Tüm alıştırma soruları

3551 soru

Soru 1561Soru

A technician is troubleshooting a desktop workstation used for 3D modeling. The user reports that after running heavy graphics rendering tasks for several minutes, the screen displays random multicolored dots and geometric distortion across the display, immediately followed by brief blackouts. Which of the following hardware issues are the MOST likely causes of these symptoms? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Overheating or failing Video RAM (VRAM) modules on the graphics card; Excessive GPU core temperature leading to thermal throttling and temporary video signal loss

Cevap

The most likely causes are overheating or failing Video RAM (VRAM) modules on the graphics card, and excessive GPU core temperature leading to thermal throttling and temporary video signal loss.
Visual artifacts (such as random colored dots, tearing, or geometric distortion) under heavy graphics rendering are classic indicators of overheating or failing VRAM on the discrete graphics adapter. Additionally, excessive thermal buildup on the main GPU core triggers thermal throttling and transient GPU recovery resets, which manifest as temporary screen blackouts.

Adım Adım Çözüm

1
Analyze reported symptoms
Identified load-dependent visual artifacts (colored dots and geometric distortion) combined with sudden screen blackouts under intensive GPU workloads.
Symptoms that occur specifically during intensive 3D rendering indicate hardware heat saturation or component failure on the graphics adapter.
2
Evaluate hardware memory and thermal factors
Determined that VRAM degradation/overheating produces artifacting, while GPU core overheating leads to thermal protection triggers and brief signal loss.
VRAM holds frame buffer data directly; errors in frame memory generate visual corruption. GPU overheating causes thermal shutdown or reset of the display engine.

Anahtar Kavram

GPU and VRAM Thermal Troubleshooting
Soru 1562Soru

During a security audit at a logistics company, an administrator discovers a Windows 11 workstation exhibiting unauthorized rootkit activity that compromised low-level system drivers. To remediate the breach, the administrator disconnects the network cable, disables System Restore, boots the system into a clean pre-installation environment, and successfully executes a bootable anti-malware utility to eradicate the infection. After booting into Safe Mode and completing a secondary scan that verifies the system is entirely clean, which of the following actions should the administrator take NEXT to follow the standard CompTIA malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Schedule automated anti-malware definition updates and OS patch management.

Cevap

Schedule automated anti-malware definition updates and OS patch management.
According to the official CompTIA 7-step malware remediation process, the steps must be executed in precise sequential order: 1. Identify malware symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware / scan and remove), 5. Schedule updates and enable auto-update, 6. Enable System Restore and create a restore point, 7. Educate end user. Because the technician has just finished removing the rootkit and verifying cleanup (Step 4), the required next step is Step 5: scheduling anti-malware definition updates and OS patch management.

Adım Adım Çözüm

1
Identify completed steps in the CompTIA 7-step malware remediation framework
The scenario details that Step 1 (Identify symptoms), Step 2 (Quarantine system), Step 3 (Disable System Restore), and Step 4 (Remediate infected system via offline scanner and secondary Safe Mode verification) have all been completed.
Tracking completed steps prevents skipping mandatory steps or executing tasks out of order.
2
Determine the mandatory next step in the standard process order
Following Step 4 (Remediate infected systems), Step 5 requires scheduling updates and enabling automatic updates for both the OS and security software.
Configuring automatic updates ensures the system is updated with current definitions prior to restoring full system functionality.
3
Select the option that matches Step 5 of the remediation process
Scheduling automated anti-malware definition updates and OS patch management directly corresponds to Step 5.
Subsequent steps, such as re-enabling System Restore (Step 6) and user education (Step 7), must only take place after update schedules are established.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Tahmini Süre:2m 0s
Soru 1563Soru

A helpdesk technician is reviewing several recent security incident logs across the organization. Match each reported security incident scenario on the left to its corresponding threat type on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An employee receives a text message on their mobile phone claiming their financial account is compromised, containing a shortened link to verify credentials.
A system administrator discovers hidden software that altered kernel-level system files to conceal unauthorized backdoor access from Task Manager.
An unbadged visitor carrying a large package follows an employee closely through a secure door immediately after the employee scans their access card.
A user reports that all local files have been encrypted with an unrecognized extension and a text file demands cryptocurrency payment to unlock them.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Smishing matches the SMS text message lure scenario; Rootkit matches the kernel-level process hiding scenario; Tailgating matches the physical intrusion following an authorized employee scenario; Ransomware matches the file encryption demanding payment scenario.
Each scenario represents a classic security threat vector: SMS-based phishing is smishing, kernel-level hiding malware is a rootkit, following someone through a secure door without authentication is tailgating, and encrypting files for extortion is ransomware.

Adım Adım Çözüm

1
Analyze the first scenario involving an SMS text message sent to a mobile phone attempting to harvest credentials.
Identify this attack vector as Smishing (SMS Phishing).
Phishing conducted specifically over SMS text messages is categorized as smishing.
2
Analyze the second scenario involving software that alters kernel files and hides processes from management utilities.
Identify this malware type as a Rootkit.
Rootkits operate deep within the operating system kernel to maintain administrative access and cloak their presence.
3
Analyze the third scenario involving an unbadged individual physically following a badged worker through a secure entryway.
Identify this physical security breach as Tailgating.
Tailgating relies on social compliance or physical proximity to bypass electronic physical access controls.
4
Analyze the fourth scenario involving file encryption and a demand for cryptocurrency payment.
Identify this malware attack as Ransomware.
Extortion via file encryption and decryption ransom demands defines ransomware.

Anahtar Kavram

Social Engineering and Malware Threat Classifications
Tahmini Süre:1m 30s
Soru 1564Soru

A Linux system administrator needs to scan through the contents of multiple log files in the `/var/log` directory to locate lines containing the string "AUTHENTICATION_FAILURE". Which command-line tool is specifically designed to search file contents for matching text patterns?

Cevabı ve açıklamayı göster

Cevap: grep

Cevap

grep
The grep command searches text files or command output for matching lines using strings or regular expressions. It is the primary tool for searching text within files in Linux and macOS environments.

Adım Adım Çözüm

1
Identify the administrative task required
The administrator must search inside files for specific text content ("AUTHENTICATION_FAILURE").
Choosing the correct Linux utility requires determining whether the search target is file content or file metadata.
2
Evaluate the available Linux CLI commands
The grep utility processes input streams or files line by line and prints lines that match a specified pattern.
grep (Global Regular Expression Print) is the standard Unix tool for content-based text searching.

Anahtar Kavram

Linux command-line utilities for file and text searching
Soru 1565Soru

A desktop support technician is deploying a legacy 32-bit local database application on a 64-bit Windows 11 workstation. The application requires a system-wide database connection and access to shared local data files for standard domain users. Which sequence of administrative steps should the technician perform to properly configure the application and verify user access?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct procedural order is: first, launch the 32-bit ODBC Data Source Administrator executable from C:\Windows\SysWOW64\odbcad32.exe; second, create a System DSN using the target 32-bit database driver; third, set Read and Write NTFS permissions for standard domain users on the shared directory in C:\ProgramData; and fourth, sign in with a standard domain user account to verify application connectivity and file access.
Configuring legacy 32-bit software on a 64-bit operating system requires using the SysWOW64 directory path to access 32-bit utilities like odbcad32.exe. Creating a System DSN ensures all local profiles share the connection configuration. Setting Read/Write permissions on C:\ProgramData accommodates shared application state files without granting full administrative privileges, and final testing under a standard user account verifies the setup under least-privilege conditions.

Adım Adım Çözüm

1
Open the 32-bit ODBC Data Source Administrator.
The 32-bit ODBC management tool launches, exposing 32-bit database drivers installed on the 64-bit Windows system.
Windows 64-bit operating systems use C:\Windows\SysWOW64\odbcad32.exe for 32-bit database architecture administration. Using System32 would launch the 64-bit tool, which cannot configure 32-bit drivers.
2
Create a System DSN.
A system-wide Data Source Name is established.
System DSNs store connection parameters in the registry under HKEY_LOCAL_MACHINE, making the database connection available to all workstation users.
3
Configure NTFS access control lists (ACLs) on C:\ProgramData\ApplicationFolder.
Standard users gain the necessary privileges to read and write shared data files.
By default, C:\ProgramData grants Read access to standard users. Since database applications require writing to data files, explicit Write permissions must be granted.
4
Perform end-user functional testing.
Application configuration and permission inheritance are validated in the actual production execution context.
Testing must be conducted under a non-administrative account to confirm that User Account Control (UAC) or permission restrictions will not block standard users.

Anahtar Kavram

32-bit vs 64-bit Application Compatibility and Folder Permission Hierarchy
Soru 1566Soru

A system technician is tasked with preparing a leased enterprise multifunction printer (MFP) for return to a third-party vendor. The MFP contains an internal magnetic hard disk drive that cached confidential scanned documents. Corporate policy mandates that all stored data must be sanitized so it is completely unrecoverable, but the vendor lease contract requires that the device and its storage hardware remain fully functional upon return. Which of the following is the BEST method to fulfill these requirements?

Cevabı ve açıklamayı göster

Cevap: Execute an ATA Secure Erase routine on the drive via the device administrative interface.

Cevap

Execute an ATA Secure Erase routine on the drive via the device administrative interface.
Executing an ATA Secure Erase routine sends a low-level hardware command directly to the drive controller to overwrite all memory locations. This purges the cached sensitive data to security standards while keeping the drive operational for lease return.

Adım Adım Çözüm

1
Identify the storage technology and constraints specified in the scenario.
The media is an internal hard drive in a leased multifunction printer that must be thoroughly sanitized without destroying the underlying hardware.
The lease agreement demands functional equipment return, excluding physical destruction methods.
2
Evaluate sanitization methods against usability and security requirements.
Degaussing and physical drilling permanently damage magnetic media components, while standard formatting leaves data recoverable.
Only cryptographic or purge-level disk wiping commands remove data securely while retaining drive functionality.
3
Select the appropriate software-based purging method.
ATA Secure Erase instructs the drive controller to overwrite all user sectors and hidden areas completely.
This complies with NIST SP 800-88 purge guidelines for reusable magnetic media.

Anahtar Kavram

Selecting proper data sanitization methods for reusable leased media
Soru 1567Soru

A user reports that a 3D modeling application crashes unexpectedly whenever high-resolution assets are exported on a Windows 11 workstation. A technician inspects Event Viewer and identifies an Application Error (Event ID 1000) indicating that a core system library, ntdll.dll, is the faulting module. Which of the following commands should the technician execute FIRST in an elevated command prompt to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: sfc /scannow

Cevap

Run sfc /scannow from an elevated command prompt to verify and replace corrupted operating system files.
Running the command 'sfc /scannow' executes the System File Checker utility, which inspects all protected Windows system files and replaces corrupted dynamic link libraries (such as ntdll.dll) with clean cached copies from the Windows component store.

Adım Adım Çözüm

1
Analyze the Event Viewer log details.
Identified Event ID 1000 with ntdll.dll listed as the faulting module, indicating a potential Windows core system file corruption.
Event ID 1000 application crashes referencing system DLLs point to corrupted or missing Windows operating system binaries.
2
Select the appropriate administrative tool to scan and repair protected operating system files.
Determined that System File Checker (sfc /scannow) is designed to inspect and repair system file corruption.
SFC checks the integrity of all protected system files and replaces corrupted versions with valid copies from the cached Windows store.
3
Execute sfc /scannow in an elevated command prompt.
The utility repairs ntdll.dll without requiring an OS reinstallation or destructive disk operations.
Using non-destructive isolation tools first follows proper CompTIA A+ troubleshooting methodology.

Anahtar Kavram

System File Checker (SFC) for Application Crash Resolution
Tahmini Süre:1m 15s
Soru 1568Soru

A user contacts the help desk because system configuration files and file extensions are hidden while navigating directories in File Explorer. A desktop technician needs to adjust global view settings so that hidden files, folders, and extension types are always visible. Which Control Panel utility should the technician open to make these adjustments?

Cevabı ve açıklamayı göster

Cevap: File Explorer Options

Cevap

File Explorer Options is the correct utility to configure the visibility of hidden files, folders, and file extensions across directories.
File Explorer Options allows technicians to customize how files and folders are presented in Windows. Under the View tab, technicians can enable the display of hidden files, folders, and drives, as well as show file extensions for known file types.

Adım Adım Çözüm

1
Identify the administrative requirement.
The requirement is to modify file view settings to reveal hidden files, hidden folders, and file extensions.
By default, Windows hides known file extensions and system folders to prevent accidental modification.
2
Locate the appropriate Control Panel applet.
File Explorer Options contains the 'View' tab where folder view preferences are managed.
Control Panel categorizes folder navigation, file display rules, and search options under File Explorer Options.
3
Apply the configuration.
Selecting 'Show hidden files, folders, and drives' and unchecking 'Hide extensions for known file types' resolves the visibility issue.
These specific settings directly control file attribute rendering in File Explorer.

Anahtar Kavram

Windows Control Panel Utilities for Directory and File View Management
Soru 1569Soru

An IT technician is configuring legacy embedded environmental monitoring units throughout a datacenter facility. The embedded operating system on these units cannot host endpoint security agents, lacks native full-disk encryption capabilities, and cannot be enrolled in the enterprise Mobile Device Management (MDM) solution. To prevent unauthorized access and protect the core network from lateral movement if a monitor is compromised, which of the following is the BEST primary security measure to implement?

Cevabı ve açıklamayı göster

Cevap: Isolate the monitoring units on a dedicated network segment with restricted firewall access and replace all factory default administrative passwords.

Cevap

Isolate the monitoring units on a dedicated network segment with restricted firewall access and replace all factory default administrative passwords.
Embedded systems often have limited computing resources and static firmware, making them incapable of running traditional MDM software, anti-malware agents, or containerized applications. Securing these systems relies on network micro-segmentation (isolating them on dedicated VLANs with strict firewall ACLs) and disabling or updating default vendor administrative credentials to reduce exposure.

Adım Adım Çözüm

1
Analyze device limitations and security constraints.
Identified that embedded IoT devices lack agent support, encryption, and MDM compatibility.
Embedded systems frequently use specialized firmware or Real-Time Operating Systems (RTOS) that cannot run standard security tools.
2
Determine appropriate defense-in-depth controls for constrained devices.
Select network-level isolation (micro-segmentation/VLANs) and fundamental device hardening (credential changes).
Since internal agent-based security cannot be installed, network barriers and changing default credentials prevent unauthorized administrative login and lateral movement.

Anahtar Kavram

Embedded System Hardening and Network Segmentation
Tahmini Süre:2m 0s
Soru 1570Soru

A technician is implementing security baselines on standalone Windows 11 computers deployed in a sensitive research facility. To harden the workstations against unauthorized network name spoofing and lateral movement attempts without interfering with required administrative tasks, the technician must turn off vulnerable legacy broadcast protocols and shut down unused background operating system services. Which of the following security actions best accomplishes these hardening goals?

Cevabı ve açıklamayı göster

Cevap: Disable Link-Local Multicast Name Resolution (LLMNR) via Local Group Policy and stop/disable the Remote Registry service.

Cevap

The technician should disable Link-Local Multicast Name Resolution (LLMNR) via Local Group Policy and stop/disable the Remote Registry service.
Disabling Link-Local Multicast Name Resolution (LLMNR) prevents fall-back broadcast name resolution spoofing attacks, and disabling the Remote Registry service stops unauthorized users from reading or altering registry keys remotely. Together, these steps effectively reduce the network attack surface on standalone workstations.

Adım Adım Çözüm

1
Identify key attack vectors associated with legacy network resolution and unnecessary system services.
Recognize that LLMNR uses unauthenticated network broadcasts that attackers can spoof to capture credential hashes, while the Remote Registry service exposes registry modifications over the network.
Hardening requires reducing the system attack surface by turning off unneeded protocols and services.
2
Select the appropriate administrative controls to disable these components on standalone Windows endpoints.
Use Local Group Policy Editor (gpedit.msc) to disable turn off multicast name resolution, and Services (services.msc) to set Remote Registry startup type to Disabled.
This directly mitigates network spoofing and unauthorized remote registry access without restricting authorized local administrative management.

Anahtar Kavram

Workstation Service and Protocol Hardening
Tahmini Süre:2m 0s
Soru 1571Soru

A desktop computer running Windows 10 fails to start and presents the message "Operating System Not Found" immediately following POST. After booting into the Command Prompt within the Windows Recovery Environment (WinRE), which TWO commands should the technician execute to repair the master boot record and rebuild the boot configuration storage file? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: bootrec /fixmbr; bootrec /rebuildbcd

Cevap

The technician should execute bootrec /fixmbr to write a compatible Master Boot Record and bootrec /rebuildbcd to scan and rebuild the Boot Configuration Data store.
To resolve startup boot sector and configuration errors, executing bootrec /fixmbr rewrites the master boot record code, while bootrec /rebuildbcd locates existing Windows installations and recreates the boot configuration file required for system startup.

Adım Adım Çözüm

1
Identify the boot failure symptom
The error message 'Operating System Not Found' indicates missing or corrupted boot sector code or missing BCD references.
When the bootloader or MBR is missing or corrupted, the system firmware cannot locate the operating system files.
2
Execute the boot record repair command
Running bootrec /fixmbr writes a new Master Boot Record code to the system partition without altering existing partition tables.
This resolves corruption in the MBR that prevents the system from starting the boot chain.
3
Execute the boot configuration rebuild command
Running bootrec /rebuildbcd scans all connected storage drives for Windows installations and rebuilds the BCD store.
This restores the critical boot configuration file needed by Windows Boot Manager.

Anahtar Kavram

Troubleshooting Windows Boot Sector and BCD Corruption using WinRE Bootrec Utilities
Soru 1572Soru

An IT technician is dispatched to troubleshoot a desktop inkjet printer that is producing printed documents with missing horizontal lines and faded colors. Arrange the technician's troubleshooting steps in the correct sequence according to the standard CompTIA troubleshooting methodology, from first step to last step.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct troubleshooting sequence follows the standard CompTIA 6-step methodology: 1) Gather details and inspect output to identify the problem, 2) Formulate a theory that dried ink has clogged the printhead nozzles, 3) Test the theory by printing a diagnostic nozzle check pattern, 4) Implement the solution by running a printhead cleaning cycle and alignment, and 5) Verify full functionality with a test page and document the resolution in the support ticket.
The correct order strictly adheres to the official CompTIA 6-step troubleshooting methodology: first identifying the problem through user inquiry and symptom inspection, second establishing a theory of dried ink nozzle blockage, third testing that theory with a diagnostic print grid, fourth implementing the solution via printhead cleaning software, and fifth verifying functionality with a test page while documenting outcomes.

Adım Adım Çözüm

1
Identify the problem
Technician gathers information from the user and inspects physical print defects.
CompTIA methodology requires defining the scope and nature of the issue before forming conclusions.
2
Establish a theory of probable cause
Technician identifies printhead nozzle clogging as the most likely root cause for missing horizontal bands.
Developing a probable cause guides targeted diagnostic testing.
3
Test the theory to determine cause
Technician prints a nozzle check test grid to visually confirm missing ink flows.
Empirical testing validates whether the theory is correct prior to performing corrective repairs.
4
Establish a plan of action and implement the solution
Technician performs printhead cleaning cycles and alignment routines.
Implementing the corrective action resolves the underlying hardware issue.
5
Verify full system functionality and document findings
Technician verifies crisp output with a test page and logs the fix in the ticketing system.
Ensures the system is completely operational and maintains institutional knowledge for future issues.

Anahtar Kavram

CompTIA Troubleshooting Methodology for Inkjet Print Quality Issues
Soru 1573Soru

A systems administrator is configuring a wireless network for a medical office. Company policy mandates that every employee must authenticate individually using their corporate Active Directory network credentials, and all wireless traffic must be encrypted using modern AES encryption. Which of the following wireless security configurations best meets these security requirements?

Cevabı ve açıklamayı göster

Cevap: WPA3-Enterprise using 802.1X authentication with AES encryption

Cevap

WPA3-Enterprise using 802.1X authentication with AES encryption is the correct configuration.
The configuration specifying WPA3-Enterprise with 802.1X authentication and AES encryption directly meets all specified requirements. Enterprise modes implement 802.1X port-based access control, requiring clients to authenticate against an authentication server (e.g., RADIUS) using their individual Active Directory credentials. Furthermore, WPA3 enforces strong AES-based encryption algorithms.

Adım Adım Çözüm

1
Identify the authentication requirement
Individual user logins via corporate Active Directory demand an Enterprise security mode using 802.1X and a RADIUS server, rather than a shared passphrase (Personal mode).
Personal modes (PSK/SAE) share one password across all client devices, preventing unique user identification and centralized access revocation.
2
Identify the encryption requirement
The requirement specifies AES encryption.
AES (used in CCMP/GCMP) provides strong, modern data protection, whereas TKIP is a legacy mechanism that is deprecated and insecure.
3
Combine requirements to select the correct wireless mode
WPA3-Enterprise with 802.1X and AES meets both individual authentication and strong encryption requirements.
It combines centralized domain authentication with robust AES-based cryptographic suites.

Anahtar Kavram

Wireless Security Modes (Personal vs. Enterprise) and Encryption Standards
Tahmini Süre:1m 15s
Soru 1574Soru

A systems administrator is troubleshooting a Windows 11 workstation where a background line-of-business service crashes every morning at 08:00 AM. Event Viewer displays Event ID 1000 in the Application log with faulting module `ntdll.dll` and exception code `0xc0000005`. Concurrently, Performance Monitor metrics show that the system's non-paged pool memory continuously increases throughout the morning until the crash occurs, while paged pool memory remains stable. Which of the following is the most likely cause of this performance degradation and application crash, and what is the most appropriate action to isolate it?

Cevabı ve açıklamayı göster

Cevap: A kernel-mode device driver memory leak is consuming non-paged pool resources; identify recently updated drivers using Driver Verifier or review system driver updates.

Cevap

The issue is caused by a kernel-mode driver memory leak consuming non-paged pool RAM, which should be isolated by inspecting recent driver updates or utilizing Driver Verifier.
Non-paged pool memory allocations are reserved for the Windows kernel and third-party device drivers. Because this memory cannot be paged to disk, a driver memory leak will continuously consume physical RAM until system memory resources are exhausted, triggering access violation exceptions (`0xc0000005`) in low-level API libraries like `ntdll.dll`. Diagnosing drivers via Driver Verifier or rollback of recently updated drivers is the correct isolation strategy.

Adım Adım Çözüm

1
Analyze Performance Monitor memory metrics.
Identify that non-paged pool usage is steadily increasing over time without being released.
Non-paged pool memory is dedicated to the Windows kernel and hardware device drivers. Unlike user-mode memory or paged pool, non-paged pool RAM MUST remain in physical RAM and cannot be moved to `pagefile.sys`.
2
Correlate non-paged pool leak with the application crash symptom.
Recognize that memory pool exhaustion eventually deprives critical subsystem libraries like `ntdll.dll` of memory allocations, leading to access violation crashes (`0xc0000005`).
`ntdll.dll` is the central user-mode entry point to the Windows kernel. When kernel memory pools are depleted, calls passing through `ntdll.dll` fail catastrophically.
3
Select the correct isolation tool and remediation path.
Use tools targeted at kernel drivers (such as PoolMon, Driver Verifier, or reviewing recent driver updates) rather than user-mode application compatibility tweaks or pagefile modifications.
Resolving driver memory leaks requires identifying the specific kernel module leaking resources.

Anahtar Kavram

Windows Memory Pool Troubleshooting and Event Log Analysis
Soru 1575Soru

A desktop support technician is configuring Local Security Policy (secpol.msc) settings on standalone Windows 11 Pro workstations. The organization's security policy mandates two specific conditions: standard users must be prompted to enter administrator credentials whenever attempting a task requiring elevation, and administrators logged into their accounts must be presented with a prompt asking for explicit consent without needing to re-enter their password. Which of the following User Account Control (UAC) policy settings should the technician configure to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: User Account Control: Behavior of the elevation prompt for standard users -> Prompt for credentials on the secure desktop; User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode -> Prompt for consent on the secure desktop

Cevap

The technician should configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Prompt for credentials on the secure desktop' and 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop'.
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to prompt for credentials forces Windows to display a credential dialog when a standard user attempts an administrative action, allowing privilege elevation upon entering admin credentials. Configuring 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to prompt for consent requires administrators to explicitly approve privilege elevation via a Yes/No prompt on the secure desktop without typing a password.

Adım Adım Çözüm

1
Determine the required policy setting for standard user elevation.
Standard users require an elevation prompt that asks for administrator credentials.
Setting 'Behavior of the elevation prompt for standard users' to 'Prompt for credentials on the secure desktop' fulfills the standard user credential requirement.
2
Determine the required policy setting for administrator account elevation.
Administrators require a consent prompt (Yes/No confirmation) rather than entering credentials.
Setting 'Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop' satisfies the administrative consent requirement.
3
Verify Local Security Policy (secpol.msc) node locations under Security Options.
Both options exist directly under Local Policies -> Security Options in secpol.msc.
Ensures technical accuracy within Windows security policy management.

Anahtar Kavram

Windows User Account Control (UAC) Local Security Policy options governing elevation prompt behaviors for standard and administrator accounts.
Soru 1576Soru

A system administrator suspects that core Windows operating system files have become corrupted on a workstation. To properly repair the system file repository before replacing damaged operating system binaries, in what order should the technician execute the diagnostic and remediation steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts by opening an elevated Command Prompt, followed by executing DISM to fix the component store, running SFC to repair system files using the healthy store, and finally rebooting the workstation.
The proper troubleshooting order requires administrative elevation first, followed by servicing the Windows component store using DISM. Once the store is verified healthy, SFC can successfully repair protected system files, and a system reboot finalizes the process.

Adım Adım Çözüm

1
Elevate command line privileges
Command Prompt opens with administrative rights necessary to modify system binaries.
DISM and SFC commands fail if run in a standard non-elevated user context.
2
Execute DISM restorehealth flag
The local Windows component store image (WinSxS) is verified and repaired using Windows Update or specified source files.
SFC relies on a healthy component store to replace corrupt files; fixing DISM first ensures SFC will succeed.
3
Execute SFC scannow flag
Protected system files are checked for integrity and corrupted files are overwritten with clean copies.
System File Checker compares active binaries against the clean copies in the component store.
4
Reboot the system
Files that were in use during the SFC scan are overwritten during startup.
Completes the remediation process when core files cannot be unlocked during runtime.

Anahtar Kavram

Windows Command-Line Repair Workflow (DISM before SFC)
Soru 1577Soru

A technician is troubleshooting a Windows workstation where a database client application frequently freezes and becomes unresponsive. The technician needs to identify which specific thread or process is causing the application to hang and review official crash logs. Which TWO of the following tools or actions should the technician use? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the Analyze Wait Chain feature in Task Manager to see if the process is waiting on another resource.; Examine the Event Viewer Application log for AppHang or AppCrash event details.

Cevap

The technician should analyze the process wait chain in Task Manager and review the Application logs in Event Viewer to diagnose the hanging application.
Analyzing the Wait Chain in Task Manager helps identify what thread or process the application is waiting for, and reviewing the Application log in Event Viewer details specific crash/hang error logs. Together, these actions provide immediate diagnostic evidence without altering system state.

Adım Adım Çözüm

1
Identify resource bottlenecks causing application unresponsiveness.
Using Task Manager's Analyze Wait Chain feature pinpoints if the application is waiting on another blocked thread or system resource.
This isolates whether the hang is internal to the application or caused by a dependent process.
2
Inspect logged system events related to application failures.
Checking Event Viewer under Windows Logs -> Application displays historical crash and hang entries.
Event logs report specific error codes and faulting modules needed for troubleshooting.

Anahtar Kavram

Identifying application hang threads using Task Manager Wait Chain analysis and reviewing failure logs in Event Viewer.
Soru 1578Soru

An employee connects a newly issued 4K4\text{K} resolution monitor to their workstation's dedicated graphics card using an older, unrated video cable found in storage. Although the display powers on and displays an image, the maximum selectable refresh rate in the operating system settings is capped at 30 Hz30\text{ Hz}, and screen flickering occurs when attempting higher resolutions. The technician confirms that the graphics card driver is up to date and fully supports 4K4\text{K} output at 60 Hz60\text{ Hz} and above. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The video cable lacks the bandwidth capacity required for the higher resolution and refresh rate combination.

Cevap

The video cable lacks the bandwidth capacity required for the higher resolution and refresh rate combination.
Display resolution and refresh rate output depend directly on cable bandwidth. When an older or lower-standard cable (such as standard HDMI 1.4 or single-link cable) is used for a 4K4\text{K} screen, the available throughput is insufficient for 4K4\text{K} at 60 Hz60\text{ Hz} or higher. Consequently, Extended Display Identification Data (EDID) negotiation limits the selectable refresh rate in the operating system to 30 Hz30\text{ Hz}, and forcing higher bandwidth leads to signal loss or flickering.

Adım Adım Çözüm

1
Analyze the reported symptoms and environment.
The display functions at 4K4\text{K} resolution but restricts refresh rates to 30 Hz30\text{ Hz} and flickers when pushed further, despite verified GPU driver capability.
Display resolution and refresh rate limits are determined by the combined capabilities of the GPU, monitor panel, and interconnect cable.
2
Evaluate the interconnecting cable specs.
Using an unrated or older specification cable limits total data throughput bandwidth.
Higher resolutions (4K4\text{K}) paired with higher refresh rates (60 Hz+60\text{ Hz}+) require high bandwidth cables (e.g., HDMI 2.0+ or DisplayPort 1.2+). Legacy or cheap cables trigger Display Data Channel (DDC) bandwidth restrictions.
3
Select the correct diagnostic conclusion.
Replacing the legacy cable with a certified High Speed / Ultra High Speed cable will resolve the bandwidth constraint.
Cable throughput mismatch is the root cause of capped refresh rates and signal flickering in high-resolution setups.

Anahtar Kavram

Display Cable Bandwidth and Refresh Rate Limitations
Soru 1579Soru

A security technician at a corporate facility reviews badge access logs and camera footage following an unauthorized entry into a restricted server room. The footage reveals an unknown individual carrying several large, heavy boxes who asked an employee to hold the badge-restricted electronic door open. The employee complied out of courtesy and held the door, allowing the individual to enter the facility without scanning a security credential. Which of the following social engineering techniques occurred in this scenario?

Cevabı ve açıklamayı göster

Cevap: Piggybacking

Cevap

Piggybacking
Piggybacking refers to a physical social engineering attack where an unauthorized individual gains entry into a restricted area with the active assistance or consent of an authorized person, typically by appealing to social norms like holding a door open for someone carrying heavy items.

Adım Adım Çözüm

1
Analyze the physical access mechanism described in the scenario.
The perpetrator gained entry into a secure building without presenting valid access credentials.
Security protocols require every individual entering a restricted area to authenticate independently.
2
Evaluate the interaction between the intruder and the authorized employee.
The intruder asked the employee to hold the door, and the employee knowingly held it open out of courtesy.
Distinguishing whether entry was gained with the employee's active cooperation determines the exact social engineering classification.
3
Differentiate between piggybacking and tailgating.
Because the employee held the door open with consent/awareness, the attack is classified as piggybacking.
Piggybacking implies permission or compliance from the authorized person, whereas tailgating involves sneaking in unassisted.

Anahtar Kavram

Physical Social Engineering Threat Types
Soru 1580Soru

Match each Linux/macOS command-line utility to its primary administrative function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

find
killall
uname
passwd

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The command 'find' searches the directory hierarchy for files matching specific criteria; 'killall' terminates running processes by program name; 'uname' prints system architecture and kernel release information; and 'passwd' changes user account credentials.
Each tool directly maps to its primary administrative function: 'find' searches the directory tree for files, 'killall' stops processes matching a program name, 'uname' outputs kernel and architecture data, and 'passwd' changes account passwords.

Adım Adım Çözüm

1
Identify the file system search utility
'find' pairs with searching directory hierarchies based on file name or size.
The 'find' command evaluates directory trees recursively for files meeting specified criteria.
2
Identify the process termination command targeting by name
'killall' pairs with terminating processes by program name.
Unlike 'kill', which requires a specific Process ID (PID), 'killall' targets all instances sharing a process name.
3
Identify the system specification utility
'uname' pairs with printing kernel version and machine architecture information.
The 'uname' command outputs platform configuration data like system name, kernel release, and hardware architecture.
4
Identify the credential modification tool
'passwd' pairs with modifying user account authentication credentials.
The 'passwd' command updates password hashes for user accounts.

Anahtar Kavram

macOS and Linux Operating System Features and Tools
ÖncekiSayfa 79 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin