effectiveness of Degaussing Across Magnetic vs. Solid-State Storage Media
Soru 1405Soru

A system administrator is updating the corporate wireless security baseline and guest network policies. Match each wireless security protocol or feature on the left with its correct operational description or technical requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

RADIUS Server
WPA3 SAE
Captive Portal
802.1X

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

RADIUS Server pairs with the centralized AAA backend server; WPA3 SAE pairs with the key exchange protocol protecting against offline dictionary attacks; Captive Portal pairs with the web interface requiring user agreement or login; and 802.1X pairs with the IEEE port-based network access control framework.
Each feature is correctly matched according to standard CompTIA A+ definitions: RADIUS performs backend AAA authentication, WPA3 SAE secures personal wireless handshakes against brute-force/dictionary attacks, Captive Portals manage guest web access enforcement, and 802.1X provides port-based authentication architecture.

Adım Adım Çözüm

1
Analyze backend authentication services in enterprise environments.
Pair RADIUS Server with the centralized AAA backend definition.
RADIUS handles authentication requests sent from wireless authenticators (access points).
2
Evaluate WPA3 enhancements to personal security.
Pair WPA3 SAE with protection against offline dictionary attacks.
SAE utilizes Dragonfly handshake mechanism to ensure forward secrecy and brute-force resistance.
3
Identify web redirection mechanisms for guest access control.
Pair Captive Portal with the web interface intercepting network traffic.
Captive portals restrict network browsing until the user completes the browser landing page requirements.
4
Identify port-based access standards.
Pair 802.1X with the IEEE port-based access control framework.
802.1X defines port status (authorized/unauthorized) and encapsulates EAP packets across local media.

Anahtar Kavram

Wireless Authentication Protocols and Security Architecture
Soru 1406Soru

A technician is servicing a video editing workstation that unexpectedly turns off completely whenever heavy rendering operations begin. The system can be turned back on immediately via the power button, but hardware monitoring logs reveal that CPU core temperatures reach 105°C right before the power cuts out. The installed power supply unit provides ample wattage capacity for all system hardware. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The CPU thermal protection circuit is triggering an automatic emergency shutdown to prevent permanent physical damage.

Cevap

The CPU thermal protection circuit is triggering an automatic emergency shutdown to prevent permanent physical damage.
When a processor exceeds safe operating limits (such as reaching 105°C), built-in thermal protection circuits force an immediate cutoff of main power to safeguard the CPU from physical burnout. The ability to restart immediately once power is toggled, combined with telemetry logging extreme temperatures right before failure and sufficient PSU wattage, confirms thermal protection cutoff as the root cause.

Adım Adım Çözüm

1
Analyze symptom telemetry and system behavior
The workstation shuts down abruptly under intense processor load, coinciding with recorded CPU core temperatures of 105°C.
Extreme temperatures occurring right at the moment of power loss indicate a thermal threshold response.
2
Evaluate power supply unit (PSU) capacity
Confirmed that PSU wattage overhead is fully sufficient for peak component draw.
Verifying power supply capacity rules out PSU thermal or current overload shutdown.
3
Identify the CPU protection mechanism
Modern CPUs initiate an immediate power cut (thermal trip) when junction safety thresholds are breached.
This hardware-level feature protects thermal-sensitive silicon gates from catastrophic thermal destruction.

Anahtar Kavram

CPU Thermal Limits and Hardware Emergency Shutdown Procedures
Tahmini Süre:1m 0s
Soru 1407Soru

An IT technician is configuring a Windows workstation for a newly established international branch office. Local finance applications require system-wide date formats to display as DD/MM/YYYY and currency values to show as £ instead of United States defaults. Which Windows Control Panel applet should the technician open to adjust these date, time, and number format settings?

Cevabı ve açıklamayı göster

Cevap: Region

Cevap

The Region applet is used to configure system date, time, number, and currency formats.
The Region applet in the Control Panel allows administrators and users to adjust system-wide regional settings, including short and long date patterns, time notation, currency symbols, and digit formatting.

Adım Adım Çözüm

1
Identify the configuration requirement.
The workstation requires modifications to date notation (DD/MM/YYYY) and currency symbol representation (£).
Localized accounting applications depend on operating system regional format standards to parse numerical data.
2
Determine which Windows Control Panel applet manages system locale formatting.
The Region applet directly controls short/long date formats, digit grouping, decimal symbols, and currency symbols.
Other Control Panel items manage general system specifications, administrative tools, or accessibility settings.

Anahtar Kavram

Windows Control Panel Region Applet Configuration
Soru 1408Soru

A workstation experiences severe slowdowns whenever a graphic design workspace is active. Diagnostic metrics reveal that physical RAM utilization is holding at 98%, accompanied by a sustained spike in memory hard faults per second. Which of the following is the primary cause of this system performance degradation?

Cevabı ve açıklamayı göster

Cevap: Insufficient physical memory causing heavy reliance on the virtual memory page file

Cevap

Insufficient physical memory causing heavy reliance on the virtual memory page file
The correct answer identifies that RAM utilization near capacity forces Windows to move data blocks to and from disk (paging file), recorded as hard faults per second. Disk access speeds are significantly slower than RAM, resulting in severe performance slowdowns.

Adım Adım Çözüm

1
Analyze the diagnostic metrics presented in the scenario.
Physical RAM utilization is at 98%, and memory hard faults per second are high.
Hard faults occur when requested data is not found in physical RAM and must be retrieved from the disk-based page file.
2
Correlate metrics with Windows memory management behavior.
High hard fault rates combined with near 100% memory consumption indicate RAM exhaustion.
When RAM fills up, the OS heavily pages data back and forth to storage, drastically slowing down response times.

Anahtar Kavram

Memory Paging and Hard Fault Performance Impact
Tahmini Süre:50s
Soru 1409Soru

An IT technician is tasked with preparing functional solid-state drives (SSDs) from decommissioned office laptops before the laptops are donated to a community center. Organizational security policy mandates rendering all stored data unrecoverable via advanced laboratory forensic techniques, while keeping the physical drives fully operational for the recipient. Which of the following methods should the technician perform?

Cevabı ve açıklamayı göster

Cevap: Executing an ATA Secure Erase command using vendor drive utility software

Cevap

Executing an ATA Secure Erase command using vendor drive utility software.
Executing an ATA Secure Erase command using the drive manufacturer's utility software sends a voltage burst across all flash memory cells, effectively purging all stored data across all NAND blocks (including unallocated and over-provisioned areas). This method renders data completely unrecoverable while leaving the SSD physically intact and ready for reuse.

Adım Adım Çözüm

1
Analyze the media type and operational requirements.
The target devices are solid-state drives (SSDs) that must be rendered data-secure while preserving full physical functionality for donation.
Sanitization requirements differ between magnetic media and non-volatile NAND flash storage.
2
Evaluate sanitization methods against the security policy and hardware reuse constraint.
ATA Secure Erase applies a voltage pulse to flush all NAND blocks simultaneously, purging data across accessible and over-provisioned regions.
Methods like physical destruction prevent drive reuse, while degaussing is ineffective on flash chips and standard OS formatting leaves residual data recoverable.
3
Select the appropriate vendor utility command.
Use manufacturer-provided storage software to run ATA Secure Erase on each drive.
This satisfies compliance standards for data purging on SSDs without causing physical harm to the drive hardware.

Anahtar Kavram

Solid-State Drive Purging via ATA Secure Erase
Soru 1410Soru

An IT technician needs to configure several newly unboxed Windows 11 Pro workstations with standard corporate Wi-Fi settings, user accounts, and security policies using a provisioning package instead of performing full disk re-imaging. What is the correct sequence of steps to create and apply this provisioning package?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with configuring the deployment settings in Windows Configuration Designer, exporting the resulting .ppkg file to a USB flash drive, powering on the target system to the Out-of-Box Experience (OOBE) screen, and finally inserting the USB flash drive into the target computer to automatically apply the package.
Provisioning packages (.ppkg) created via Windows Configuration Designer allow technicians to rapidly configure new or existing Windows devices without re-imaging. The workflow requires building the package configuration first, exporting the package to removable media (such as a USB drive), booting the target device into OOBE, and plugging in the drive so Windows detects the package automatically.

Adım Adım Çözüm

1
Define configuration settings using Windows Configuration Designer.
A deployment project containing corporate Wi-Fi, policy, and application rules is established.
Windows Configuration Designer is the tool used to build provisioning packages for Windows deployment.
2
Export the project as a .ppkg file onto a USB flash drive.
A standalone provisioning package file (.ppkg) is created on removable media.
The target computer requires access to the compiled .ppkg package to process configuration instructions.
3
Boot the target system into the Out-of-Box Experience (OOBE) screen.
The target computer reaches the initial Windows setup environment.
Provisioning packages are designed to be recognized natively by Windows during the initial OOBE stage.
4
Insert the USB flash drive into the target computer while at the OOBE screen.
Windows automatically detects the .ppkg file and applies all custom corporate settings.
During OOBE, Windows scans connected USB drives for .ppkg packages and prompts or executes automated configuration upon detection.

Anahtar Kavram

Windows Provisioning Packages (.ppkg)
Tahmini Süre:1m 30s
Soru 1411Soru

An IT support specialist is setting up a shared kiosk workstation in a public library environment. To enforce basic workstation hardening controls before placing the computer into service, which TWO actions should the technician perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable unused built-in user accounts, such as the default Guest account.; Enforce a screen saver password requirement coupled with an idle screen lock timeout.

Cevap

Disabling unused default accounts and enforcing a password-protected screen saver lock upon idle timeout are essential workstation hardening practices.
Hardening a workstation involves reducing potential attack vectors by managing local accounts (disabling unused built-in accounts) and protecting physical access to active sessions (requiring a password to clear an idle screen saver lock).

Adım Adım Çözüm

1
Analyze account hardening requirements.
Disabling default accounts, such as the Guest account, closes unnecessary access paths.
Unused default accounts provide potential attack vectors if left enabled on a shared system.
2
Analyze local session protection measures.
Configuring a screen saver lock with password protection secures unattended workstations.
Idle timeouts prevent unauthorized individuals from interacting with an active desktop session.

Anahtar Kavram

Workstation Hardening Best Practices
Soru 1412Soru

A desktop technician is troubleshooting an enterprise workstation where the desktop monitor displays persistent, thin vertical colored lines across the screen. To isolate the failure, the technician disconnects the video cable from the host computer and accesses the monitor's built-in On-Screen Display (OSD) menu interface. The vertical lines remain clearly visible directly on top of the OSD menu interface itself. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: A hardware failure or physical defect within the LCD display panel assembly

Cevap

A hardware failure or physical defect within the LCD display panel assembly
The correct answer correctly identifies a hardware failure within the LCD panel assembly. The On-Screen Display (OSD) menu is generated internally by the monitor's built-in scalar board. If visual artifacts (such as persistent vertical lines) appear over the OSD menu even when disconnected from the PC, all external components—including the computer's GPU, video drivers, and display cables—are ruled out, leaving the LCD monitor panel as the definitive cause.

Adım Adım Çözüm

1
Analyze the isolation testing method used by the technician.
Opening the monitor's built-in On-Screen Display (OSD) menu without an active video cable connection isolates the monitor's internal hardware from external variables.
The OSD menu is rendered locally by the monitor's internal scalar board and firmware.
2
Evaluate the symptom visibility on the OSD menu.
Since the vertical lines overlay the OSD menu when no external host or video cable is attached, host-side drivers, video cards, and external cables are completely eliminated.
External components cannot affect internally generated monitor menus.
3
Identify the failing component responsible for vertical line artifacts on the OSD.
Vertical lines caused by stuck pixel columns or defective row/column drivers indicate permanent physical damage or component failure within the LCD panel assembly.
Physical glass or driver IC failures inside the LCD panel directly corrupt all visual output including OSD layers.

Anahtar Kavram

Isolating display issues using internal On-Screen Display (OSD) diagnostics
Soru 1413Soru

A technician is configuring security settings on a standalone Windows 11 Pro system. The organization requires that standard users are prompted to enter administrator credentials whenever an action requires elevation, and that elevation prompts do not switch to the dimmed Secure Desktop. Which of the following settings in Local Security Policy (secpol.msc) should the technician configure to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Prompt for credentials'; Set 'User Account Control: Switch to the secure desktop when prompting for elevation' to 'Disabled'

Cevap

The technician should set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Prompt for credentials' and set 'User Account Control: Switch to the secure desktop when prompting for elevation' to 'Disabled'.
Configuring the policy setting for standard user elevation behavior to prompt for credentials forces authentication when standard accounts attempt administrative tasks. Disabling the secure desktop switch policy prevents the screen from dimming while displaying UAC elevation prompts.

Adım Adım Çözüm

1
Identify the policy controlling standard user elevation prompts
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Prompt for credentials' ensures standard users must authenticate with administrative credentials before executing elevated tasks.
Standard user accounts require explicit administrator authentication to proceed with privileged operations.
2
Identify the policy controlling the dimmed Secure Desktop feature
Disabling 'User Account Control: Switch to the secure desktop when prompting for elevation' allows prompts to appear directly on the interactive user desktop without darkening the background.
This setting directly satisfies the requirement to keep elevation prompts on the standard interactive desktop.

Anahtar Kavram

Windows Local Security Policy settings for User Account Control (UAC) elevation behaviors and Secure Desktop toggles
Soru 1414Soru

A network administrator isolates a Windows workstation after detecting an active rootkit that intercepted system calls and modified core system files. The technician has successfully quarantined the machine from the network and disabled System Restore. To proceed with the remediation phase according to the standard CompTIA malware removal process, which of the following actions should the technician take? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update local anti-malware definitions using an isolated media source or internal update server.; Boot into Safe Mode or an isolated pre-installation environment to perform a full system anti-malware scan.

Cevap

Updating anti-malware definitions from a clean source and performing a full scan in Safe Mode or a clean pre-boot environment are the correct remediation actions.
Updating anti-malware signatures from a trusted offline or internal source and executing scans in Safe Mode or a pre-installation environment represent the key tasks of Step 4 (Remediate infected systems) in the CompTIA 7-step process. Safe Mode prevents rootkits and trojans from locking system resources during removal.

Adım Adım Çözüm

1
Identify the current step in the CompTIA 7-step malware removal workflow.
The technician has already completed Step 1 (Identify malware symptoms), Step 2 (Quarantine infected systems), and Step 3 (Disable System Restore). Step 4 is Remediate Infected Systems.
The process must follow the strict standard sequence.
2
Select appropriate actions for Step 4 (Remediate infected systems).
Step 4 requires updating signature files/engines from an uncompromised location and running anti-malware tools (often in Safe Mode or a pre-boot environment to bypass active rootkits).
Rootkits hook OS APIs when running normally, making pre-boot or Safe Mode scanning mandatory for thorough detection and removal.
3
Evaluate distractors against the 7-step process and tool capabilities.
Re-enabling System Restore prematurely violates Step 6 rules, and Event Viewer cannot quarantine files.
System Restore is only re-enabled after infection removal is verified, and log viewers are passive tools.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process: Remediate Infected Systems
Tahmini Süre:2m 0s
Soru 1415Soru

An IT technician is configuring security policies on corporate mobile devices issued to field workers. Which TWO of the following features should the technician enforce to directly protect sensitive data if a mobile device is lost or stolen?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Remote wipe capability to sanitize device storage over the network; Full device encryption paired with a mandatory passcode lock

Cevap

Enforcing remote wipe capability and full device encryption paired with a mandatory passcode lock.
Enforcing remote wipe allows administrators to send a signal to erase sensitive corporate information from a lost device. Full device encryption combined with a mandatory passcode lock secures data at rest so that even if an unauthorized user physically possesses the hardware, they cannot read the contents of the storage drive.

Adım Adım Çözüm

1
Identify the primary threat presented in the scenario.
The threat is unauthorized access to sensitive corporate data on a physically lost or stolen mobile device.
Physical control of the device has been lost, exposing stored files.
2
Evaluate security controls that safeguard local data on missing hardware.
Full device encryption paired with a passcode prevents offline or local data extraction, while remote wipe allows sanitizing the drive if the device cannot be recovered.
These controls combine at-rest encryption and remotely triggered sanitization to prevent data exposure.

Anahtar Kavram

Mobile Security Controls for Lost or Stolen Hardware
Tahmini Süre:45s
Soru 1416Soru

A technician has finished removing malware from a corporate desktop, scheduled routine anti-malware scans, and created a new System Restore point. Which of the following actions represents the final step in the standard CompTIA malware remediation workflow?

Cevabı ve açıklamayı göster

Cevap: Educate the end user on safe computing practices and how to avoid future infections.

Cevap

Educate the end user on safe computing practices and how to avoid future infections.
The correct action is educating the end user. Following the official CompTIA 7-step malware remediation process (Identify, Quarantine, Disable System Restore, Remediate, Schedule updates/scans, Enable System Restore/Create restore point, Educate user), educating the user is the final step to ensure long-term system protection and prevent re-infection.

Adım Adım Çözüm

1
Review the CompTIA 7-step malware removal procedure sequence.
The steps in order are: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and update definitions, 6. Enable System Restore and create a restore point, 7. Educate the end user.
Memorizing the precise sequence allows technicians to correctly identify missing or completed remediation milestones.
2
Evaluate the current progress given in the scenario.
The scenario states that malware has been removed (Step 4), scans scheduled (Step 5), and a restore point created (Step 6).
Identifying the current stage pinpoints what remains to be completed.
3
Determine the remaining step.
The only remaining step in the official 7-step workflow is Step 7: Educating the end user.
User training prevents re-infection and completes the remediation process.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process - Step 7: End-User Education
Soru 1417Soru

An enterprise technician is tasked with decommissioning a hybrid storage array containing both SATA Solid-State Drives (SSDs) and SAS Magnetic Hard Disk Drives (HDDs) that store sensitive financial data. According to NIST SP 800-88 guidelines, the media must undergo sanitization to the 'Purge' standard to prevent data recovery via advanced laboratory techniques. Additionally, corporate policy mandates that all storage media must remain physically operational after sanitization so they can be resold to a third-party vendor. Which of the following procedures correctly complies with these requirements for both drive types?

Cevabı ve açıklamayı göster

Cevap: Issue an ATA/NVMe Secure Erase or Cryptographic Erase command to the SSDs, and execute an ATA Sanitize firmware command on the magnetic HDDs.

Cevap

Issue an ATA/NVMe Secure Erase or Cryptographic Erase command to the SSDs, and execute an ATA Sanitize firmware command on the magnetic HDDs.
Issuing hardware firmware commands (ATA/NVMe Secure Erase or Cryptographic Erase for SSDs, and ATA Sanitize for HDDs) purges all physical storage areas—including hidden, reallocated, and wear-leveled sectors—meeting NIST SP 800-88 Purge requirements without damaging internal drive components needed for subsequent resale.

Adım Adım Çözüm

1
Analyze media types and sanitization objectives.
The target array contains solid-state drives (SSDs) and magnetic hard disk drives (HDDs) requiring NIST 800-88 'Purge' sanitization, with the operational constraint that drives must remain functional for resale.
Purge-level sanitization protects against forensic laboratory extraction while maintaining hardware usability when physical destruction is explicitly ruled out.
2
Evaluate sanitization methods for solid-state drives (SSDs).
SSDs require hardware-based commands like ATA/NVMe Secure Erase or Cryptographic Erase because magnetic degaussing does not affect NAND flash cells, and software overwrites fail to target over-provisioned or wear-leveled blocks.
Firmware commands instruct the internal SSD controller to reset flash cells or delete encryption keys across the entire physical media.
3
Evaluate sanitization methods for magnetic hard disk drives (HDDs) under resale constraints.
HDDs require firmware-level commands such as ATA Sanitize (Overwrite or Crypto Erase). Degaussing must be avoided because it permanently ruins the factory-written servo tracks, making the drive unusable.
ATA Sanitize overwrites or cryptographically purges all magnetic media sectors while preserving the drive's mechanical functionality and track alignment.

Anahtar Kavram

NIST SP 800-88 Data Sanitization (Purge vs. Destroy and Media Specificity)
Soru 1418Soru

A network technician is configuring wireless access for a medical clinic's administrative staff. Management specifies that all employees must authenticate using their individual corporate domain credentials rather than sharing a single passphrase, and that wireless traffic must be protected with strong AES encryption. Which of the following wireless security configurations best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: WPA3-Enterprise utilizing 802.1X and a RADIUS server

Cevap

WPA3-Enterprise utilizing 802.1X and a RADIUS server
WPA3-Enterprise uses IEEE 802.1X port-based network access control combined with a RADIUS server. This setup allows each user to authenticate with their unique enterprise domain username and password while delivering high-grade cryptographic protection.

Adım Adım Çözüm

1
Identify the authentication requirement
Individual user authentication via corporate credentials requires Enterprise mode (802.1X / RADIUS), eliminating Personal (PSK/SAE) modes.
Personal modes rely on a single shared passphrase across all clients.
2
Identify the encryption requirement
Strong encryption requires modern WPA2 or WPA3 standards rather than deprecated protocols like WEP.
WEP uses weak RC4 encryption that can be compromised within minutes.
3
Select the optimal configuration
WPA3-Enterprise provides both centralized 802.1X user authentication via RADIUS and state-of-the-art encryption.
It fulfills all requirements for security, encryption strength, and individual accountability.

Anahtar Kavram

Distinction between WPA Personal (PSK/SAE) and WPA Enterprise (802.1X/RADIUS) modes for wireless security.
Tahmini Süre:1m 15s
Soru 1419Soru

A systems administrator is configuring local security policies on a shared Windows workstation deployed in an unmonitored kiosk area. The system must allow users to interact with a web portal while preventing automatic execution of untrusted scripts from inserted removable media, mitigating credential harvesting through legacy name resolution fallback protocols, and minimizing the overall local attack surface. Which of the following sets of hardening measures best achieves these security objectives?

Cevabı ve açıklamayı göster

Cevap: Disable LLMNR and NBT-NS protocols, enforce Group Policy settings to disable AutoRun and AutoPlay across all drives, apply AppLocker or Software Restriction Policies, and disable the built-in Guest and local Administrator accounts.

Cevap

Disabling LLMNR/NBT-NS protocols, enforcing Group Policy to disable AutoRun and AutoPlay across all drives, applying Software Restriction Policies or AppLocker, and disabling default local accounts represents the optimal combination of workstation hardening controls.
The correct response combines essential operating system hardening controls: turning off legacy resolution protocols (LLMNR/NBT-NS) prevents network credential interception, disabling AutoRun/AutoPlay stops untrusted media from automatically executing payloads, enforcing AppLocker/SRP ensures only approved applications can run, and disabling built-in accounts minimizes local entry points.

Adım Adım Çözüm

1
Analyze the technical requirements of the scenario.
Identified key requirements: mitigate script execution from USB drives, prevent legacy protocol poisoning, prevent unauthorized execution, and reduce local account vulnerability.
Hardening requires selecting controls that directly map to identified threat vectors.
2
Evaluate protocol-level and service-level hardening measures.
Disabling LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) mitigates local network spoofing and hash-harvesting attacks.
Legacy fallback protocols broadcast requests in cleartext and are frequently exploited by attackers on local segments.
3
Evaluate media auto-execution and application execution control measures.
Disabling AutoRun/AutoPlay via Group Policy stops payload delivery upon drive insertion, while AppLocker restricts binary execution to authorized paths and hashes.
Default OS behaviors often allow automatic content indexing or execution from external mass storage devices.
4
Evaluate account hardening policies.
Disabling built-in Guest and local Administrator accounts restricts privilege escalation pathways.
Default accounts have well-known SID patterns and provide prime targets for brute-force attacks.

Anahtar Kavram

Workstation Hardening and Defense-in-Depth Configuration
Soru 1420Soru

An IT support technician is deploying a specialized line-of-business application to several Windows 11 workstations used by multiple standard domain users. During testing, standard users receive an error stating that the application cannot save configuration files to its default directory inside C:\Program Files, and it fails to locate its database network path upon startup. Which TWO configuration steps should the technician take to resolve these issues while maintaining security best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Reconfigure the application configuration path to store user-specific data in %LOCALAPPDATA% or grant standard users Write permissions to a designated directory in %PROGRAMDATA%.; Configure a Group Policy Preference drive mapping script to ensure the database network share is automatically mapped during user sign-in.

Cevap

The technician should reconfigure the application settings to use %LOCALAPPDATA% or %PROGRAMDATA% for user configuration files and deploy a Group Policy logon script or preference to automatically map the required database network share.
Standard domain users lack write permissions to C:\Program Files by default. Writing user-specific settings to profile paths such as %LOCALAPPDATA% or %PROGRAMDATA% aligns with Windows security standards. Automating network drive mappings via Group Policy ensures the application reliably connects to its database share during startup.

Adım Adım Çözüm

1
Identify directory permission restrictions for non-administrative accounts.
Standard Windows security policies prevent standard user write operations within C:\Program Files.
Applications must write user configuration files to approved user profile areas (%LOCALAPPDATA%) or shared application data directories (%PROGRAMDATA%).
2
Ensure necessary network paths are connected upon user logon.
The application can locate its database share reliably whenever a user logs into the workstation.
Automating drive mapping via Group Policy guarantees consistent path availability across multi-user environments.

Anahtar Kavram

Application Environment Configuration and User Permission Scoping
ÖncekiSayfa 71 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin