Examkin

Tüm alıştırma soruları

3551 soru

Tüm türler3,551Çoktan seçmeli1,809Çoklu seçim786Sayısal12Eşleştirme521Sıralama423
Soru 1581Soru →

An IT technician in an engineering laboratory responds to a workstation flagged for suspicious file-encrypting worm activity. The technician has already quarantined the machine by disconnecting its network cable and disabling all wireless adapters. Which of the following actions should the technician perform NEXT before conducting a full system anti-malware scan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Restore on the infected workstation to prevent malicious files from being cached in restore points.; Download the latest anti-malware signature updates on a clean machine and transfer them to the isolated system using removable media.

Cevap

The technician must disable System Restore on the infected system and manually update anti-malware definitions using removable media before scanning.
Following the CompTIA 7-step malware remediation process, once a system is quarantined (Step 2), the technician must disable System Restore (Step 3) to prevent clean files from being overwritten by infected restore points. The technician must then update anti-malware signature definitions (Step 4a) out-of-band using removable media to keep the system isolated before initiating full scans (Step 4b).

Adım Adım Çözüm

1
Review current remediation stage within the CompTIA 7-step process
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
Determining current progress identifies which prerequisite steps remain prior to active remediation.
2
Execute Step 3 of malware remediation (Disable System Restore)
System Restore is turned off, clearing existing restore points.
If System Restore remains enabled, Windows might back up infected system files or allow malware to restore itself after clean-up.
3
Execute Step 4a of malware remediation (Update anti-malware environment)
Anti-malware signatures are updated out-of-band via USB flash drive without reconnecting to the network.
Scanning with outdated definitions may miss new variants, while reconnecting to a network breaks quarantine.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Tahmini Süre:2m 0s
Soru 1582Soru →

An IT technician is decommissioning legacy corporate workstations that contain a mix of magnetic hard disk drives (HDDs) and solid-state drives (SSDs) containing confidential employee information. The drives must be sanitized prior to transferring the hardware to an external recycling facility. Which of the following actions represent valid data destruction methods for these storage media? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Physical shredding or disintegration of both HDDs and SSDs into tiny physical fragments; Exposing the magnetic hard disk drives to a high-capacity degausser

Cevap

Physical shredding of both drive types and degaussing the magnetic hard disk drives are valid data destruction methods.
Physical shredding or disintegration destroys the physical structure of both HDDs and SSDs, rendering data recovery impossible regardless of storage architecture. Degaussing subjects magnetic storage to a powerful magnetic field that disrupts magnetic domains, permanently destroying data on HDDs.

Adım Adım Çözüm

1
Identify the media types being decommissioned
The media consists of both magnetic HDDs (magnetic domain storage) and SSDs (flash memory electronic storage).
Different storage technologies require specific sanitization and destruction techniques.
2
Evaluate degaussing against magnetic vs solid-state media
Degaussing works on HDDs by destroying magnetic fields, but has no sanitization effect on non-magnetic SSD flash memory.
Degaussers disrupt magnetic domains; semiconductors do not store data magnetically.
3
Evaluate physical destruction across media types
Physical shredding or disintegration renders both magnetic platters and flash memory chips physically destroyed.
Physical destruction prevents raw data extraction from any storage medium.

Anahtar Kavram

Data Destruction and Sanitization Methods for HDDs vs. SSDs
Soru 1583Soru →

A system administrator is preparing to deploy an in-house developed software utility to corporate Windows 11 desktop workstations. During pre-deployment testing, the installer prompts for elevated credentials via User Account Control (UAC) and completes successfully under an administrator account. However, when standard domain users launch the installed application from their desktops, the application immediately crashes with a file access permission violation when attempting to write temporary working files. Which of the following configuration changes should be made to resolve this issue while adhering to security best practices?

Cevabı ve açıklamayı göster

Cevap: Modify the application configuration so that temporary files are written to the logged-in user's %LOCALAPPDATA% folder rather than the application's Program Files directory.

Cevap

Modify the application configuration so that temporary files are written to the logged-in user's %LOCALAPPDATA% folder rather than the application's Program Files directory.
The correct answer addresses the root cause of the permission violation. In modern Windows operating systems, standard user accounts have read and execute rights in the Program Files directory but are blocked from creating or modifying files there. Applications designed for standard users should store temporary data, logs, and user settings inside the user's profile directory (such as %LOCALAPPDATA%), where standard users naturally hold write permissions.

Adım Adım Çözüm

1
Analyze the file permission model in Windows operating systems.
Identified that Program Files and Program Files (x86) are restricted system directories where standard users possess read/execute permissions but lack write permissions.
Windows uses default access control lists (ACLs) on system directories to prevent unprivileged users or malware from altering executable files.
2
Evaluate storage locations intended for user-specific dynamic data.
Determined that standard users have full write permissions within their personal profile paths (e.g., %USERPROFILE%\AppData\Local or %LOCALAPPDATA%).
Applications must separate global read-only binaries from per-user writable data to function under standard user privileges.
3
Select the resolution that aligns with security best practices.
Reconfiguring the application to direct temporary working files to %LOCALAPPDATA% solves the crash without relaxing system directory security controls.
Maintaining default NTFS permissions on system directories prevents security risks while enabling proper application execution.

Anahtar Kavram

Application Data Storage Locations and User Access Permissions
Soru 1584Soru →

An IT security administrator is establishing mobile endpoint and embedded system security policies for an enterprise organization. Match each operational security goal on the left with the correct policy control or technical implementation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Restricting mobile application functionality automatically when a device physically exits an authorized corporate facility campus.
Encapsulating corporate apps and data on employee-owned (BYOD) devices to allow targeted removal without touching personal content.
Preventing unauthorized execution of unverified binaries on embedded industrial sensors that lack traditional antivirus software.
Verifying device OS patch state, encryption status, and root/jailbreak integrity before permitting a remote VPN connection.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Restricting mobile application functionality based on physical perimeter location matches with Geofencing.
2. Encapsulating corporate apps and data on BYOD devices matches with Containerization.
3. Preventing unauthorized binary execution on embedded devices matches with Application Whitelisting.
4. Verifying device security health before granting VPN access matches with Posture Assessment.
Each requirement directly aligns with its specific technical implementation:
- Location-driven security enforcement uses Geofencing.
- Segmenting corporate data from personal storage on BYOD endpoints utilizes Containerization.
- Restricting execution on resource-constrained embedded systems relies on Application Whitelisting.
- Evaluating endpoint health before establishing connection tunnels requires Posture Assessment.

Adım Adım Çözüm

1
Analyze location-based policy enforcement requirements for mobile devices.
Identify that using location services (GPS/cellular/Wi-Fi) to restrict app capabilities outside a physical boundary defines geofencing.
Geofencing dynamically alters device posture or application availability based on real-time location metrics.
2
Evaluate BYOD data isolation and selective wipe controls.
Identify containerization (MAM) as the technology designed to sandbox corporate assets from personal user storage.
Containerization ensures corporate privacy control while maintaining personal user privacy on non-corporate-owned hardware.
3
Determine execution control methods for embedded IoT hardware.
Match application whitelisting with embedded system binary execution control.
Embedded systems frequently lack compute resources for real-time signature antivirus scanning, making strict whitelisting the optimal default-deny mitigation.
4
Examine pre-connection health validation controls.
Associate checking patch levels and root status before VPN access with posture assessment.
Posture assessment ensures endpoints satisfy baseline health requirements prior to network connection authorization.

Anahtar Kavram

Mobile Device and Embedded System Security Controls
Soru 1585Soru →

A shipping warehouse technician replaces the media roll on a direct thermal barcode printer used for generating shipping labels. Following the roll replacement, the printer correctly feeds the paper and operates without error lights during print jobs, but all output labels come out completely blank. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: Standard thermal-transfer or plain paper label stock was installed instead of direct thermal paper.

Cevap

Standard thermal-transfer or plain paper label stock was installed instead of direct thermal paper.
Direct thermal printers utilize a thermal printhead to apply heat directly to specially treated heat-sensitive media. If standard paper or thermal-transfer labels (which require an ink ribbon) are installed by mistake, the heat applied by the printhead produces no chemical reaction, resulting in completely blank labels.

Adım Adım Çözüm

1
Analyze the printer technology and reported symptom
The printer uses direct thermal technology (which uses heat-sensitive media without ink or toner ribbon) and feeds paper normally but leaves no visible marks.
Direct thermal printers do not use ribbons; heat applied by the printhead triggers a chemical reaction on special direct thermal paper to create images.
2
Evaluate the recent change
The issue immediately followed the replacement of the label media roll.
Replacing direct thermal labels with standard thermal-transfer paper or plain labels prevents any image formation because standard paper has no heat-reactive coating.
3
Select the correct root cause
Confirming incorrect media stock as the root cause.
Verifying media compatibility is the primary step when blank pages follow a media replacement on a thermal printer.

Anahtar Kavram

Direct thermal printing media requirements
Tahmini Süre:1m 15s
Soru 1586Soru →

An IT security technician is updating baseline security policies for workstations deployed across an enterprise network. Match each workstation hardening control on the left with the specific risk or attack vector it is primarily designed to mitigate on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Restricting 'Allow log on locally' rights via Local Group Policy
Enforcing screensaver timeout with password protection
Disabling the built-in Guest account and renaming the default Administrator account
Disabling AutoPlay and AutoRun policies across all storage volumes

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Restricting local logon rights matches with preventing non-authorized user accounts from establishing interactive physical console sessions. Enforcing screensaver timeout with password protection matches with preventing unauthorized physical access to an active desktop session when left unattended. Disabling the built-in Guest account and renaming the Administrator account matches with mitigating automated dictionary attacks targeting standard accounts. Disabling AutoPlay and AutoRun policies matches with preventing automatic execution of untrusted payloads when removable media is inserted.
Each workstation hardening control addresses a specific vulnerability vector. Restricting local logon permissions prevents unauthorized accounts from initiating physical console sessions. Password-protected screen locks prevent physical exposure of unattended active sessions. Disabling or renaming built-in accounts thwarts automated credential guessing against default account identifiers. Disabling AutoPlay/AutoRun stops drive-by code execution from connected removable storage.

Adım Adım Çözüm

1
Analyze local user rights policies for interactive logon control.
Determined that 'Allow log on locally' controls physical console logon capability.
Restricting this permission ensures that only authorized personnel can log into the local workstation console.
2
Evaluate inactivity screen locking mechanisms.
Identified that password-protected screen saver timeouts lock active sessions automatically.
When a technician or user steps away, the lock prevents passerby tampering and shoulder surfing.
3
Examine account obfuscation and disabling policies.
Identified that default accounts like Guest and Administrator are predictable targets.
Renaming or disabling default accounts blocks automated scripts relying on standard account names.
4
Assess removable media execution controls.
Determined that AutoPlay/AutoRun policies govern media file auto-execution.
Disabling these features stops rogue USB flash drives or external drives from launching malicious code automatically.

Anahtar Kavram

Workstation Hardening and Threat Mitigation Controls
Tahmini Süre:2m 0s
Soru 1587Soru →

A technician is troubleshooting a Windows workstation that fails to boot, displaying error code 0xc000014c with a message indicating that the Boot Configuration Data (BCD) file is missing or contains errors. The technician boots the computer into the Windows Recovery Environment (WinRE) and opens the Command Prompt. Which of the following commands should the technician execute to scan for installed operating systems and rebuild the BCD repository?

Cevabı ve açıklamayı göster

Cevap: bootrec /rebuildbcd

Cevap

The command bootrec /rebuildbcd scans all connected storage drives for installed Windows operating systems and allows the technician to rebuild the Boot Configuration Data (BCD) store.
Executing bootrec /rebuildbcd searches all mounted storage volumes for Windows installations and allows the user to rebuild the Boot Configuration Data store, directly resolving BCD corruption errors such as 0xc000014c.

Adım Adım Çözüm

1
Analyze the boot error symptom code 0xc000014c.
Identified that the system cannot locate or read the Boot Configuration Data (BCD) file.
Error 0xc000014c specifically indicates missing or corrupted BCD information.
2
Boot into the Windows Recovery Environment (WinRE) Command Prompt.
Opened an offline command line interface with administrative recovery utilities.
Boot environment files cannot be modified while the standard operating system is active or failing to load.
3
Execute the utility command bootrec /rebuildbcd.
The utility scans the disk partitions for Windows installations and prompts to re-add them to the BCD repository.
This process constructs a clean BCD store, enabling Windows Boot Manager to start the operating system.

Anahtar Kavram

Rebuilding Windows Boot Configuration Data (BCD)
Soru 1588Soru →

A systems administrator needs to configure a network firewall to allow remote command-line administration of a headless Linux web server over an untrusted external network. The management session must ensure that login credentials and command outputs are fully encrypted in transit. Which of the following default protocol and port combinations should the administrator permit through the firewall?

Cevabı ve açıklamayı göster

Cevap: SSH over TCP port 22

Cevap

SSH over TCP port 22 is the correct choice because it provides secure, encrypted command-line access for remote administration over untrusted networks.
SSH (Secure Shell) operating on default TCP port 22 is designed specifically to establish secure, encrypted shell/command-line sessions over unsecure public networks, ensuring confidentiality of administrator credentials and transmitted data.

Adım Adım Çözüm

1
Identify the remote management interface requirement.
The scenario specifies command-line (terminal) administration of a Linux server.
Choosing between command-line and graphical interface tools narrows down protocol candidates (SSH/Telnet vs RDP/VNC).
2
Evaluate security and encryption requirements.
The network connection passes through an untrusted external network, requiring end-to-end transport encryption.
Unencrypted protocols such as Telnet expose credentials to packet sniffing.
3
Select the correct protocol and default network port.
SSH encrypts all traffic and listens on TCP port 22 by default.
Permitting TCP port 22 on the firewall satisfies both the security encryption requirement and the command-line interface requirement.

Anahtar Kavram

SSH vs Telnet and default port assignments for secure remote command-line administration
Tahmini Süre:1m 0s
Soru 1589Soru →

A Windows workstation running an internal financial reporting tool becomes unresponsive and freezes periodically during data sync operations. A technician needs to determine why the application is hanging and identify the specific executable or system file causing the failure. Which of the following actions should the technician perform to isolate the issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the Analyze Wait Chain feature on the reporting tool process within Resource Monitor.; Examine the Event Viewer Application log for Event ID 1000 or Event ID 1002 fault entries.

Cevap

The technician should inspect the process threads using Analyze Wait Chain in Resource Monitor and review Event ID 1000/1002 crash records in the Event Viewer Application log.
Analyzing the wait chain in Resource Monitor isolates locked or waiting process threads when an application freezes, while reviewing Event ID 1000 (Application Error) and Event ID 1002 (Application Hang) in Event Viewer provides concrete logs regarding faulting modules and crash codes.

Adım Adım Çözüm

1
Inspect active process dependencies during the hang.
Opening Resource Monitor and selecting 'Analyze Wait Chain' on the unresponsive process reveals if it is waiting on another locked thread or secondary executable.
Process hangs often occur when one thread is blocked by a non-responsive dependency.
2
Check system event logs for failure details.
Reviewing Event Viewer under Windows Logs > Application yields Event ID 1000 (Application Error) or 1002 (Application Hang) logs.
Event log entries provide explicit faulting module filenames, exception codes, and timestamps essential for root cause isolation.

Anahtar Kavram

Application Crash and Hang Diagnostics
Tahmini Süre:1m 30s
Soru 1590Soru →

Match each Windows administration task or system configuration requirement on the left with its corresponding Control Panel utility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Manage offline files and set up synchronization schedules for network shared folders
Add a multi-function office printer and adjust its default paper tray preferences
Enable optional Windows components such as Internet Information Services (IIS) or Hyper-V
Modify the computer host name and adjust performance settings for virtual memory pagefile size

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Offline files and network folder synchronization match Sync Center; adding printers and setting default paper tray preferences match Devices and Printers; enabling optional OS components like IIS or Hyper-V matches Programs and Features; modifying the host name and adjusting virtual memory pagefile size match System.
Each administrative task aligns directly with its primary Windows Control Panel utility: Sync Center manages offline network files and schedules; Devices and Printers handles peripheral configuration and default printer properties; Programs and Features allows technicians to enable or disable optional OS components like IIS or Hyper-V; System provides access to basic system specifications, computer identity, and virtual memory (paging file) configuration.

Adım Adım Çözüm

1
Identify the tool for managing offline network folders and sync schedules.
Determine that Sync Center handles offline files, synchronization status, and conflict resolution.
Windows routes file caching and sync rules through the Sync Center applet.
2
Identify the tool for managing user-facing printer settings and default properties.
Determine that Devices and Printers manages installed peripherals, printing defaults, and print queues.
Higher-level device preferences and default selections are configured in Devices and Printers.
3
Identify the location for turning Windows features on or off.
Determine that Programs and Features houses the option to enable optional components such as IIS or Hyper-V.
Built-in OS features and optional roles are managed from within Programs and Features.
4
Identify the applet controlling system host identity and performance options.
Determine that the System utility provides access to System Properties for computer renaming and virtual memory paging configuration.
Host name, domain membership, and advanced performance settings (such as pagefile sizing) reside under System settings.

Anahtar Kavram

Windows Control Panel Utilities Functionality
Tahmini Süre:1m 30s
Soru 1591Soru →

A network administrator is deploying a new wireless network for corporate laptops at a financial services firm. Corporate policy requires that every employee authenticate individually using their corporate domain credentials and that the network use the highest available encryption standard without relying on a shared passphrase. Which TWO of the following configurations should the administrator implement?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: WPA3-Enterprise security mode; 802.1X authentication backed by a RADIUS server

Cevap

WPA3-Enterprise security mode and 802.1X authentication backed by a RADIUS server
Selecting WPA3-Enterprise security mode alongside 802.1X authentication backed by a RADIUS server fulfills all corporate requirements. WPA3-Enterprise provides modern enterprise-class encryption, while 802.1X with RADIUS passes authentication requests to centralized identity stores like Active Directory so each user logs in with unique individual credentials.

Adım Adım Çözüm

1
Analyze the user authentication requirement
Individual user authentication using network domain credentials requires an enterprise authentication framework (802.1X) integrated with an authentication server such as RADIUS.
Personal wireless modes rely on a single shared passphrase across all clients, failing the requirement for unique individual user logins.
2
Determine the required wireless security standard
The highest modern encryption standard that supports 802.1X enterprise authentication without pre-shared keys is WPA3-Enterprise.
WPA3-Enterprise utilizes robust encryption suites and enforces centralized 802.1X authentication.

Anahtar Kavram

WPA3-Enterprise and 802.1X/RADIUS authentication for corporate wireless networks
Soru 1592Soru →

A technician is troubleshooting a mobile device experiencing severe thermal throttling and rapid battery drain caused by a misbehaving geolocation-tracking module within a third-party application. Arrange the following troubleshooting procedures in the correct sequence from least invasive to most invasive according to standard mobile operating system maintenance methodology.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of troubleshooting steps from least invasive to most invasive is: 1) Force close the application, 2) Soft restart the mobile device, 3) Revoke location access and background refresh permissions, 4) Uninstall and reinstall the application, 5) Perform a full factory reset.
CompTIA A+ troubleshooting standard dictates proceeding from the least invasive action to the most invasive action. Force stopping the application operates purely in active volatile memory. A soft device restart clears broader system memory leaks. Adjusting specific app permissions alters persistent feature settings while keeping user data intact. Reinstalling the application clears application data and requires re-setup. Finally, a full factory reset wipes all operating system data and represents the ultimate escalation step.

Adım Adım Çözüm

1
Terminate volatile memory process
Force closing the application immediately halts the CPU/GPS resource drain without altering any device settings.
Troubleshooting should always start by stopping the running process directly in RAM.
2
Reboot the mobile platform
A soft reset clears system-wide runtime caches and unmanaged background threads.
Restarting the hardware addresses potential OS-level memory leaks without destroying persistent user data.
3
Adjust OS-level application permissions
Disabling background refresh and location services stops the application from initiating high-power hardware states.
Configuration adjustments reconfigure feature access to resolve performance drain while retaining user data.
4
Rebuild application installation
Deleting and reinstalling the package eliminates corrupted local storage files and corrupted binary packages.
Reinstallation forces the user to log in again and reconfigure preferences, making it more disruptive than permission adjustments.
5
Execute OS factory wipe
Factory resetting clears all storage partitions, restoring the OS image to defaults.
This is the final escalation step used only when all application-level and configuration-level remedies fail.

Anahtar Kavram

Least-Invasive-First Mobile OS Troubleshooting Methodology
Soru 1593Soru →

A helpdesk technician receives an incoming call from a remote user experiencing an issue with their email client. Place the technician's professional communication and user interaction steps in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order is: 1) Greet the user and introduce yourself, 2) Actively listen to the issue without interrupting, 3) Explain the fix and ask for remote session permission, 4) Verify complete resolution with the user and document the ticket.
The standard CompTIA workflow for professional communication begins with establishing greeting and rapport, actively listening to gather details without interruption, communicating proposed actions and securing consent, and concluding with user verification of the fix followed by ticket documentation.

Adım Adım Çözüm

1
Initiate the interaction professionally
Establishes technician identity and positive customer rapport
CompTIA standards dictate introducing yourself and your organization immediately upon answering a support call.
2
Gather issue details via active listening
Captures complete technical context without making the user feel dismissed
Allowing the user to finish explaining their situation prevents misunderstandings and demonstrates professional respect.
3
Set expectations and obtain user consent
Ensures user awareness and privacy compliance before taking remote control
Technicians must avoid taking control of a workstation without explaining the procedure and securing explicit permission.
4
Confirm resolution and complete administrative documentation
Ensures full customer satisfaction and accurate ticketing history
A ticket should only be closed after verifying full functionality directly with the user and logging the technical resolution.

Anahtar Kavram

Professional Customer Interaction Workflow
Soru 1594Soru →

A Windows 11 workstation fails to start critical operating system services following a corrupted third-party driver installation during a forced reboot. When booting into the Windows Recovery Environment (WinRE), running `sfc /scannow` fails with a message indicating that Windows Resource Protection found corrupt files but was unable to repair them due to damage within the local Windows Component Store (WinSxS). An offline Windows installation ISO has been mounted to drive letter `E:`. Which TWO of the following command-line operations must the technician execute to repair the component store and successfully recover the system files?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute DISM specifying `/Image:C:\` and `/Cleanup-Image /RestoreHealth` along with `/Source:E:\sources\install.wim` to repair the WinSxS store from the mounted media.; Execute `sfc /scannow` with `/offbootdir=C:\` and `/offwindir=C:\Windows` after the DISM restoration completes to replace corrupt system files.

Cevap

The technician must execute DISM pointing to the offline Windows installation path while supplying an explicit installation media source file to restore the WinSxS component store, and subsequently run the SFC utility configured with offline boot and Windows directory parameters.
When repairing corrupted Windows system files from WinRE where the local component store (WinSxS) is damaged, DISM must first be executed using the `/Image` path to target the offline system drive and the `/Source` parameter pointing to a known good `install.wim` image. Following a successful DISM restoration of the component store, `sfc /scannow` must be targeted at the offline installation using `/offbootdir` and `/offwindir` parameters to successfully scan and repair corrupted protected system files.

Adım Adım Çözüm

1
Identify the dependency between DISM and SFC when repairing corrupted operating system files.
Recognize that System File Checker (SFC) relies on a healthy WinSxS component store; if WinSxS is corrupted, DISM must be run first.
SFC uses the local WinSxS store as its source for replacing corrupted protected files. If the store itself is damaged, SFC repairs will fail until DISM fixes the store.
2
Configure the DISM repair command for an offline image inside WinRE.
Run DISM with the `/Image:C:\` parameter and set `/Source:E:\sources\install.wim` combined with `/Cleanup-Image /RestoreHealth`.
Because WinRE is active, using `/online` targets WinRE instead of the target system. The command requires explicit target and repair source paths.
3
Execute System File Checker against the offline system drive post-DISM repair.
Run `sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows`.
Now that the WinSxS store is healthy, SFC can extract clean system binaries and repair corrupt files on the offline volume.

Anahtar Kavram

Offline System File and Component Store Repair Sequence
Soru 1595Soru →

A technician is troubleshooting a Windows 11 workstation where a critical desktop publishing application intermittently freezes during high-resolution graphics export. The technician needs to isolate the specific thread deadlock causing the freeze, restore application responsiveness without terminating the main application process if possible, and gather historical crash logs for post-incident reporting. In what order should the technician execute these troubleshooting steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The technician should first locate the application process in Task Manager's Details tab, use Analyze Wait Chain to pinpoint the blocking thread, end the blocking thread to restore responsiveness, and finally inspect Event Viewer Application logs for Event ID 1002 entries.
The correct troubleshooting sequence begins by targeting the process in Task Manager's Details tab, running Analyze Wait Chain to identify the specific thread lock, terminating the blocking child thread to safely unfreeze the application, and lastly querying Event Viewer (Event ID 1002) for root-cause diagnostic information.

Adım Adım Çözüm

1
Navigate to Task Manager Details tab
Identify the target application executable name and associated PID.
Process management utilities like Analyze Wait Chain are accessible from the Details tab.
2
Execute Analyze Wait Chain
Examine the dependency tree to find which thread or secondary process is holding a resource lock.
Analyze Wait Chain pinpoints thread contention causing the application to stop responding.
3
End the blocking child process
Unfreeze the main application window without killing the primary process tree.
Selective termination releases locked memory handles while preserving unsaved work in the parent process.
4
Review Event Viewer Application logs
Filter for Event ID 1002 (Application Hang) to capture faulting DLLs, timestamps, and error codes.
Log analysis provides empirical data for persistent bug resolution or software updates.

Anahtar Kavram

Isolating Windows application hangs using Task Manager Analyze Wait Chain and Event Viewer logging
Soru 1596Soru →

A Windows 11 workstation experienced an improper shutdown during a power outage and now frequently crashes with Stop errors referencing system file corruption. A technician opens an elevated Command Prompt and executes `sfc /scannow`, but the process halts with the error: "Windows Resource Protection found corrupt files but was unable to fix some of them." The technician suspects that the local Windows Component Store (WinSxS) used for file repair is itself corrupted. Which of the following command-line procedures should the technician execute NEXT to successfully restore system file integrity?

Cevabı ve açıklamayı göster

Cevap: Execute `dism /online /cleanup-image /restorehealth` to repair the local Component Store, and then re-run `sfc /scannow`.

Cevap

The technician should execute `dism /online /cleanup-image /restorehealth` to repair the Windows Component Store, followed by re-running `sfc /scannow`.
When System File Checker (`sfc /scannow`) reports that it found corrupt files but could not repair them, it means the local source repository (the WinSxS folder) lacks healthy replacement copies. Running `dism /online /cleanup-image /restorehealth` repairs the Windows Component Store image using Windows Update. Once DISM finishes repairing the store, running `sfc /scannow` again will successfully restore damaged protected operating system files.

Adım Adım Çözüm

1
Identify the cause of the System File Checker failure
The message 'unable to fix some of them' indicates that SFC's source repository (the WinSxS component store) is damaged or missing required clean files.
SFC relies on the local Component Store to replace corrupted OS binaries.
2
Repair the Component Store using DISM
Running `dism /online /cleanup-image /restorehealth` downloads and repairs damaged payload files in the WinSxS store from Windows Update.
DISM must restore health to the component payload store before SFC can function properly.
3
Re-run System File Checker
Executing `sfc /scannow` now finds the corrupted system files and successfully replaces them using the newly restored Component Store files.
SFC can now successfully retrieve uncorrupted files.

Anahtar Kavram

DISM and SFC Repair Workflow Sequence
Soru 1597Soru →

Match each remote access technology or tool with its characteristic operating requirement, protocol, or default port configuration.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Remote Desktop Host (RDP)
Microsoft Remote Assistance (MSRA)
Secure Shell (SSH)
Virtual Network Computing (VNC)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Remote Desktop Host (RDP) matches the requirement for Windows Pro/Enterprise/Education on TCP port 3389. Microsoft Remote Assistance (MSRA) matches helper invitation sessions across all Windows editions. Secure Shell (SSH) matches encrypted command-line access on TCP port 22. Virtual Network Computing (VNC) matches RFB protocol usage on TCP port 5900.
Each remote access technology correctly maps to its core operational parameter: RDP host capabilities require Windows Pro/Enterprise/Education on TCP 3389; MSRA enables interactive helper sessions via invitation tokens across all editions; SSH supplies encrypted terminal administration over TCP 22; and VNC delivers cross-platform screen sharing via the RFB protocol over TCP 5900.

Adım Adım Çözüm

1
Identify operating system edition restrictions for incoming GUI remote desktop sessions.
Confirm that Windows Home editions lack the RDP host listener component, requiring Pro, Enterprise, or Education editions on TCP port 3389.
CompTIA A+ objectives specifically contrast RDP host availability between Windows client editions.
2
Differentiate MSRA functionality from standard RDP session behaviors.
Determine that MSRA allows assisted remote support sessions across all Windows editions via user invitation tokens.
Technicians use MSRA to assist remote users on Home edition machines where RDP host mode is disabled.
3
Associate command-line and cross-platform tools with their default network ports and protocols.
Link SSH to encrypted CLI administration on TCP port 22, and VNC to RFB protocol administration on TCP port 5900.
Network firewalls and routers must be configured with correct default listening ports for SSH and VNC connectivity.

Anahtar Kavram

Remote Access Technologies, Port Assignments, and Windows Edition Capabilities
Soru 1598Soru →

An IT support technician arrives at a user's workstation to resolve a local printing issue. The user is visibly frustrated, complaining that recent system slowness has caused severe project delays, and begins venting about past IT support experiences. Which of the following is the most professional response for the technician to take first?

Cevabı ve açıklamayı göster

Cevap: Actively listen without interrupting, clarify the user's concerns, and acknowledge their frustration while maintaining a professional demeanor.

Cevap

Actively listen without interrupting, clarify the user's concerns, and acknowledge their frustration while maintaining a professional demeanor.
The correct response prioritizes active listening, emotional de-escalation, and clear communication. When interacting with a frustrated user, a technician must first allow the user to express their concerns fully without interruption, validate their situation professionally, and avoid arguing or shifting blame.

Adım Adım Çözüm

1
De-escalate the user's frustration through active listening
The user feels heard and respected, reducing tension in the support interaction.
Before addressing technical issues, establishing rapport and professional empathy is required to build trust.
2
Clarify and document the reported symptoms
Accurate information gathering regarding both the printer and performance issues.
Ensures all aspects of the user's operational disruption are understood before diagnostic steps begin.

Anahtar Kavram

Professional Interpersonal Communication and Active Listening
Soru 1599Soru →

A smartphone user reports that a specific line-of-business mobile application frequently freezes and crashes immediately upon launch. Following standard mobile troubleshooting methodology, which of the following actions should a technician perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Force stop the application and clear the application cache

Cevap

Force stop the application and clear the application cache.
Force stopping the application and clearing its cached data directly addresses corrupted temporary files or hanging process states, which are the most common causes of single-app crashes. This represents the least invasive initial step in mobile OS troubleshooting.

Adım Adım Çözüm

1
Identify the troubleshooting scope
The issue is limited to a single application crashing on a mobile device.
Isolating the issue ensures targeted troubleshooting rather than system-wide changes.
2
Apply the least invasive troubleshooting method
Force stopping the application terminates stuck background processes, and clearing the app cache removes corrupted temporary files without deleting user data.
Standard CompTIA troubleshooting methodology requires performing least invasive actions before resorting to app reinstallation or device resets.

Anahtar Kavram

Least Invasive Mobile App Troubleshooting Methodology
Soru 1600Soru →

A help desk technician receives a ticket reporting an unrecognized suspicious process continuously executing on an executive assistant's workstation. According to standard enterprise IT service management and ticketing system workflows, in what order should the technician execute the following ticket lifecycle and documentation steps from initial receipt to final resolution?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the ticketing workflow is: (1) Categorize the ticket as a high-priority security incident and document initial symptoms, (2) Reassign and escalate the ticket to the Cybersecurity Operations team with attached logs, (3) Log specific remediation steps and diagnostic actions in work notes, (4) Obtain explicit end-user confirmation that normal operation is restored, and (5) Record final root cause analysis code, update internal knowledge base, and set ticket status to Closed.
The standard ITSM incident lifecycle dictates that incoming issues are first triaged and categorized to establish priority and scope. Once identified as an out-of-scope security incident, the ticket is formally escalated with initial findings. Following successful technical remediation by specialized staff, all resolution actions are logged. Explicit end-user verification must be gathered next to ensure system stability. Finally, administrative closure—including root cause coding and knowledge base updates—completes the process.

Adım Adım Çözüm

1
Perform ticket triage, initial documentation, and impact/urgency categorization.
The ticket is properly classified in the IT Service Management (ITSM) system with an accurate severity rating.
Accurate categorization determines routing, escalation rules, and SLA tracking.
2
Escalate the incident to specialized Tier 2 / Security Operations with diagnostic notes.
The ticket is assigned to qualified personnel with necessary investigative context.
Security incidents exceeding Tier 1 operational scope must be formally transferred following escalation protocols.
3
Execute technical remediation and log detailed actions taken.
The system threat is neutralized, and a detailed audit trail of changes is maintained in the ticket history.
Detailed resolution logs are mandatory for compliance, audit trails, and technical history.
4
Verify complete functionality with the affected end user.
Confirmation is received that the user can perform work duties without issue.
Tickets must never be closed unilaterally without validating that the user's workflow is restored.
5
Complete root cause documentation, knowledge base entries, and formal ticket closure.
The ticket lifecycle completes, and institutional knowledge is updated for future reference.
Formal closure and knowledge management prevent recurring incidents and document historical fixes.

Anahtar Kavram

IT service management ticket lifecycle stages (Intake/Triage -> Escalation -> Remediation/Logging -> User Verification -> Final Closure/KB Update).
Tahmini Süre:2m 30s
ÖncekiSayfa 80 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin