Tüm alıştırma soruları

3551 soru

Soru 1541Soru

A desktop technician is setting up a workstation in a corporate lobby for visitor registration. To prevent unauthorized users from accessing the system when the desk is left unattended, which workstation hardening control should the technician implement?

Cevabı ve açıklamayı göster

Cevap: Configure a short screen lock timeout that requires password re-authentication.

Cevap

Configuring a short screen lock timeout requiring password re-authentication is the most effective control for securing an unattended workstation.
Configuring a screen lock timeout with mandatory password re-authentication ensures that if a user steps away, the session automatically locks after a short period of inactivity, protecting system resources and sensitive data from unauthorized access.

Adım Adım Çözüm

1
Identify the primary security risk in the scenario.
The risk is physical interaction by unauthorized persons when a workstation in a public area is left unattended.
Publicly accessible workstations require automated controls to restrict access during idle periods.
2
Evaluate workstation hardening controls for idle session protection.
Setting an automatic screen lock timeout forces the operating system to lock when inactive.
Requiring credentials to resume the session ensures only authorized personnel can access the device.

Anahtar Kavram

Workstation Hardening - Screen Lock and Idle Timeout Policies
Soru 1542Soru

A desktop technician needs to deploy an enterprise software package packaged as a Windows Installer (.msi) file across several workstation endpoints. To automate the installation via a script, the command must run unattended without any user interface prompts and generate a detailed verbose log file at C:\Logs\app_install.log for auditing purposes. Which of the following command-line executions correctly accomplishes this requirement?

Cevabı ve açıklamayı göster

Cevap: msiexec /i software.msi /qn /L*V C:\Logs\app_install.log

Cevap

Executing msiexec /i software.msi /qn /L*V C:\Logs\app_install.log performs a silent installation of the package while generating a verbose log file.
The msiexec command is the standard executable for managing Windows Installer packages. Passing the /i flag initiates installation, the /qn flag sets quiet mode with no user interface, and the /L*V switch turns on verbose logging output to the specified log path.

Adım Adım Çözüm

1
Identify the appropriate Windows command-line utility for interpreting .msi files.
Select msiexec.exe, which is the built-in Windows Installer engine tool.
Standard .msi software installation packages require the msiexec utility to execute installation commands.
2
Determine the required switches for installation mode and user interface level.
Use /i for package installation and /qn for quiet mode (no user interface display).
The /i parameter instructs the tool to install the application, while /qn suppresses all user dialogs and progress windows for unattended scripting.
3
Specify the logging parameter for detailed audit tracing.
Add /L*V followed by the target path C:\Logs\app_install.log.
The /L*V parameter enables verbose logging to capture all status events, parameters, and error codes during deployment.

Anahtar Kavram

Unattended MSI Application Installation and Logging via Command Line
Tahmini Süre:1m 15s
Soru 1543Soru

A desktop technician is configuring a new macOS workstation for an enterprise user. Company policy mandates that the system must automatically create periodic, incremental backups of user data and system files to an external disk. Additionally, user credentials, digital certificates, and WiFi encryption keys must be stored in a centralized, encrypted system repository for automated authentication. Which TWO native macOS utilities should the technician configure to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Time Machine; Keychain Access

Cevap

The technician should configure Time Machine for automated incremental backups and Keychain Access for secure credential and certificate storage.
Time Machine is the default macOS backup application designed to create regular, automated incremental backups to secondary storage. Keychain Access is the built-in password management vault in macOS that securely holds user account credentials, certificates, and encryption keys.

Adım Adım Çözüm

1
Identify the macOS utility responsible for automated system and file backups.
Time Machine provides automatic, regular background backups to designated backup drives.
It satisfies the policy requirement for continuous incremental data protection.
2
Identify the macOS utility responsible for encrypted password and certificate management.
Keychain Access serves as the centralized repository for passwords, keys, and certificates.
It enables secure storage and automated authentication across macOS applications and network resources.

Anahtar Kavram

macOS Administrative Utilities (Time Machine and Keychain Access)
Soru 1544Soru

A technician is troubleshooting a Windows 11 workstation where a custom line-of-business inventory application frequently freezes during database synchronization. Place the following diagnostic and remediation steps in the correct sequential order to analyze the active frozen state, inspect crash logs, review system stability history, and repair operating system files.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct troubleshooting order begins with analyzing the active process wait chain in Task Manager, followed by inspecting Event Viewer application hang logs, checking Reliability Monitor for system change history, and finally running System File Checker to repair corrupted operating system files.
The correct troubleshooting sequence follows the standard CompTIA methodology: gather live diagnostic data first (Task Manager Analyze Wait Chain), review application event log specifics (Event Viewer Event ID 1002), review timeline correlation with recent updates (Reliability Monitor), and perform file integrity repair (sfc /scannow).

Adım Adım Çözüm

1
Analyze the active process state using Task Manager's Analyze Wait Chain feature.
Identifies if the application process is blocked by another process or thread.
Immediate live diagnostic tools take priority when an application is currently frozen.
2
Examine Event Viewer Application logs for Event ID 1002.
Provides exact faulting module names and failure signatures.
Detailed application log analysis clarifies specific technical error codes.
3
Review Reliability Monitor trends.
Correlates the onset of crashes with software or driver installations.
Evaluating environmental changes helps isolate external factors causing the performance degradation.
4
Execute sfc /scannow in an elevated Command Prompt.
Scans and repairs damaged operating system files and libraries.
System repair commands should be run after diagnosing and establishing the likely root cause.

Anahtar Kavram

Methodological Troubleshooting of Windows Performance and Application Hangs
Soru 1545Soru

Match each data destruction and sanitization method to its correct operational description and capability.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Degaussing
Overwriting (Zero-Fill)
Cryptographic Erase
Physical Shredding

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Degaussing matches disruption of magnetic fields on HDDs; Overwriting matches replacing storage sectors with binary patterns for hardware reuse; Cryptographic Erase matches deleting the encryption key on Self-Encrypting Drives; Physical Shredding matches cutting storage media into tiny fragments with mechanical blades.
Each method is matched correctly based on its core sanitization technique: Degaussing alters magnetic fields on HDDs, Overwriting fills drive sectors with pattern data to allow reuse, Cryptographic Erase invalidates encryption keys on SEDs, and Physical Shredding mechanically fragments storage media.

Adım Adım Çözüm

1
Identify the data sanitization mechanism for magnetic media rendered inoperable by magnetic fields.
Degaussing applies a strong electromagnetic pulse to magnetic drives (HDDs/tapes), destroying track alignment and data.
Degaussing alters magnetic domain alignment on magnetic storage media.
2
Identify the software-based method for sanitizing drive sectors to permit hardware reuse.
Overwriting (Zero-Fill) writes new patterns over drive sectors, making data unrecoverable while keeping the device operable.
Logical drive wiping allows disk reuse without physical damage.
3
Identify the method specific to Self-Encrypting Drives (SEDs).
Cryptographic Erase instantly deletes or resets the drive's media encryption key (MEK).
Without the encryption key, data stored as ciphertext on the drive cannot be decrypted.
4
Identify the method that relies on mechanical destruction into small physical pieces.
Physical Shredding physically destroys the storage medium using mechanical cutters.
Shredding guarantees complete physical destruction across all media types.

Anahtar Kavram

Data Sanitization and Destruction Methods
Soru 1546Soru

A system administrator is hardening corporate-issued smart Point-of-Sale (PoS) handheld devices running an embedded operating system used by field merchants. The devices process sensitive customer payment data, are frequently operated in public venues, and are at high risk of physical theft or untrusted app installation. Which TWO of the following security measures should the administrator enforce on these embedded endpoints to mitigate these risks?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable sideloading and restrict application execution exclusively to cryptographically signed corporate app repositories.; Enable full-device storage encryption paired with a remote wipe policy managed through a Mobile Device Management (MDM) profile.

Cevap

The correct measures are restricting application installation by disabling sideloading and enforcing full-device storage encryption combined with MDM remote wipe capabilities.
Disabling sideloading ensures that unverified or untrusted third-party software packages cannot be installed on embedded payment terminals, reducing malware exposure. Enforcing full-device storage encryption together with MDM remote wipe functionality secures sensitive local payment data at rest and provides immediate remote remediation should a device be stolen or lost in the field.

Adım Adım Çözüm

1
Analyze the operational risks associated with embedded PoS handheld devices in public environments.
Primary threat vectors identified: unauthorized software execution (sideloading) and physical device theft causing data at rest exposure.
Embedded payment endpoints operated in public require strict control over app execution sources and robust protection for local storage.
2
Evaluate controls to prevent malicious software execution on embedded endpoints.
Disabling sideloading ensures only verified, signed software from corporate-approved repositories can be installed.
Sideloading bypasses store vetting processes and is a major vector for mobile malware infections.
3
Evaluate controls for physical theft and loss of mobile devices.
Full-device storage encryption protects data at rest, and MDM-driven remote wipe allows sanitizing compromised endpoints remotely.
Hardware stolen in the field remains unreadable without encryption keys, and remote wiping prevents persistent data exposure.

Anahtar Kavram

Mobile Device and Embedded System Security Enforcement
Soru 1547Soru

A desktop support technician is setting up a dedicated Windows 10 workstation in a conference room. The technician needs to direct default system audio playback to an HDMI-connected projector and set a newly connected network color printer as the default printing device for all users. Which of the following Control Panel utilities should the technician use to complete these configurations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Sound; Devices and Printers

Cevap

The Sound applet and the Devices and Printers applet are the two required Control Panel utilities.
The Sound applet in Control Panel is specifically designed to manage audio input and output devices, enabling the technician to set the HDMI projector as the default playback device. The Devices and Printers applet allows users to manage installed peripherals, including right-clicking a connected network printer to mark it as the default printer for the workstation.

Adım Adım Çözüm

1
Open Control Panel and select the Sound utility.
Locate the HDMI output device under the Playback tab and select 'Set Default'.
This routes default system audio through the conference room HDMI projector.
2
Navigate to the Devices and Printers utility within Control Panel.
Right-click the network color printer and select 'Set as default printer'.
This ensures print jobs automatically route to the designated network printer.

Anahtar Kavram

Selecting proper Windows Control Panel applets for hardware peripheral management and audio output default settings.
Soru 1548Soru

A system administrator is tasked with hardening standalone Windows workstations deployed in a building lobby for public visitor registration. The workstations must be secured against unauthorized access, privilege escalation, and automated malicious code execution from external drives. Which TWO of the following account and system policy configurations should the administrator implement to meet these hardening requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable AutoPlay and AutoRun policies across all removable storage drives.; Disable the built-in Guest account and rename the default local Administrator account.

Cevap

The correct hardening controls are disabling AutoPlay/AutoRun policies across removable drives and disabling the built-in Guest account while renaming the default Administrator account.
Hardening standalone workstations requires minimizing attack vectors. Disabling AutoPlay and AutoRun prevents malicious software on inserted drives from executing without user intervention. Disabling the built-in Guest account and renaming the default Administrator account removes known default attack paths and reduces the risk of credential brute-forcing.

Adım Adım Çözüm

1
Identify the risk associated with physical access to external ports on public terminals.
Recognize that external flash drives can launch scripts automatically unless AutoPlay and AutoRun policies are restricted.
Preventing automated execution reduces the local attack vector from physical media.
2
Evaluate local account hardening best practices for standalone systems.
Identify that disabling the default Guest account and renaming the default Administrator account reduces attack surface.
Standard account names like 'Administrator' are primary targets for automated credential attacks and unauthorized access.
3
Validate distractors against security fundamentals and administrative tool functions.
Reject elevated group assignments for visitors and rule out Event Viewer for firewall packet filtering.
Least privilege principles dictate standard user rights, and firewall filtering requires host security utilities rather than event logging tools.

Anahtar Kavram

Workstation account and policy hardening best practices
Soru 1549Soru

An IT support technician is troubleshooting a monochrome laser printer in an accounting firm. Users report that printed pages show a faint repeating duplicate image (ghosting) of previously printed text appearing down the page at regular intervals of approximately 3.75 inches3.75\text{ inches} (95 mm95\text{ mm}). The toner on the pages is fully adhered and does not smudge when touched. Which of the following components is the most likely cause of this print quality defect?

Cevabı ve açıklamayı göster

Cevap: A worn cleaning blade failing to scrape residual toner off the photosensitive drum

Cevap

A worn cleaning blade failing to scrape residual toner off the photosensitive drum is the root cause of the repeating ghosting defect.
In the electrophotographic (EP) printing process, the cleaning phase uses a rubber wiper blade to scrape remaining toner off the photosensitive drum after image transfer. If the blade is worn or damaged, residual toner remains on the drum surface and creates repeating faint ghost images at intervals matching the circumference of the drum.

Adım Adım Çözüm

1
Analyze the reported defect symptoms and repeat pattern.
The defect is a repeating ghost image at a specific fixed distance (3.75 inches3.75\text{ inches}). The toner is fully fused, eliminating fuser temperature failure.
Repeating defects at regular intervals correspond to the circumference of a rotating roller inside the laser printing assembly.
2
Correlate the interval measurement (3.75 inches3.75\text{ inches}) with electrophotographic drum dimensions.
A distance of 3.75 inches3.75\text{ inches} corresponds to a drum diameter d=3.75π1.2 inchesd = \frac{3.75}{\pi} \approx 1.2\text{ inches}, matching a standard photosensitive drum circumference.
If leftover toner from a previous image is not cleared during the cleaning phase of the EP process, it transfers again on the next rotation of the drum.
3
Identify the failing component responsible for clearing residual toner during the cleaning step.
The rubber cleaning blade (wiper blade) failed to scrape leftover toner into the waste toner cavity.
Replacing the drum unit or toner cartridge containing the damaged cleaning blade resolves the ghosting issue.

Anahtar Kavram

Electrophotographic Printing Process - Cleaning Phase Defects
Tahmini Süre:1m 15s
Soru 1550Soru

A technician is troubleshooting a desktop workstation that fails to complete POST and emits a continuous beep code immediately after a memory upgrade. Place the following troubleshooting steps in the correct sequence to isolate the issue according to standard CompTIA hardware diagnostic procedures.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with disconnecting AC power and draining residual electricity, removing the newly installed RAM module to re-establish a baseline, powering on the system to verify baseline operation, and finally testing the new RAM module independently in a known-good slot.
CompTIA hardware troubleshooting principles mandate establishing safety first by removing power and draining residual charge, returning to a known-good baseline by removing newly added RAM, verifying baseline system operation, and then testing the new module independently to isolate component versus slot failure.

Adım Adım Çözüm

1
Disconnect AC power and drain residual motherboard voltage.
Prevents electrical discharge damage and hazards during component handling.
Safety procedures mandate de-energizing the power supply unit and clearing capacitors before working inside the chassis.
2
Remove the newly added RAM module to establish a baseline.
Isolates the new hardware variable from the system.
Standard troubleshooting methodology dictates undoing recent hardware modifications first.
3
Reconnect power and verify baseline POST.
Determines whether original hardware functions without emitting beep codes.
Confirms system health under pre-existing hardware conditions.
4
Test the new module separately in a known-good DIMM slot.
Pinpoints whether the failure is caused by a bad RAM module or a damaged motherboard slot.
Isolated hardware testing reveals the exact root cause of the error.

Anahtar Kavram

Isolating Memory POST Failures using Systematic Component Testing
Tahmini Süre:1m 30s
Soru 1551Soru

An IT technician installs a second internal hard drive into a functional Windows desktop computer. Upon turning on the system, the screen displays the error message 'Operating System Not Found'. The technician verifies that the primary drive containing Windows is properly connected and undamaged. Which of the following is the MOST likely cause of this boot error?

Cevabı ve açıklamayı göster

Cevap: The BIOS/UEFI boot sequence was automatically altered to prioritize the newly installed blank drive.

Cevap

The BIOS/UEFI boot sequence was automatically altered to prioritize the newly installed blank drive.
When a new blank storage drive is added to a computer, the BIOS/UEFI firmware often automatically changes the boot priority order, placing the newly detected drive above the existing system drive. Because the new disk contains no operating system files, the POST process halts with an 'Operating System Not Found' error.

Adım Adım Çözüm

1
Identify the event triggering the boot issue and the resulting error state.
Installing a new storage device often causes motherboard firmware to reprioritize boot order, placing the newly detected empty disk first.
When the firmware attempts to initiate startup from an unformatted or empty drive, it cannot locate a valid bootloader or operating system, yielding 'Operating System Not Found'.
2
Determine the appropriate corrective measure.
Access the system BIOS/UEFI settings and adjust the boot sequence to place the original system drive at the top of the priority list.
Restoring the primary OS drive to the first position in the boot order allows the system to load Windows normally.

Anahtar Kavram

BIOS/UEFI boot priority configuration when adding auxiliary storage devices
Soru 1552Soru

A user reports that after changing their corporate network domain password, Windows continues to automatically attempt authentication to an internal shared folder using their old password, causing repeated account lockouts. Which Control Panel utility should a technician access to update or remove these cached network authentication details?

Cevabı ve açıklamayı göster

Cevap: Credential Manager

Cevap

Credential Manager is the correct utility to update or remove cached domain and network credentials.
Credential Manager allows users and administrators to view, modify, and delete saved credentials for signing in to websites, connected applications, and network resources. Updating the outdated entry under Windows Credentials stops Windows from sending the expired password to the file server.

Adım Adım Çözüm

1
Identify the cause of the repeated lockouts.
The operating system is attempting to connect to a network resource using saved credentials that contain an outdated password.
When network passwords change, Windows Vault or Credential Manager may retain the old password for specific mapped resources.
2
Select the appropriate Control Panel tool to resolve stored credential issues.
Open Credential Manager and navigate to the Windows Credentials section.
Credential Manager securely stores web and Windows authentication details for network locations, shares, and applications.
3
Modify or remove the entry corresponding to the internal share.
The stale credential entry is updated with the new password or removed so Windows prompts for fresh credentials.
Updating the stored entry prevents silent authentication failures using the old password.

Anahtar Kavram

Credential Management in Windows
Tahmini Süre:1m 0s
Soru 1553Soru

A video editor running Windows 11 reports that a video processing application consistently freezes and crashes during 4K export rendering. During heavy rendering, Task Manager shows RAM utilization exceeding 98% with sustained high hard faults per second on the system partition, and Event Viewer Application logs record Event ID 1000 pointing to a graphics driver module failure. Which TWO of the following initial actions should the technician perform to address the application crash and system degradation?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform a clean installation of the latest WHQL-certified display adapter drivers to resolve the faulting graphics module.; Reconfigure the system virtual memory settings to expand the pagefile size onto a secondary high-speed storage drive.

Cevap

The technician should perform a clean installation of the latest display adapter drivers and expand/relocate the system virtual memory pagefile to a secondary high-speed drive.
The combination of Event ID 1000 pointing to a graphics module and physical memory starvation requires two targeted interventions: performing a clean installation of display drivers to fix the module crash, and expanding the virtual memory pagefile (or moving it to a secondary fast drive) to stop severe disk thrashing caused by memory page faults.

Adım Adım Çözüm

1
Analyze diagnostic symptoms from Task Manager and Event Viewer
Identified high RAM usage (98%) and elevated hard faults/sec indicating virtual memory starvation, along with Event ID 1000 referencing a faulting graphics driver module.
Correlating event logs with performance metrics isolates the dual bottlenecks: display driver crash and physical memory exhaustion.
2
Address display driver failure
Replaced corrupted or unstable graphics driver binaries with clean, updated vendor drivers.
Prevents graphics subsystem crashes during heavy GPU rendering tasks.
3
Mitigate virtual memory pressure
Expanded the Windows pagefile capacity and placed it on fast secondary storage.
Reduces disk thrashing caused by excessive hard faults when physical RAM is exhausted.

Anahtar Kavram

Troubleshooting Windows Application Crashes and Memory Bottlenecks
Soru 1554Soru

A network technician is configuring wireless security settings across various company locations and access scenarios. Match each wireless security requirement or deployment scenario on the left to its corresponding technology or protocol on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An enterprise deployment requiring individual user authentication via 802.1X and a RADIUS server
A legacy wireless encryption standard introduced to temporarily patch WEP vulnerabilities using TKIP
A modern SOHO wireless security standard using Simultaneous Authentication of Equals (SAE) to prevent dictionary attacks
A guest wireless setup that redirects HTTP traffic to a web page requiring acceptance of an acceptable use policy before granting network access

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Enterprise 802.1X authentication matches WPA2-Enterprise.
2. Legacy TKIP standard matches WPA.
3. Modern SAE SOHO standard matches WPA3-Personal.
4. Web page redirection for guest access matches Captive Portal.
Each wireless security technology matches its exact operational characteristics: WPA2-Enterprise provides 802.1X/RADIUS authentication; WPA relies on TKIP; WPA3-Personal uses SAE for enhanced PSK protection; and Captive Portals manage guest network landing page redirection.

Adım Adım Çözüm

1
Analyze enterprise authentication requirements requiring RADIUS and 802.1X.
Identify that 802.1X authentication with central user account management corresponds to Enterprise security modes (WPA2-Enterprise).
Enterprise modes use EAP and RADIUS servers for individual user credentials rather than pre-shared keys.
2
Evaluate legacy encryption mechanisms designed to address original WEP weaknesses.
Identify TKIP as the protocol created for the original WPA standard.
WPA added TKIP as a temporary security patch compatible with existing WEP network hardware.
3
Examine modern SOHO passphrase authentication enhancements against offline password guessing.
Identify SAE as the core authentication protocol introduced in WPA3-Personal.
SAE performs a secure key exchange that makes offline dictionary attacks ineffective even with weak passwords.
4
Determine the mechanism used for web page redirection and terms acceptance on guest networks.
Identify Captive Portal as the access control mechanism for guest networks.
Captive portals intercept unauthenticated HTTP traffic to present login or landing pages.

Anahtar Kavram

Wireless Security Protocols and Authentication Frameworks
Soru 1555Soru

A technician installs a replacement processor into a desktop system. Upon pressing the power button, the cooling fans spin briefly for less than one second before the system immediately shuts down. The system will not react to subsequent power button presses until the AC power cord is unplugged and reconnected. When the technician disconnects the dedicated 8-pin +12V CPU power connector from the motherboard, the system fans run continuously upon powering on, though no display output or POST occurs. Which of the following is the most likely cause of this behavior?

Cevabı ve açıklamayı göster

Cevap: The power supply unit is entering a protective safety shutdown due to a short circuit or over-current condition on the +12V CPU power rail.

Cevap

The power supply unit is entering a protective safety shutdown due to a short circuit or over-current condition on the +12V CPU power rail.
The system exhibiting a momentary fan spin followed by complete power loss—requiring the AC cord to be pulled before it will respond again—is a classic indicator of a power supply tripping its short-circuit or over-current protection logic. Because unplugging the +12V CPU power cable allows the rest of the board to remain powered, the short circuit or severe electrical failure is located on the CPU power circuit.

Adım Adım Çözüm

1
Analyze initial power failure symptoms
Fans spin for less than a second and system shuts down; requires AC cable cycle to retry.
This behavior indicates a Power Supply Unit (PSU) protection latch (OCP/SCP) triggering to protect components.
2
Evaluate isolation diagnostic step
Disconnecting the 8-pin +12V CPU connector allows fans to run continuously without a system shutdown.
Removing power from the CPU rail eliminates the short circuit/overload condition, proving the issue lies within the +12V CPU power line or motherboard VRMs.
3
Determine root cause
Identify a shorted CPU socket pin, faulty VRM capacitor, or bent pin on the CPU power rail.
A physical short or severe current draw on the CPU power branch triggers the PSU safety shutdown.

Anahtar Kavram

PSU Over-Current / Short-Circuit Protection Latching on +12V CPU Rail
Soru 1556Soru

A network technician is preparing a newly imaged desktop computer for deployment in an accounting office. To minimize the workstation's attack surface against potential network-based threats, which security hardening best practice should the technician implement?

Cevabı ve açıklamayı göster

Cevap: Disable unneeded background services and close unused network ports.

Cevap

Disable unneeded background services and close unused network ports.
Disabling unneeded services and closing unrequired open ports is a fundamental workstation hardening practice that reduces the operating system's attack surface, preventing remote exploitation of unneeded components.

Adım Adım Çözüm

1
Identify the primary objective of attack surface reduction for workstation hardening.
Recognize that minimizing running services and network listeners limits exposure to unauthorized access.
Every active service or open network port represents a potential entry point for unauthorized users or malware.
2
Evaluate the administrative options against system security hardening best practices.
Determine that turning off unnecessary services and unneeded open ports reduces system vulnerabilities.
Closing unused communication channels directly strengthens system security posture.

Anahtar Kavram

Attack Surface Reduction
Soru 1557Soru

A technician is troubleshooting a Windows 11 workstation using a UEFI/GPT configuration that fails to boot following an unexpected power loss during a system upgrade. The computer displays a stop screen with error code 0xc00000e, signaling that the boot selection failed because a required device is inaccessible. The technician launches the Command Prompt from the Windows Recovery Environment (WinRE) and determines that the hidden EFI System Partition (ESP) has been assigned drive letter S: and the main Windows installation volume is recognized as drive letter D:. Which TWO of the following command-line actions should the technician perform to rebuild the UEFI boot files and repair offline corrupted operating system files?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute bcdboot D:\Windows /s S: /f UEFI to recreate the boot loader files on the EFI System Partition.; Execute sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows to repair protected system files on the offline Windows volume.

Cevap

The technician must execute bcdboot D:\Windows /s S: /f UEFI to rebuild the boot configuration files on the EFI partition and execute sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows to scan and repair corrupted operating system binaries in the offline Windows directory.
To repair a corrupted UEFI startup environment from WinRE, the bcdboot tool must be pointed to the OS directory (D:\Windows) and the target EFI partition (S:) using the UEFI firmware flag (/f UEFI). Additionally, to scan and repair protected system files on an offline OS instance, sfc must be executed with the /offbootdir and /offwindir parameters set to the offline OS partition.

Adım Adım Çözüm

1
Identify partition layout and system environment from WinRE Command Prompt.
Determined that the system uses UEFI/GPT, the EFI System Partition is mounted as S:, and the offline Windows system files are located on drive D:.
WinRE often assigns different drive letters to partitions than the running Windows OS environment.
2
Rebuild UEFI boot entries and Boot Configuration Data store.
Running bcdboot D:\Windows /s S: /f UEFI generates fresh boot files on partition S: targeting the Windows directory on D:.
The error 0xc00000e indicates missing or inaccessible boot configuration entries which require generating a new BCD store on the ESP.
3
Scan and fix damaged operating system files in the offline installation.
Running sfc /scannow with /offbootdir=D:\ and /offwindir=D:\Windows repairs corrupted protected files.
Using the offline switches forces SFC to target the offline installation directory on D: rather than the WinRE X: RAM disk.

Anahtar Kavram

UEFI Boot File Repair and Offline SFC Servicing in WinRE
Soru 1558Soru

As an IT support technician, you are implementing standard security controls across office desktop systems. Match each workstation hardening technique on the left to its primary risk mitigation objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Disabling AutoPlay and AutoRun features
Configuring a short password-protected screen saver timeout
Disabling unneeded operating system background services
Renaming or disabling the built-in Administrator account

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Disabling AutoPlay and AutoRun features matches with preventing automatic execution of malicious code from attached USB drives. Configuring a short password-protected screen saver timeout matches with mitigating unauthorized physical access to unattended active sessions. Disabling unneeded operating system background services matches with reducing the network attack surface by closing unused ports. Renaming or disabling the built-in Administrator account matches with protecting against targeted brute-force attacks exploiting default credentials.
Each hardening control directly addresses a distinct attack vector: disabling AutoPlay protects against removable media exploits, screen timeouts secure idle physical sessions, service minimization reduces open network ports, and account baseline changes mitigate default credential attacks.

Adım Adım Çözüm

1
Identify the primary threat vector associated with removable storage media.
Disabling AutoPlay/AutoRun directly prevents unauthorized executables from running automatically when flash drives are inserted.
AutoPlay/AutoRun exploits rely on OS features that execute scripts upon hardware detection.
2
Evaluate local physical session security measures.
Configuring a screen lock timeout ensures unattended workstations automatically lock and demand credentials.
Physical security best practices require securing idle endpoints against walkthrough intrusion.
3
Analyze operating system service minimization.
Disabling unneeded services shuts down associated listening network ports.
Fewer active background services result in a smaller overall system attack surface.
4
Examine local user account security baselines.
Disabling or renaming default accounts neutralizes automated attacks targeting known default account identifiers.
Attackers target well-known SID patterns and default names like 'Administrator' or 'Guest' first.

Anahtar Kavram

Workstation Hardening Controls and Risk Mitigation
Soru 1559Soru

A tier 2 helpdesk technician is investigating a suspicious outbound network connection originating from a Windows 11 workstation. The technician needs to identify the exact Process Identifier (PID) associated with the active network connections directly from the command prompt. Which command and switch combination should the technician execute?

Cevabı ve açıklamayı göster

Cevap: netstat -o

Cevap

The command 'netstat -o' displays active network connections along with their corresponding Process IDs (PIDs).
The 'netstat -o' command displays active TCP connections and includes the PID associated with each connection, allowing the administrator to trace network traffic directly to specific software processes.

Adım Adım Çözüm

1
Identify the diagnostic objective
The technician needs to map open network sockets to their specific owning application Process ID (PID) via the Windows Command Prompt.
Tracking PIDs allows the technician to correlate suspicious network traffic with specific running executable files.
2
Evaluate native Windows command-line utilities for network statistics
The netstat utility is designed to display active network connections, listening ports, and protocol statistics.
Using native Windows CLI tools satisfies command-line troubleshooting requirements without launching graphical tools or third-party software.
3
Select the appropriate utility parameter flag
Appending the -o parameter instructs netstat to output the PID for each listed connection.
The PID column output can subsequently be cross-referenced using tasklist or Task Manager to terminate unauthorized processes.

Anahtar Kavram

Windows CLI Network Troubleshooting Utilities (netstat parameters)
Soru 1560Soru

A user reports that a specialized productivity application closes unexpectedly every time a specific file is opened. A technician needs to inspect system logs to find the error code and faulting module details associated with these crashes. Which Windows Administrative tool should the technician open?

Cevabı ve açıklamayı göster

Cevap: Event Viewer

Cevap

Event Viewer
Event Viewer maintains system logs for Windows, including Application logs where crash details, faulting module paths, and event IDs are logged whenever a program terminates unexpectedly.

Adım Adım Çözüm

1
Identify the diagnostic requirement.
The technician needs to review historical application crash logs and faulting module details.
Application crashes generate log entries detailing error codes and faulting modules.
2
Select the correct administrative log viewing utility.
Event Viewer displays the Windows Application log containing crash entries.
Event Viewer is the standard Windows tool for inspecting logs generated by operating system services and third-party applications.

Anahtar Kavram

Using Event Viewer to inspect application crash logs and fault details
ÖncekiSayfa 78 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin