Examkin

Tüm alıştırma soruları

3551 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 1441Soru →

A system administrator is auditing remote management capabilities and network protocols across a corporate environment. Match each remote access technology or protocol to its correct primary technical characteristic or default network port specification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Remote Desktop Protocol (RDP)
Secure Shell (SSH)
Microsoft Remote Assistance (MSRA)
Telnet

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Remote Desktop Protocol (RDP) pairs with TCP port 3389 and Windows Pro/Enterprise hosting requirements; Secure Shell (SSH) pairs with encrypted command-line access over TCP port 22; Microsoft Remote Assistance (MSRA) pairs with interactive desktop session sharing via user invitation; Telnet pairs with unencrypted clear-text terminal sessions over TCP port 23.
Each technology is correctly paired with its specific security features, network ports, and OS constraints: Remote Desktop Protocol (RDP) uses port 3389 and requires Windows Pro/Enterprise/Education for incoming host sessions; Secure Shell (SSH) encrypts terminal access on port 22; Microsoft Remote Assistance (MSRA) allows interactive user-invited desktop sharing across Windows editions; Telnet operates unencrypted over port 23.

Adım Adım Çözüm

1
Identify the port and Windows edition requirements for Remote Desktop Protocol (RDP).
RDP uses TCP port 3389 and requires a Windows Pro, Enterprise, or Education edition to host incoming connections.
Windows Home edition can initiate RDP outbound connections but lacks the host service component to accept incoming RDP connections.
2
Determine the secure command-line administration protocol.
SSH provides encrypted shell traffic operating over TCP port 22.
SSH replaces unencrypted management protocols to protect administrative credentials across remote shell connections.
3
Differentiate MSRA from traditional incoming RDP host sessions.
MSRA allows interactive screen sharing with user invitation on all Windows editions, including Home.
MSRA relies on explicit user authorization and session sharing rather than establishing an unattended host session.
4
Identify the unencrypted legacy terminal protocol.
Telnet operates on TCP port 23 without encryption.
Telnet transmits all traffic, including username and password credentials, in plain text.

Anahtar Kavram

Remote Access Protocols, Port Numbers, and OS Edition Restrictions
Soru 1442Soru →

Match each mobile device or embedded system security control on the left with its corresponding technical implementation objective or enforcement capability on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

MAM Application Containerization
MDM Sideloading Restriction Policy
Embedded Hardware Root of Trust
Full Device Remote Wipe

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

MAM Application Containerization matches with corporate data segregation on BYOD hardware; MDM Sideloading Restriction Policy matches with blocking installation of unverified third-party app packages; Embedded Hardware Root of Trust matches with cryptographic validation of firmware signatures during boot; Full Device Remote Wipe matches with erasing all flash storage partitions to factory default state.
Each security control aligns directly with its primary technical role: Containerization isolates corporate data on BYOD hardware to enable targeted wipes; sideloading policies block unvetted third-party installation packages; hardware roots of trust cryptographically measure and verify embedded bootloader firmware before boot; and full remote wipes revert lost corporate hardware back to clean factory default states.

Adım Adım Çözüm

1
Analyze BYOD security controls for enterprise app isolation
Identify MAM Application Containerization as the mechanism created to separate corporate data from personal data without full device erasure.
Containerization creates a logically isolated, encrypted storage area for corporate apps.
2
Determine mobile app distribution and execution policies
Map the MDM Sideloading Restriction Policy to blocking unverified third-party software packages.
Disabling sideloading prevents users from manually deploying unapproved or malicious APK/IPA installation files.
3
Examine low-level firmware and boot integrity controls for embedded systems
Link Embedded Hardware Root of Trust to signature validation of bootloader firmware during RTOS boot.
Hardware security modules establish an immutable chain of trust during system startup.
4
Evaluate enterprise response options for lost or stolen assets
Match Full Device Remote Wipe to the complete sanitation of flash storage partitions back to factory settings.
When a corporate-owned asset is compromised, a complete reset ensures no cached encryption keys or data remain.

Anahtar Kavram

Mobile Device and Embedded System Security Controls
Tahmini Süre:1m 30s
Soru 1443Soru →

A healthcare organization is preparing to decommission an array of enterprise Self-Encrypting Drives (SEDs) containing magnetic platters that stored protected health information (PHI). The IT department plans to reassign these physical hard drives to a non-sensitive internal development environment. The compliance policy requires a NIST-compliant purge method that renders all historical data unrecoverable via advanced laboratory techniques while preserving the drive hardware for immediate reuse. Which of the following data disposition methods should the technician perform?

Cevabı ve açıklamayı göster

Cevap: Perform a Cryptographic Erase (CE) to destroy the internal media encryption keys.

Cevap

Performing a Cryptographic Erase (CE) to destroy the internal media encryption keys.
Performing a Cryptographic Erase (CE) on Self-Encrypting Drives (SEDs) permanently erases or overwrites the symmetric media encryption key stored in the controller onboard memory. Without the key, existing encrypted data on the platters becomes unreadable ciphertext that cannot be decrypted even with specialized laboratory recovery techniques. Because the physical magnetic structure of the disk is unaltered, the drive can be re-initialized with a new key and safely redeployed.

Adım Adım Çözüm

1
Analyze the organization's requirements for data disposition.
Identified the need for a 'Purge' level sanitization (unrecoverable via laboratory methods) that simultaneously allows hardware redeployment/reuse on Self-Encrypting Drives (SEDs).
Selecting an improper disposition method either leaves sensitive data vulnerable or unnecessarily destroys reusable enterprise hardware.
2
Evaluate the capabilities of Self-Encrypting Drives (SEDs) regarding sanitization.
Determined that SEDs store data encrypted at rest, and destroying the internal cryptographic key instantly renders all underlying ciphertext indecipherable.
Cryptographic Erase (CE) is defined by NIST SP 800-88 as an approved purge technique for self-encrypting media that preserves drive functionality.
3
Eliminate options that fail to preserve hardware or fail security standards.
Degaussing and shredding destroy the drive hardware preventing reuse, while standard OS formatting provides insufficient sanitization (clear only, not purge).
Only Cryptographic Erase meets both constraints: purging sensitive PHI and preserving physical disk functionality.

Anahtar Kavram

Data Sanitization Standards (NIST SP 800-88) and Cryptographic Erase
Tahmini Süre:2m 0s
Soru 1444Soru →

A graphic designer reports that during intensive 3D rendering workloads, their workstation display frequently shows random colored blocks, checkerboard patterns, and misplaced pixels across active application windows. Updating the graphics card display drivers to the latest release did not resolve the problem. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: Overheating or failing Video RAM (VRAM) on the graphics card

Cevap

Overheating or failing Video RAM (VRAM) on the graphics card
Visual artifacts like checkerboard patterns, colored blocks, and random screen distortion appearing during heavy GPU operations indicate memory corruption in the graphics card's Video RAM (VRAM) or GPU overheating. Because software driver updates did not resolve the issue, physical GPU replacement or thermal management inspection is required.

Adım Adım Çözüm

1
Analyze reported symptoms and trigger conditions
Identified that visual corruption (colored blocks, checkerboard patterns) occurs specifically during heavy 3D rendering workloads.
Heavy 3D rendering increases power draw and thermal load on the GPU core and VRAM.
2
Evaluate attempted troubleshooting steps
Updating graphics drivers failed to resolve the problem.
This isolates the root cause to physical GPU hardware rather than software corruption.
3
Determine primary hardware failure point
Diagnosed failing or overheating VRAM on the graphics processing unit.
VRAM hardware defects or thermal throttling manifest as rendered artifacts, pixel corruption, or checkerboard patterns.

Anahtar Kavram

Identifying GPU VRAM failure symptoms vs. software driver issues
Tahmini Süre:1m 0s
Soru 1445Soru →

A field systems engineer is configuring wireless connectivity for a newly established regional office. The company security policy mandates that all employees authenticate using their individual network credentials via an existing RADIUS server, ensuring dynamic per-session encryption keys rather than a static shared passphrase. Which wireless security configuration should the engineer implement on the access points?

Cevabı ve açıklamayı göster

Cevap: WPA3-Enterprise utilizing 802.1X authentication

Cevap

WPA3-Enterprise utilizing 802.1X authentication
WPA3-Enterprise uses 802.1X authentication to interface directly with a RADIUS server, allowing centralized authentication of individual domain user accounts and generating unique per-session encryption keys.

Adım Adım Çözüm

1
Identify the authentication requirement
The requirement specifies individual authentication using employee network credentials via RADIUS.
Enterprise modes (802.1X) connect to RADIUS servers for central credential verification, whereas Personal modes rely on shared passphrases.
2
Determine the appropriate security mode
Select WPA3-Enterprise for modern security and RADIUS 802.1X integration.
WPA3-Enterprise provides robust encryption alongside 802.1X corporate credential authentication.

Anahtar Kavram

Wireless Security Modes and Enterprise Authentication
Soru 1446Soru →

A system administrator is troubleshooting a Windows 11 workstation where a background service executable named analytics_service.exe has stopped responding and is causing severe system instability. The administrator opens an elevated Command Prompt and needs to forcefully terminate the process by specifying its executable name. Which of the following commands should the administrator run to accomplish this task?

Cevabı ve açıklamayı göster

Cevap: taskkill /f /im analytics_service.exe

Cevap

The command taskkill /f /im analytics_service.exe forcefully terminates the specified executable by image name.
The command taskkill /f /im analytics_service.exe correctly uses the taskkill utility with the /f switch to forcefully close the process and the /im switch to identify the process by its image name.

Adım Adım Çözüm

1
Identify the target command-line utility for ending running processes in Windows.
The utility taskkill is used in Command Prompt to terminate active tasks.
Windows Command Prompt uses taskkill for process termination.
2
Select the appropriate switches for forced termination using an image filename.
The /f flag forces process termination, and /im specifies the image name (analytics_service.exe).
The scenario requires ending the process using its image name rather than a numeric PID.

Anahtar Kavram

Terminating processes via command-line using taskkill flags
Soru 1447Soru →

An IT technician is dispatched to resolve a point-of-sale (POS) thermal receipt printer issue where printed receipts are faint and partially illegible. Place the following troubleshooting steps in the correct sequence according to standard CompTIA troubleshooting methodology.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows standard CompTIA troubleshooting methodology: 1) Identify the problem by gathering information, 2) Establish a theory of probable cause regarding thermal printhead contamination, 3) Test the theory using diagnostic test prints, 4) Implement the solution by cleaning the printhead and replacing paper, and 5) Verify system functionality and document the outcome.
The correct order strictly follows the standard CompTIA troubleshooting framework: Identify the problem, establish a theory of probable cause, test the theory, implement the corrective action, and verify full functionality while documenting findings.

Adım Adım Çözüm

1
Identify the problem
User symptoms and initial device conditions are observed.
Troubleshooting always begins by gathering details from the user and inspecting the hardware setup.
2
Establish a theory of probable cause
A specific hypothesis is established based on thermal printing mechanics.
Determines the most likely failure point (thermal printhead residue or paper quality) before making hardware changes.
3
Test the theory to determine cause
Root cause is confirmed via diagnostic output.
Validates whether printhead contamination is responsible without performing unnecessary component replacements.
4
Establish a plan of action and implement the solution
Physical maintenance is executed safely.
Cleans the thermal heating elements with isopropyl alcohol and installs supported thermal paper stock.
5
Verify full system functionality and document findings
Full operation confirmed and repair details recorded.
Ensures the issue is resolved to the user's satisfaction and logs the maintenance steps for future reference.

Anahtar Kavram

CompTIA Troubleshooting Methodology for Thermal Printer Issues
Soru 1448Soru →

Match each workstation hardening policy or control on the left to its corresponding primary risk mitigation objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Disabling unneeded services and open ports
Configuring screensaver password lock with timeout
Enforcing account lockout threshold policy
Disabling AutoRun and AutoPlay features

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Disabling unneeded services and ports reduces the system attack surface by removing active listening points. Setting a screensaver password lock protects against physical access on unattended systems. Enforcing account lockout threshold mitigates online brute-force password attacks. Disabling AutoRun and AutoPlay prevents malicious script execution from inserted USB drives.
Each hardening control directly addresses a distinct operational vulnerability: disabling unused services reduces attack surface, screensaver lock secures physical access, account lockout mitigates brute-force attacks, and disabling AutoRun blocks malicious removable media execution.

Adım Adım Çözüm

1
Identify the primary threat vector targeted by disabling unused services and listening ports.
Disabling unneeded network protocols and background services directly minimizes unnecessary attack surface.
Fewer listening ports mean fewer entry points for network vulnerabilities.
2
Identify the primary threat vector targeted by password-protected screensaver timeouts.
Locks the interactive user session automatically after inactivity.
Prevents unauthorized physical users from accessing logged-in resources.
3
Identify the primary threat vector targeted by account lockout policies.
Limits maximum consecutive failed login attempts.
Blocks automated scripts trying thousands of password combinations.
4
Identify the primary threat vector targeted by disabling AutoRun/AutoPlay.
Prevents Windows from executing default autorun files on removable media.
Stops malicious drives from executing payload code without user intervention.

Anahtar Kavram

Workstation Hardening and Best Practices
Soru 1449Soru →

A desktop support technician needs to sanitize several decommissioned magnetic hard disk drives (HDDs) that contained confidential customer financial records before releasing them to an off-site recycling vendor. The technician requires an on-site method that neutralizes the magnetic domains of the platters, rendering the stored data completely unrecoverable and the drives permanently inoperable. Which of the following data destruction methods best fulfills these requirements?

Cevabı ve açıklamayı göster

Cevap: Degaussing

Cevap

Degaussing is the correct method because it exposes magnetic hard disk drives to a high-coercivity magnetic field, neutralizing magnetic tracks and destroying stored data while permanently disabling the drive electronics and magnetic servo patterns.
Degaussing introduces a powerful magnetic field that demagnetizes the drive platters. For magnetic hard drives (HDDs), this sanitizes all stored data and destroys the essential factory servo tracks, rendering the drive permanently unusable as required.

Adım Adım Çözüm

1
Identify the media type and destruction requirements
The media consists of magnetic hard disk drives (HDDs) containing sensitive data that must be rendered unrecoverable while also rendering the physical media inoperable.
Different storage media technologies require distinct destruction techniques; magnetic media responds directly to magnetic degaussing fields.
2
Evaluate sanitization methods against magnetic media properties
Degaussing applies a strong electromagnetic pulse that completely erases magnetic patterns and factory alignment tracks on HDD platters.
This process ensures total data destruction and prevents the drive from being used again.
3
Eliminate methods that do not meet the security or hardware disabling constraints
Formatting and write-blocking leave data intact or recoverable, while ATA Secure Erase leaves the hard drive functional.
Only degaussing achieves both magnetic data destruction and permanent drive rendering unusable without needing physical shredding.

Anahtar Kavram

Magnetic Media Degaussing and Sanitization
Soru 1450Soru →

A technician assembles a new desktop workstation. When the power button is pressed, the motherboard power LEDs illuminate and the cooling fans spin continuously, but the system fails to display video, produces no diagnostic beep codes, and does not complete the Power-On Self-Test (POST). The power supply unit has been verified to be functional and correctly connected to the main 24-pin ATX motherboard power socket. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The auxiliary 8-pin EPS12V power connector for the CPU is disconnected.

Cevap

The auxiliary 8-pin EPS12V power connector for the CPU is disconnected.
The 8-pin EPS12V auxiliary connector supplies dedicated power directly to the CPU voltage regulator circuit. When the 24-pin main ATX connector is attached, chassis fans and status LEDs will turn on, but without EPS12V power, the CPU remains completely unpowered. Because the processor cannot execute motherboard firmware, POST cannot start, leading to a silent system with no video output or diagnostic beep codes.

Adım Adım Çözüm

1
Evaluate symptom behavior during power-on.
The motherboard LEDs and fans receive power, but the computer fails to POST, displays no output, and emits no diagnostic beep codes.
This indicates that basic 12V/5V/3.3V power is reaching the motherboard peripherals, but the processor itself is not executing BIOS code.
2
Trace power delivery requirements for modern CPU architectures.
The main 24-pin ATX connector supplies power to motherboard chipsets, PCI slots, and fan headers, but the CPU relies on the separate 4-pin or 8-pin EPS12V connector.
If the EPS12V power cable is unattached, the CPU cannot power on, halting POST before diagnostic routines or display initialization can occur.

Anahtar Kavram

CPU Auxiliary Power Requirements and Early POST Diagnostics
Soru 1451Soru →

A technician is investigating a slow-performing Windows workstation where applications frequently freeze. Task Manager shows physical memory usage at 98%, and the technician needs to observe real-time metrics for hard faults per second and process-specific commit charges to identify memory pressure. Which Windows tool should the technician use to view these detailed real-time memory metrics?

Cevabı ve açıklamayı göster

Cevap: Resource Monitor

Cevap

Resource Monitor is the correct utility to observe real-time memory metrics such as hard faults per second and process commit charges.
Resource Monitor provides a specialized Memory tab that breaks down physical memory usage by process and displays live graphs for Hard Faults/sec, Commit Charge, and Working Set.

Adım Adım Çözüm

1
Identify the diagnostic requirement
The technician needs real-time process-level memory details including hard faults per second.
High RAM utilization combined with hard faults indicates excessive paging to disk, which slows system performance.
2
Evaluate available Windows administrative tools
Resource Monitor offers advanced real-time monitoring of Memory tabs displaying Working Set, Commit, and Hard Faults/sec.
Resource Monitor expands upon Task Manager's high-level overview by giving detailed resource tab insights.

Anahtar Kavram

Windows Resource Monitor Memory Tab Metrics
Tahmini Süre:45s
Soru 1452Soru →

An IT administrator is preparing a security reference guide for mobile devices. Match each mobile security term on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Geofencing
Containerization
Sideloading
Remote Wipe

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Geofencing matches with restricting device access based on physical location boundaries; Containerization matches with separating enterprise data and applications from personal user storage; Sideloading matches with installing applications from third-party sources outside official app stores; Remote Wipe matches with sending a network signal to erase stored data on a missing or stolen device.
Each security term is paired with its precise industry-standard definition: Geofencing enforces location limits, Containerization segregates business assets, Sideloading describes untrusted app installation, and Remote Wipe executes data sanitization commands remotely.

Adım Adım Çözüm

1
Identify the definition of Geofencing.
Matches location-based access control.
Geofencing relies on geographic coordinates to enable or restrict device features.
2
Identify the definition of Containerization.
Matches data separation on mobile devices.
Containerization isolates work profile data from personal data, which is essential for BYOD environments.
3
Identify the definition of Sideloading.
Matches non-official app store installations.
Sideloading bypasses standard vendor application stores, posing security risks.
4
Identify the definition of Remote Wipe.
Matches over-the-air device sanitization.
Remote wipe commands clear data to prevent unauthorized access to missing devices.

Anahtar Kavram

Mobile Device Security Controls
Tahmini Süre:1m 0s
Soru 1453Soru →

A systems administrator needs to prevent standard users from attempting privilege elevation on a standalone Windows 11 workstation by suppressing elevation prompts entirely. Arrange the steps required to configure this security restriction using the Local Security Policy management console in the correct administrative sequence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order begins with launching the console using secpol.msc, navigating to Security Options under Local Policies, selecting the policy 'User Account Control: Behavior of the elevation prompt for standard users', and setting its value to 'Automatically deny elevation requests'.
To modify UAC elevation behavior for standard users, an administrator must first open the Local Security Policy console using secpol.msc, navigate to Local Policies > Security Options, locate 'User Account Control: Behavior of the elevation prompt for standard users', and change its setting to 'Automatically deny elevation requests'.

Adım Adım Çözüm

1
Launch the management snap-in
The Local Security Policy snap-in (secpol.msc) opens.
Administrative security settings for UAC are configured inside the Local Security Policy console.
2
Navigate to the Security Options container
The list of local security policies and UAC policies is displayed in the right pane.
Local Policies > Security Options contains the granular User Account Control settings.
3
Open the standard user UAC behavior policy
The policy properties window opens.
This specific policy governs the elevation prompt behavior for accounts without administrative privileges.
4
Configure the security setting to automatically deny elevation
The policy setting is applied, blocking privilege elevation attempts for standard users without displaying credential prompts.
Setting the behavior to automatically deny elevation prevents standard users from attempting administrative actions.

Anahtar Kavram

Configuring UAC Standard User Elevation Behavior via Local Security Policy (secpol.msc)
Soru 1454Soru →

A tier-2 IT support technician is responding to a confirmed ransomware infection on an enterprise Windows workstation. Place the following remediation actions in the correct sequential order according to the standard CompTIA 7-step malware removal process.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the standard CompTIA 7-step malware removal process: 1. Quarantine infected system (disconnect network), 2. Disable System Restore, 3. Remediate infected system (update signatures and scan), 4. Enable System Restore and create restore point, 5. Educate the end user.
The CompTIA 7-step malware removal process follows a strict sequential order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Disconnecting network interfaces (quarantine) must occur first to contain the infection. Disabling System Restore comes next to prevent malware from remaining in snapshot backups. Remediating with updated tools comes third. Re-enabling System Restore and creating a clean point occurs after remediation. User education is always the final step.

Adım Adım Çözüm

1
Isolate the infected host from the network environment.
Network communication is severed, stopping the malware from spreading to other subnet endpoints or connecting to command-and-control servers.
Quarantining the system is Step 2 in the CompTIA methodology.
2
Turn off System Restore / System Protection in Windows.
Existing restore points containing malicious payloads are deleted, preventing accidental re-infection upon restoration.
Disabling System Restore is Step 3 in the CompTIA methodology.
3
Update signature definitions and execute full anti-malware scan in an isolated environment.
Malicious binaries, registry keys, and background tasks are identified and purged.
Remediating the system is Step 4 in the CompTIA methodology.
4
Re-enable System Protection and generate a new restore point.
A known-good baseline state is saved for future recovery options.
Enabling System Restore and creating a restore point is Step 6 in the CompTIA methodology.
5
Provide security awareness education to the endpoint user.
The user understands attack vectors such as phishing links or suspicious attachments.
Educating the end user is Step 7 in the CompTIA methodology.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process Sequence
Soru 1455Soru →

An IT support technician is troubleshooting a workstation in a corporate office. The user reports that after finding a flash drive in the building parking lot and plugging it into the workstation to identify its owner, the system became sluggish and initiated unauthorized background network connections. Which of the following social engineering threat types best describes this attack vector?

Cevabı ve açıklamayı göster

Cevap: Baiting

Cevap

Baiting is the social engineering tactic where an attacker leaves malware-laden physical media in a public space to exploit human curiosity.
Baiting occurs when an attacker strategically leaves malware-infected physical media (such as a USB flash drive) in a location where potential victims will find it, relying on human curiosity to persuade the victim to connect the media to a system.

Adım Adım Çözüm

1
Identify the primary vector used by the attacker.
The attacker left an infected physical flash drive in a public area (parking lot) accessible to company employees.
Classifying the delivery method and human driver reveals the social engineering tactic.
2
Match the observed tactic to standard threat definitions.
Leaving a physical lure to tempt an individual into plugging it into a network computer is defined as baiting.
Baiting leverages victim curiosity or greed by dangling an attractive physical or digital lure.

Anahtar Kavram

Social Engineering: Baiting Attack Vector
Soru 1456Soru →

A desktop support technician needs to manually install and configure a custom line-of-business application for standard domain users on a Windows workstation. What is the correct logical sequence of steps the technician should follow from pre-installation to user validation?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Verify operating system architecture compatibility (32-bit vs. 64-bit) and hardware prerequisites, 2) Right-click the application installer executable and select 'Run as administrator', 3) Select the appropriate destination path (Program Files vs. Program Files (x86)) during the setup wizard, 4) Configure NTFS access control list (ACL) permissions on shared data folders in ProgramData, and 5) Log in as a standard user and launch the application to confirm proper operational functionality.
The correct logical order begins with checking system architecture requirements, followed by elevating installer privileges, specifying the target path during installation, configuring folder ACLs post-install for user data access, and concluding with end-user verification.

Adım Adım Çözüm

1
Check CPU and OS architecture alongside vendor hardware requirements.
Confirmed whether a 32-bit or 64-bit installer version is required.
Pre-installation checks prevent installer failures caused by executing incompatible binaries.
2
Elevate setup execution via User Account Control.
The installer obtains access rights needed to modify system registries and root directories.
Standard user accounts lack rights to install software across system-wide directories.
3
Select installation directory in setup configuration.
Files are placed in Program Files (64-bit) or Program Files (x86) (32-bit).
Ensures adherence to Windows file system structure guidelines for 32-bit and 64-bit applications.
4
Adjust directory access control lists for application data storage.
Standard users gain read/write permissions for shared local files in C:\ProgramData.
Standard users are blocked from writing to system directories by default unless explicit permission grant rules are applied post-installation.
5
Conduct functional testing under standard user credentials.
Application opens and operates cleanly without requiring ongoing administrative rights.
Testing under the administrator account would mask missing permissions required by end users.

Anahtar Kavram

Application Installation and Configuration Workflow
Soru 1457Soru →

A Windows 11 workstation running a CAD application experiences sudden application crashes during heavy render tasks. Event logs indicate recurring crash events involving faulting module ntdll.dll with memory access violation code 0xc0000005. The technician needs to isolate whether the crash is caused by system file corruption, memory pressure, or third-party background interference. In what sequence should the technician perform the following troubleshooting steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper troubleshooting order follows the CompTIA troubleshooting methodology: 1) Review Event Viewer Application logs to gather specific error details; 2) Monitor real-time performance metrics in Task Manager and Resource Monitor while reproducing the issue; 3) Perform a Clean Boot using msconfig to isolate third-party software conflicts; 4) Execute sfc /scannow from an elevated command prompt to repair corrupted system files; 5) Verify resolution in normal boot mode and document the outcome.
The correct sequence adheres strictly to standard CompTIA troubleshooting procedures. The technician starts by gathering crash details from Event Viewer, observes resource metrics during crash reproduction using Task Manager and Resource Monitor, isolates startup items via Clean Boot, repairs system file integrity using SFC, and concludes by verifying and documenting the resolution.

Adım Adım Çözüm

1
Gather detailed crash logs using Event Viewer.
Identifies the specific faulting application, faulting module, and exception code.
Always begin troubleshooting by identifying problem symptoms and gathering event details.
2
Monitor system resources using Task Manager and Resource Monitor during task reproduction.
Measures CPU, RAM, and disk performance metrics under load to detect resource exhaustion or leaks.
Empirical monitoring provides direct insight into system state during application execution.
3
Isolate third-party services using System Configuration (msconfig) for a Clean Boot.
Eliminates potential background service and startup program interference.
Isolating variables is necessary before applying destructive fixes or system repairs.
4
Execute system file repair commands (sfc /scannow).
Scans and replaces damaged or corrupted OS files like ntdll.dll from the Windows component store.
Remediates system-level corruption causing memory access exceptions.
5
Verify complete system functionality and document findings.
Confirms the CAD application operates stably without crashing and logs complete resolution steps.
Finalizing the issue requires verification and documentation per administrative best practices.

Anahtar Kavram

CompTIA A+ Software Troubleshooting Methodology for Windows Application Crashes
Tahmini Süre:1m 30s
Soru 1458Soru →

A desktop support technician is configuring security settings on Windows 11 Pro workstations in a shared corporate training lab. Company security policy requires that standard user accounts are automatically denied privilege elevation without displaying a User Account Control (UAC) credential prompt. Arrange the steps in the correct order to configure and verify this policy setting.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1. Open the Run dialog, type secpol.msc, and press Enter to launch the Local Security Policy console. 2. In the left navigation pane, expand Security Settings, expand Local Policies, and select Security Options. 3. Locate and double-click 'User Account Control: Behavior of the elevation prompt for standard users'. 4. Change the local security setting value to 'Automatically deny elevation requests' and click OK. 5. Sign out, log in using a standard user account, and attempt an administrative task to verify that elevation is denied without a prompt.
To block standard users from elevating privileges without displaying a UAC credential prompt, a technician must open Local Security Policy (secpol.msc), navigate to Security Settings > Local Policies > Security Options, locate 'User Account Control: Behavior of the elevation prompt for standard users', set it to 'Automatically deny elevation requests', and verify enforcement by attempting an administrative task under a standard user account.

Adım Adım Çözüm

1
Launch Local Security Policy console
The secpol.msc MMC snap-in opens.
Administrative security options for standalone Windows workstations are managed through Local Security Policy.
2
Navigate to Security Options
The list of system and UAC security policies is displayed.
UAC elevation behaviors are stored under Security Settings > Local Policies > Security Options.
3
Open the Standard User Elevation Behavior Policy
The properties window for the target policy opens.
This policy specifically controls whether standard users receive a UAC credential prompt or are blocked.
4
Configure the policy to Automatically Deny elevation
Elevation requests from standard accounts will now fail automatically without prompting for credentials.
Selecting 'Automatically deny elevation requests' satisfies the compliance objective.
5
Verify enforcement with a standard user account
Attempted administrative operations fail immediately with an access denied message.
Testing validates that the policy configuration is properly enforced.

Anahtar Kavram

Configuring UAC elevation prompt behavior for standard users in Local Security Policy (secpol.msc)
Soru 1459Soru →

A desktop technician is executing a file migration script to transfer a complex directory tree from a legacy Windows workstation to a new network location using the Robocopy utility. The migration requires transferring all subdirectories, including any empty folders, while fully preserving NTFS permissions, ownership details, and auditing flags on all transferred files. Which of the following Robocopy switches must be included in the command to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: /e; /copyall

Cevap

The correct options are '/e' and '/copyall'. The '/e' switch ensures subdirectories—including empty ones—are copied, while '/copyall' preserves all file attributes, NTFS security permissions (ACLs), owner information, and auditing settings.
The combination of the '/e' and '/copyall' switches ensures that both the directory hierarchy (including empty folders) and all associated security/audit metadata are preserved during file transfer.

Adım Adım Çözüm

1
Identify the Robocopy switch required for directory recursion including empty folders.
The '/e' switch fulfills the requirement to copy all subdirectories, including empty ones (unlike '/s', which excludes empty subdirectories).
Preserving the complete folder structure requires including folders that do not currently store files.
2
Identify the Robocopy switch required to copy all security and administrative metadata.
The '/copyall' switch is equivalent to '/copy:DATSOU' (Data, Attributes, Timestamps, Security/NTFS ACLs, Owner info, Auditing info).
Standard file copy commands only transfer basic data and attributes, requiring an explicit flag to retain security permissions and audit logs.

Anahtar Kavram

Windows Robocopy File Preservation Switches
Tahmini Süre:1m 15s
Soru 1460Soru →

An IT technician is deploying new Windows workstations for a finance department. To prevent unauthorized or malicious software from automatically executing when employees insert USB flash drives, which of the following workstation hardening best practices should the technician implement?

Cevabı ve açıklamayı göster

Cevap: Disable the AutoPlay and AutoRun features across all workstations using Group Policy.

Cevap

Disabling the AutoPlay and AutoRun features across all workstations using Group Policy.
Disabling AutoPlay and AutoRun ensures that when removable drives are connected, Windows will not automatically run setup files or executable scripts without explicit user intervention, mitigating drive-by media execution attacks.

Adım Adım Çözüm

1
Identify the primary security threat in the scenario.
The threat is the automatic execution of untrusted or malicious files when removable media (such as a USB flash drive) is plugged into a system.
Hardening best practices aim to minimize automated execution vectors on end-user systems.
2
Select the policy control that directly prevents automated media execution.
Disabling AutoPlay and AutoRun prevents the operating system from reading autorun.inf files or automatically prompting users to launch executable files upon mounting media.
Enforcing this setting via Group Policy ensures consistent compliance across all workstations.

Anahtar Kavram

Workstation Hardening via Disabling AutoPlay/AutoRun
ÖncekiSayfa 73 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin