Tüm alıştırma soruları

3551 soru

Soru 1481Soru

A helpdesk technician is troubleshooting a Windows 11 desktop where a critical inventory management application closes unexpectedly every afternoon. To determine the root cause without waiting for another crash to occur, the technician needs to review historical stability trends, application failure dates, and Windows update installations over the past month in a single graphical summary view. Which tool should the technician launch?

Cevabı ve açıklamayı göster

Cevap: Reliability Monitor

Cevap

Reliability Monitor is the correct tool because it aggregates system stability metrics, application crashes, hardware failures, and software changes into a clear daily and weekly timeline.
Reliability Monitor provides a user-friendly graphical timeline showing daily system stability index scores (ranging from 1 to 10), software installation history, driver updates, and application crash events, allowing technicians to correlate crashes with recent system changes.

Adım Adım Çözüm

1
Identify the technician's primary diagnostic objective.
The requirement is to review historical trends, application crash dates, and system change history in a unified interface.
Tracking patterns over time helps correlate software crashes with recent updates or environmental changes.
2
Evaluate available Windows administrative tools against the requirement.
Reliability Monitor (perfmon /rel) displays the System Stability Index graph alongside historical logs of application faults and system updates.
Other tools like Resource Monitor or Performance Monitor capture real-time resource utilization rather than aggregated historical crash timelines.

Anahtar Kavram

Using Reliability Monitor to track historical application crashes and system stability trends in Windows
Tahmini Süre:1m 0s
Soru 1482Soru

A system administrator needs to sanitize several high-performance NVMe Solid-State Drives (SSDs) containing confidential client data before returning leased server chassis back to the hardware vendor. The lease agreement specifies that all hardware must be returned intact and fully functional. Which of the following methods should the administrator use to render the data irrecoverable while keeping the drives operational?

Cevabı ve açıklamayı göster

Cevap: Perform an NVMe cryptographic erase or sanitized firmware purge command

Cevap

Performing an NVMe cryptographic erase or sanitize command purges all data blocks securely while preserving the drive hardware for lease return.
Performing an NVMe cryptographic erase or firmware sanitize command is the standard purge method for solid-state drives. It permanently destroys data across all NAND cells without causing physical damage, allowing the drives to be reused or returned under lease agreements.

Adım Adım Çözüm

1
Identify media type and constraint requirements
Media is flash-based (NVMe SSD), and hardware must remain intact and functional for lease return.
Physical destruction methods (shredding, drilling) cannot be used due to lease return requirements, and degaussing is ineffective on flash storage.
2
Select the appropriate logical sanitization method for solid-state drives
NVMe cryptographic erase or ATA/NVMe Sanitize firmware commands are selected.
Cryptographic erase invalidates encryption keys on self-encrypting drives or sanitizes NAND cells directly, ensuring complete data purge without physical wear or hardware damage.

Anahtar Kavram

Selecting media-appropriate sanitization methods based on hardware type and reuse policies
Tahmini Süre:1m 0s
Soru 1483Soru

A Windows 11 Pro desktop user reports that a proprietary line-of-business inventory application crashes immediately upon startup. Task Manager shows temporary 100% CPU utilization spikes caused by Windows Error Reporting (werfault.exe). An inspection of the Event Viewer Application log reveals Event ID 1000 with an exception code of 0xc0000005, citing a faulting module named InventoryCore.dll located within the application's installation folder. Which of the following actions should the technician take FIRST to resolve this crash while preserving application settings and user data?

Cevabı ve açıklamayı göster

Cevap: Perform an application repair installation using the software installer or Control Panel.

Cevap

Perform an application repair installation using the software installer or Control Panel.
The diagnostic evidence indicates a specific application file crash (Event ID 1000 pointing to InventoryCore.dll inside the app's folder). Performing an application repair installation directly targets the corrupted application files, restoring the missing or damaged DLL while maintaining user data and application settings.

Adım Adım Çözüm

1
Analyze diagnostic evidence from Event Viewer and Task Manager.
Event ID 1000 and exception code 0xc0000005 (Access Violation) pinpoint a crash originating specifically within a third-party application DLL (InventoryCore.dll) in the application directory.
Identifying whether corruption is system-wide or limited to a single application prevents unnecessary operating system repair procedures.
2
Select the least intrusive and most targeted remediation method.
Executing an application repair installation re-copies missing or damaged application binaries.
Repair installations target only the program's files while preserving user configurations and avoiding operating system modifications.

Anahtar Kavram

Isolating and resolving application crashes caused by corrupted application-specific binaries using targeted repair procedures.
Tahmini Süre:2m 0s
Soru 1484Soru

An organization is preparing to decommission an enterprise storage array equipped with NVMe Solid-State Drives (SSDs) that held proprietary source code. Security policy requires media sanitization to a Purge standard to allow drive reuse within a lower-security tier. A technician proposes applying a commercial degaussing wand to the drives followed by a standard single-pass zero-fill overwrite. Which of the following technical evaluations best explains why this proposed sanitization plan is flawed?

Cevabı ve açıklamayı göster

Cevap: Degaussing is ineffective on flash memory storage, and software overwriting cannot reliably target data stored in wear-leveling reserves or bad block pools.

Cevap

Degaussing is ineffective on flash memory storage, and software overwriting cannot reliably target data stored in wear-leveling reserves or bad block pools.
The option identifying that degaussing is ineffective on flash memory and that software overwriting cannot reach wear-leveling reserves is correct. SSDs store data using electrical charges in NAND flash cells, which are immune to magnetic degaussing. Furthermore, standard zero-fill overwrite software operates on logical block addresses (LBAs) provided by the OS and cannot sanitize data residing in over-provisioned blocks, retired sectors, or wear-leveling pools managed internally by the SSD controller. Sanitizing SSDs for reuse requires hardware-level commands such as NVMe Sanitize or cryptographic erase.

Adım Adım Çözüm

1
Analyze the physical media type specified in the scenario.
The storage devices are NVMe Solid-State Drives (SSDs), which utilize NAND flash semiconductor technology rather than magnetic platters.
Data destruction techniques depend strictly on the underlying physical storage technology.
2
Evaluate the effectiveness of degaussing on solid-state drives.
Degaussing uses high-density magnetic fields to disrupt magnetic domains on HDDs and tapes. Because SSDs store data electronically in floating-gate or charge-trap flash memory cells, degaussing has zero effect on SSD data retention.
Applying magnetic sanitization to non-magnetic media fails to sanitize the data.
3
Evaluate standard software overwriting (zero-fill) on flash storage architectures.
SSDs use wear-leveling algorithms, over-provisioned space, and dynamic block mapping. Standard OS-level zero-fill software only writes to logically exposed sectors and cannot access hidden, wear-leveled, or bad block pools managed internally by the SSD controller.
Achieving a true Purge on SSDs for reuse requires specialized controller commands such as NVMe Sanitize or ATA Secure Erase rather than standard sector overwriting.

Anahtar Kavram

Selecting media-appropriate data sanitization and disposal methods for magnetic versus solid-state media.
Soru 1485Soru

A technician is servicing a desktop workstation that is in a completely unpowered state. Pressing the chassis power button produces no fan movement, LED indicators, or diagnostic beeps. The technician tests the power supply unit (PSU) using a standalone PSU tester, which confirms that all output voltage rails (+12V, +5V, +3.3V) are within proper operating specifications. Which of the following diagnostic steps should the technician perform next to isolate the cause of the failure?

Cevabı ve açıklamayı göster

Cevap: Momentarily bridge the front-panel power switch header pins on the motherboard using a jumper or small conductive tool.

Cevap

Momentarily bridge the front-panel power switch header pins on the motherboard using a jumper or small conductive tool.
The correct action is to test the chassis power button switch by shorting the front-panel power pins on the motherboard. Since the PSU passed testing on all voltage rails, the motherboard is receiving standby power but may not be receiving the momentary ground signal from the case power button required to initiate full system power-on.

Adım Adım Çözüm

1
Analyze verified components
The wall power source and power supply unit (PSU) output voltage rails have already been tested and verified as operational.
Eliminating the PSU as a root cause leaves the chassis power switch, front-panel header cables, or motherboard power management circuits as the remaining failure points.
2
Select the least invasive next diagnostic step
Bypass the physical chassis switch by shorting the motherboard front-panel power button pins momentarily.
If the computer powers on, the problem is conclusively identified as a faulty chassis power switch or broken front-panel wiring.

Anahtar Kavram

Power switch bypassing and power state isolation diagnostics
Soru 1486Soru

A corporate software specialist is configuring a newly developed internal database tool for deployment across a department. During testing on a standard user account, the application fails to save user configuration settings and crashes. The administrator discovers that the application installer defaulted to writing user-specific configuration files into C:\Program Files\AppDir, where standard users lack write permissions. Which of the following configuration changes should the specialist request from the application developers to properly resolve this issue according to Windows best practices?

Cevabı ve açıklamayı göster

Cevap: Redirect user-specific configuration files to write to the %LOCALAPPDATA% user directory.

Cevap

Redirect user-specific configuration files to write to the %LOCALAPPDATA% user directory.
According to standard Windows application configuration guidelines, user-specific settings and application data should be written to the user's local profile path (%LOCALAPPDATA% or %APPDATA%). Standard users hold full write permissions to their personal profile directories by default, allowing the application to operate correctly without compromising security.

Adım Adım Çözüm

1
Analyze the root cause of the application crash for standard domain users.
Standard user accounts lack write permissions to system folders such as C:\Program Files.
Windows security architecture intentionally restricts non-administrative accounts from modifying files inside C:\Program Files to protect system integrity.
2
Identify the standard Windows directory designated for per-user application storage.
%LOCALAPPDATA% (C:\Users\<Username>\AppData\Local) is specifically intended for user-specific settings and application files.
Standard users automatically possess full read/write permissions within their own user profile folder structure.
3
Determine the solution that maintains system security and compliance.
Reconfiguring the application storage path to %LOCALAPPDATA% resolves the write failure while keeping default system permissions intact.
Proper path redirection fixes the operational fault without introducing security vulnerabilities.

Anahtar Kavram

Windows Application Installation and Configuration Best Practices (User Profiles vs. System Directories)
Soru 1487Soru

A user reports that a desktop utility application closes abruptly every time a specific tool within it is selected. A technician needs to inspect the system log history to find the exact faulting module name and error code associated with the application crash. Which Windows administrative utility should the technician open?

Cevabı ve açıklamayı göster

Cevap: Event Viewer

Cevap

Event Viewer is the correct tool because it logs detailed application error events, including the faulting application name, faulting module, and exception code.
Event Viewer records system-wide events and application failures under the Application log, providing critical diagnostic details such as Event ID 1000, faulting module paths, and error codes.

Adım Adım Çözüm

1
Determine the diagnostic requirement.
The technician needs to locate historical crash event details and faulting module information for a failing application.
Windows logs application errors to a central system log upon an unexpected program termination.
2
Select the tool designed for reviewing system and application event logs.
Opening Event Viewer and navigating to Windows Logs > Application reveals the crash events.
Other tools like Performance Monitor or Device Manager analyze system metrics or hardware status rather than application failure event logs.

Anahtar Kavram

Windows Event Viewer Application Log Analysis
Soru 1488Soru

A systems administrator is configuring security controls for field technicians who use corporate-issued mobile endpoints to monitor isolated embedded SCADA controllers at remote infrastructure sites. The mobile devices access enterprise cloud resources via cellular networks while concurrently communicating with the embedded IoT devices over local wireless links. Which TWO of the following security configurations should the administrator implement to best protect both the mobile endpoints and the embedded systems?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce mobile application management (MAM) containerization to isolate enterprise data from local network interface traffic.; Mandate cryptographically signed firmware verification and disable unneeded physical and wireless ports on the embedded controllers.

Cevap

Enforcing MAM containerization on mobile endpoints and mandating cryptographically signed firmware with disabled unneeded ports on embedded controllers.
Mobile application management (MAM) containerization ensures corporate data remains isolated in an encrypted sandbox on mobile devices, protecting sensitive enterprise information when communicating over local short-range links. Simultaneously, embedded IoT devices require attack surface reduction—achieved by shutting down unnecessary physical/wireless ports—and protection against malicious firmware updates via cryptographically signed firmware enforcement.

Adım Adım Çözüm

1
Evaluate mobile endpoint data protection requirements when operating across dual networks.
Identified that corporate data must be logically separated from local wireless interfaces accessing embedded hardware.
MAM containerization encapsulates enterprise apps and data in an encrypted volume, preventing data leakage across unauthorized local connections.
2
Evaluate hardening controls required for resource-constrained embedded SCADA/IoT devices.
Identified reducing attack surfaces and preventing unauthorized firmware modifications.
Disabling unused ports eliminates unused entry points, and cryptographically signed firmware prevents malicious code execution.
3
Analyze proposed MDM passcode wipe policies and wireless security protocols for flawed implementations.
Rejected excessive local wipe thresholds and deprecated TKIP encryption settings.
A 3-attempt wipe threshold creates operational disruption, while TKIP is computationally weak and vulnerable to exploitation.

Anahtar Kavram

Mobile App Containerization and Embedded System Hardening Controls
Tahmini Süre:3m 0s
Soru 1489Soru

A systems administrator is establishing security baselines for a new fleet of corporate smartphones to protect sensitive local data if a device is lost or stolen. Which TWO security controls should the administrator deploy on these devices to directly protect data at rest and prevent unauthorized access upon physical loss? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable full-device storage encryption; Configure remote wipe functionality via Mobile Device Management (MDM)

Cevap

The correct security controls to protect data on lost or stolen mobile devices are enabling full-device storage encryption and configuring remote wipe functionality via Mobile Device Management (MDM).
Enabling full-device storage encryption and configuring remote wipe capability directly safeguard data on lost or stolen smartphones. Storage encryption ensures that data at rest remains unreadable without valid authentication, while remote wipe allows administrators to clean sensitive files remotely if physical possession of the device cannot be recovered.

Adım Adım Çözüm

1
Analyze the security objective.
The target objective is protecting data at rest and mitigating risks if physical control of a mobile device is lost.
Mobile devices are vulnerable to theft and loss, requiring controls focused on local storage confidentiality and emergency data removal.
2
Evaluate options for protecting stored data directly on the hardware.
Full-device storage encryption ensures that raw data cannot be read off the internal flash memory without authentication.
Encryption is the standard control for protecting data at rest.
3
Evaluate options for incident remediation following device loss.
Remote wipe capability allows IT administrators to clear device contents over cellular or Wi-Fi networks.
Erasing data remotely prevents persistent exposure of corporate data.

Anahtar Kavram

Mobile data-at-rest protection and lost device remediation (Full-Device Encryption and Remote Wipe)
Soru 1490Soru

An IT support technician is following standard operational procedures to manage a reported end-user service request. Place the standard service desk ticketing lifecycle steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the IT service desk ticketing lifecycle is: 1) Identify user issue and create ticket, 2) Perform initial investigation and Tier 1 diagnostics, 3) Escalate ticket with notes, 4) Implement resolution and verify functionality with user, 5) Log root cause details and close ticket.
The correct order follows the standard IT service management lifecycle: incident intake/creation, initial triage/diagnostics, escalation (if required), resolution implementation with user verification, and final ticket closure with complete root cause documentation.

Adım Adım Çözüm

1
Begin by logging the incident upon receipt of the request.
The ticket is assigned a unique identifier, category, and initial priority level.
Accurate logging ensures proper routing and tracking within the ticketing system.
2
Triage the incident using standard diagnostic workflows.
Basic causes are ruled out, and initial findings are documented.
Tier 1 triage attempts to resolve simple issues quickly before unnecessary escalation.
3
Escalate complex technical issues that require specialized skills.
Ownership transfers to Tier 2 support alongside full case history.
Including diagnostic context prevents duplicate efforts by higher-level technicians.
4
Apply the fix and verify that normal operations are restored.
The user confirms the problem is resolved and system functionality is verified.
Verification ensures the solution solved the issue without introducing collateral problems.
5
Record comprehensive resolution documentation and close the record.
The ticket transitions to closed status.
Detailed resolution logs populate knowledge bases and satisfy compliance auditing.

Anahtar Kavram

Standard Ticketing System Lifecycle Workflows
Soru 1491Soru

Users in an office report that heavy cardstock printed on a departmental laser printer regularly comes out with smudged toner that easily wipes off the page, along with severe paper crinkling. Physical inspection reveals that the paper stock is being stored near an open window and feels damp. Which TWO of the following actions should the technician take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the printer tray settings and print driver media type to Cardstock or Heavy Paper.; Replace the paper with fresh stock from a sealed ream stored in a climate-controlled room.

Cevap

The technician should adjust the printer tray media type setting to Cardstock/Heavy Paper and replace the paper stock with fresh paper stored in a climate-controlled environment.
Unfused toner that smudges off heavy paper indicates insufficient heat transfer during the fusing process, which is corrected by configuring the printer driver and tray properties to 'Cardstock' or 'Heavy Paper'. Additionally, paper crinkling and steam formation are caused by damp paper stock, which must be replaced with dry paper kept in a humidity-controlled area.

Adım Adım Çözüm

1
Address the media weight issue
Configuring the media setting to heavy paper increases fuser heat and slows paper throughput, ensuring toner melts completely into thick cardstock.
Thicker media requires more heat energy during the fusing process than standard copy paper.
2
Address the environmental moisture issue
Replacing damp paper eliminates steam generation and paper distortion, stopping page crinkling.
Moisture trapped in paper fibers expands rapidly under fuser heat, causing structural paper deformation and incomplete toner bonding.

Anahtar Kavram

Laser Printer Fuser Operation and Media Settings Troubleshooting
Tahmini Süre:1m 30s
Soru 1492Soru

A IT support specialist is configuring wireless connectivity for a law firm's main office. Management requires that each employee authenticate using their own centralized corporate user credentials rather than connecting with a shared passphrase. Which wireless security standard and protocol combination should the specialist implement to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: WPA3-Enterprise with 802.1X authentication

Cevap

WPA3-Enterprise with 802.1X authentication
WPA3-Enterprise combined with 802.1X provides centralized access control by passing client authentication requests to a RADIUS server, allowing employees to log in using their distinct domain credentials.

Adım Adım Çözüm

1
Analyze authentication requirement
Identified the need for individual user credential authentication backed by a centralized server.
The organization specified that users must not share a single passphrase, requiring centralized account validation.
2
Evaluate wireless security modes
Personal (PSK/SAE) modes use shared passphrases, whereas Enterprise modes leverage 802.1X and RADIUS for centralized per-user authentication.
802.1X provides Port-Based Network Access Control suited for enterprise credential verification.
3
Select the modern, secure standard
WPA3-Enterprise combined with 802.1X is the recommended implementation.
WPA3 provides robust encryption standards while Enterprise mode satisfies the requirement for central user authentication.

Anahtar Kavram

Wireless Security Modes (Personal vs. Enterprise)
Soru 1493Soru

A field technician is servicing a modern laptop equipped with an Organic Light-Emitting Diode (OLED) display. The user reports that the laptop screen is completely dark, although the power LED is illuminated and an external monitor connected via HDMI displays the operating system desktop normally. A junior technician suggests replacing the display backlight inverter board to fix the dark screen. Which of the following best explains why this recommendation is incorrect?

Cevabı ve açıklamayı göster

Cevap: OLED displays use self-emitting pixels that do not require a backlight or inverter board.

Cevap

OLED displays use self-emitting pixels that do not require a backlight or inverter board.
The option noting that OLED displays use self-emitting pixels without a backlight or inverter board is correct. Unlike CCFL-backlit LCD panels, OLED technology provides illumination on a per-pixel basis, meaning there is no separate backlight unit or inverter circuit in the display assembly.

Adım Adım Çözüm

1
Identify the display panel technology specified in the scenario.
The device features an Organic Light-Emitting Diode (OLED) screen.
Display architecture determines the underlying hardware components and troubleshooting steps.
2
Analyze the functional characteristics of OLED displays compared to LCD displays.
OLED pixels generate their own light independently, whereas traditional LCD displays require CCFL or LED backlighting.
Because OLED displays have no backlight, they do not utilize backlight inverter boards.
3
Evaluate the junior technician's proposal.
Replacing a backlight inverter board is impossible on an OLED panel because the component does not exist in this architecture.
Knowing display component variations prevents ordering incompatible or unnecessary hardware components.

Anahtar Kavram

OLED vs. LCD backlighting architecture in mobile display troubleshooting
Soru 1494Soru

A systems engineer is hardening Windows 11 Pro workstations deployed in a high-security kiosk environment. Organizational security policy mandates two key User Account Control (UAC) behaviors:

1. When standard users attempt any operation that requires elevated privileges, the system must immediately reject the attempt without displaying a credential prompt.
2. When administrator accounts operating in Admin Approval Mode attempt elevated tasks, they must be required to re-enter their administrative password on the secure desktop to proceed.

Which TWO settings in Local Security Policy (secpol.msc) under Security Options must be configured to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests"; Set "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for credentials on the secure desktop"

Cevap

The technician must configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Configuring standard user elevation behavior to 'Automatically deny elevation requests' prevents non-admin users from seeing credential entry dialogs when attempting protected actions. Additionally, setting administrator elevation behavior to 'Prompt for credentials on the secure desktop' ensures administrators must provide valid credentials on an isolated screen before privileges are granted.

Adım Adım Çözüm

1
Identify the standard user requirement.
To ensure standard user accounts are blocked immediately from elevating without presenting a credential entry interface, set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This policy suppresses standard user privilege elevation prompts entirely, enforcing strict access controls on kiosk machines.
2
Identify the administrator elevation requirement.
To require administrators in Admin Approval Mode to re-authenticate on an isolated screen, set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
The secure desktop prevents unauthorized soft/malware interference while requiring full password entry for any administrative privilege escalation.

Anahtar Kavram

Windows Local Security Policy UAC Elevation Prompt Behaviors
Soru 1495Soru

A cybersecurity analyst at a healthcare organization isolates an infected Windows endpoint by disconnecting its network interface and disabling all wireless radios following detection of active spyware transmission. According to the CompTIA standard 7-step malware remediation process, which TWO actions must the analyst perform NEXT immediately prior to running a full system scan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Restore on all system drives; Update the anti-malware signature definitions

Cevap

The analyst must disable System Restore on all system drives and update the anti-malware signature definitions before conducting the remediation scan.
In the standard CompTIA 7-step malware remediation methodology (1. Identify, 2. Quarantine, 3. Disable System Restore, 4. Remediate, 5. Schedule scans, 6. Enable System Restore/Create restore point, 7. Educate user), once quarantine is accomplished, the technician must disable System Restore and update antimalware signature definitions before running the remediation scan.

Adım Adım Çözüm

1
Analyze the current stage in the CompTIA 7-step malware remediation process
The scenario states that symptoms were identified (Step 1) and the system has already been quarantined (Step 2).
Determining the completed steps establishes what must happen next in the standardized workflow.
2
Identify the next sequential step in the process
Step 3 requires disabling System Restore to prevent infected files from being saved or backed up during clean-up.
If System Restore remains enabled, malicious code can persist within restore snapshots.
3
Identify the initial action required within Step 4 (Remediate infected systems)
Step 4a mandates updating anti-malware software and signature definitions prior to executing the actual system scan (Step 4b).
Scanning with outdated definitions can cause the anti-malware scanner to miss newly identified variants of spyware.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Order
Tahmini Süre:2m 0s
Soru 1496Soru

Match each macOS system feature or Linux/macOS command-line utility to its primary administrative function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

dd
NVRAM
lsof
Disk Utility

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

dd matches low-level raw data copying and bootable media creation; NVRAM matches storing persistent macOS system configuration settings across reboots; lsof matches listing all active open files and associated process IDs; Disk Utility matches repairing file systems, partitioning drives, and managing disk images in macOS.
Each feature or utility is matched to its true function: dd is a low-level raw copying tool, NVRAM stores non-volatile system settings in macOS, lsof lists open files and process ties, and Disk Utility is the native macOS storage maintenance app.

Adım Adım Çözüm

1
Identify the command-line utility for raw block copy tasks.
dd is recognized as the utility for bit-by-bit raw data copying.
Technicians use dd to write ISO images directly to USB drives or clone storage blocks.
2
Identify the persistent hardware memory area in macOS.
NVRAM holds low-level system configuration settings.
Resetting NVRAM resolves issues related to boot device selection, screen resolution, and audio settings.
3
Identify the process monitoring CLI command related to open handles.
lsof outputs active files opened by processes.
The name lsof stands for 'list open files', allowing technicians to identify locked files or active network sockets.
4
Identify the primary macOS GUI storage management application.
Disk Utility provides drive partitioning, wiping, and First Aid functionality.
It is the standard built-in GUI utility in macOS for drive diagnostics and volume formatting.

Anahtar Kavram

macOS and Linux Operating System Features and Tools
Soru 1497Soru

A systems technician is tasked with re-hardening a company laptop that was recently returned from a high-risk remote assignment before allowing it back onto the internal corporate network. Arrange the following workstation hardening and remediation steps in the correct procedural sequence from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for re-hardening the remote workstation is: 1) Disconnect all physical and wireless network interfaces to isolate the device, 2) Boot the system using a trusted external rescue disk to perform an offline malware scan, 3) Disable the built-in Guest account and unbind non-essential network protocol bindings and services, 4) Configure Local Security Policy to enforce password-protected screen saver locks and disable AutoPlay/AutoRun, and 5) Connect the workstation to a restricted remediation VLAN to apply system updates and patch definitions.
Hardening a returning untrusted endpoint must always follow a defense-in-depth sequence: Isolation → Verification/Cleaning → OS Baseline Reduction → Policy Enforcement → Segregated Updating. Isolating network access first prevents threat proliferation. Offline scanning verifies system integrity. Disabling unused accounts and services reduces attack surface. Enforcing Local Security Policy ensures endpoint operational security, and using a segregated remediation VLAN allows patching without exposing production assets.

Adım Adım Çözüm

1
Isolate the endpoint
Network communication is completely severed.
Prevents command-and-control communication or lateral movement of potential malware while the device is in an unverified security state.
2
Perform offline security verification
Malware scan completes without OS-level interference.
Scanning offline guarantees that malicious kernel drivers or rootkits are inactive and detectable.
3
Apply attack surface reduction baselines
Unused services, protocols, and default accounts are disabled.
Eliminating unnecessary services minimizes potential vectors for unauthorized local or remote access.
4
Enforce endpoint compliance policies
Screensaver locks and AutoPlay restrictions are active.
Configuring Local Security Policy hardens the OS against physical tampering and unauthorized removable media execution.
5
Patch and update in a controlled environment
OS patches and antivirus signatures are fully updated.
Using a isolated remediation VLAN ensures updates are retrieved safely before the endpoint is granted production network access.

Anahtar Kavram

Workstation Hardening and Incident Remediation Lifecycle
Soru 1498Soru

An enterprise employee contacts the helpdesk after a pop-up window appears on their web browser claiming their computer is severely infected with malware. The pop-up instructs the user to call an unverified toll-free technical support number immediately to purchase remediation software. The company's installed security software indicates the operating system is clean. Which of the following social engineering threat types is being attempted?

Cevabı ve açıklamayı göster

Cevap: Scareware

Cevap

The threat described is scareware, which uses false security warnings and fear tactics to manipulate users into taking harmful financial or operational actions.
Scareware leverages psychological pressure and fake system alerts to convince victims that their device is compromised, prompting them to pay for fake software or call rogue support numbers.

Adım Adım Çözüm

1
Analyze the indicators provided in the scenario.
The user received an unexpected pop-up claiming malware infection and demanding immediate phone contact/payment, while installed antivirus tools report clean status.
Identifying tactics such as coercive urgency, false infection messages, and solicitation of payment helps isolate the attack method.
2
Differentiate between threat classifications.
The scenario highlights anxiety-driven intimidation via fake warnings rather than targeted email messaging (spear phishing), persona fabrication (pretexting), or site compromises (watering hole).
Scareware specifically utilizes fake security notifications to trick users into installing rogue software or making payments.

Anahtar Kavram

Scareware and Social Engineering Threat Classification
Tahmini Süre:1m 0s
Soru 1499Soru

An IT technician is preparing to decommission several enterprise magnetic hard disk drives (HDDs) containing sensitive personnel records. To adhere to organizational security policies and maintain regulatory compliance, the disposal process must follow strict data sanitization and chain-of-custody procedures. In what sequence should the technician perform the following decommissioning steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with logging the drive serial numbers for chain-of-custody tracking, followed by performing a logical sanitization pass, executing physical destruction or degaussing, and finally obtaining and archiving a Certificate of Destruction.
Proper media disposal mandates initializing chain-of-custody documentation first by logging serial numbers. Next, logical sanitization (overwriting) is performed while drives are operational. Physical destruction (degaussing or shredding) permanently renders media unreadable, and finally, obtaining a Certificate of Destruction completes compliance recording.

Adım Adım Çözüm

1
Establish chain-of-custody logging
Drive serial numbers and asset tags are logged into inventory tracking.
Tracking must begin prior to handling or transport to establish legal accountability for sensitive media.
2
Perform logical drive sanitization (purge)
All data sectors on the HDDs are overwritten.
Sanitizing data logically protects confidential records while the drive is intact before physical transport or destruction.
3
Execute physical media destruction
The drives are degaussed or physically shredded.
Degaussing neutralizes magnetic domains and shredding physically breaks platters, ensuring recovery is impossible.
4
Archive compliance documentation
A formal Certificate of Destruction is archived.
Final documentation validates to auditors that data destruction met mandatory regulatory standards.

Anahtar Kavram

Lifecycle and Chain of Custody for Hard Drive Disposition
Soru 1500Soru

A desktop technician is configuring a newly deployed Windows workstation for an administrative office. To minimize the local attack surface and adhere to workstation hardening best practices, which of the following actions should the technician take regarding default accounts?

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and rename the default Administrator account.

Cevap

Disabling the built-in Guest account and renaming the default Administrator account is the correct hardening measure.
Disabling unneeded built-in accounts such as Guest and renaming default administrative accounts limits potential entry points and mitigates automated targeting of default username configurations.

Adım Adım Çözüm

1
Identify default account vulnerabilities on a new OS installation.
Default accounts like Administrator and Guest are common targets for unauthorized access.
Attackers frequently target default account names because they are well-known across standard operating system installations.
2
Apply standard account hardening best practices.
Disable unneeded default accounts (such as Guest) and rename privileged default accounts (such as Administrator).
This reduces the overall attack surface of the workstation without hindering normal administrative duties.

Anahtar Kavram

Workstation account hardening by managing default and built-in accounts.
ÖncekiSayfa 75 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin