Tüm alıştırma soruları

3551 soru

Soru 1781Soru

An IT security administrator notices that several enterprise mobile devices are failing to authenticate against the corporate 802.1X wireless network and displaying untrusted server certificate warnings when browsing internal HTTPS portals. Further inspection reveals an unauthorized configuration profile was secretly installed alongside a side-loaded utility application. Which TWO of the following troubleshooting and remediation steps should the administrator take to resolve these security and connectivity issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Remove the malicious configuration profile from the mobile device settings.; Re-enroll the affected devices into the enterprise MDM server to push verified security certificates.

Cevap

The administrator must remove the malicious configuration profile from the mobile device settings and re-enroll the affected devices into the enterprise MDM server.
Deleting the unauthorized configuration profile removes untrusted root certificates and proxy settings causing browser warnings and authentication failures. Re-enrolling the device in MDM automatically restores corporate 802.1X wireless profiles and legitimate security certificates.

Adım Adım Çözüm

1
Locate and inspect installed profiles in device settings.
Identify the rogue configuration profile containing untrusted root certificates and proxy configurations.
Unauthorized profiles alter mobile OS trust stores and network routing parameters.
2
Delete the malicious configuration profile.
Purge untrusted certificates and rogue network redirects from the device.
Removing the profile eliminates active man-in-the-middle trust violations and unauthorized traffic redirection.
3
Re-enroll the device in enterprise Mobile Device Management (MDM).
Deploy compliant network profiles, valid 802.1X credentials, and official corporate CA certificates.
MDM re-enrollment restores verified Wi-Fi authentication configurations necessary for secure 802.1X enterprise connection.

Anahtar Kavram

Remediating Mobile OS Security Profiles and 802.1X Wireless Authentication
Soru 1782Soru

A help desk technician receives a phone call from an end user whose laptop suffered an unexpected system crash in the middle of a high-stakes presentation to external stakeholders. The user is visibly agitated, speaking in an elevated tone, and demanding an instant fix while blaming the IT department for recent system updates. Which of the following is the most appropriate initial response for the technician to make?

Cevabı ve açıklamayı göster

Cevap: Actively listen to the user without interrupting, acknowledge their frustration empathetically, and gather details about the error.

Cevap

Actively listen to the user without interrupting, acknowledge their frustration empathetically, and gather details about the error.
When handling an upset or frustrated user, CompTIA guidelines dictate that technicians should maintain a professional posture by actively listening without interruption, acknowledging the user's feelings, and projecting a supportive, calm demeanor.

Adım Adım Çözüm

1
Maintain self-control and practice active listening
Allows the frustrated user to vent their concern fully without interruption.
De-escalating the user's emotion is mandatory before technical problem-solving can occur effectively.
2
Acknowledge the situation with empathy and positive tone
Builds rapport and reassures the user that IT understands the urgency of the problem.
Demonstrating empathy prevents defensive arguments and establishes a collaborative environment.
3
Ask clarifying, targeted questions
Collects pertinent technical data to begin troubleshooting.
Obtaining technical context relies on clear communication once the user feels heard.

Anahtar Kavram

De-escalation and Active Listening Techniques
Soru 1783Soru

An IT support technician receives a ticket reporting that a graphic designer's Windows workstation experiences frequent application crashes accompanied by missing DLL error messages. The technician runs the System File Checker utility (`sfc /scannow`), but the command completes with an error stating that corrupt files were found but could not be repaired because the local payload store is damaged. The workstation has an active connection to the Internet. Which command should the technician run next to repair the component store?

Cevabı ve açıklamayı göster

Cevap: dism /online /cleanup-image /restorehealth

Cevap

dism /online /cleanup-image /restorehealth
Executing `dism /online /cleanup-image /restorehealth` repairs the corrupted Windows Component Store (WinSxS payload repository) by fetching known-good replacement files from Windows Update. Once DISM restores the health of the store, running `sfc /scannow` will successfully replace damaged operating system files.

Adım Adım Çözüm

1
Analyze the error output from the initial repair attempt.
Identified that `sfc /scannow` failed because the local Component Store (WinSxS) source payload files are corrupt.
System File Checker relies on healthy source files inside the Component Store to replace corrupted system files.
2
Select the appropriate Deployment Image Servicing and Management (DISM) command.
Execute `dism /online /cleanup-image /restorehealth` using an active internet connection.
The `/restorehealth` switch scans the Component Store for corruption and uses Windows Update to download clean replacement payloads.
3
Re-run the System File Checker utility.
Execute `sfc /scannow` after DISM successfully completes.
Now that the Component Store is healthy, SFC can access undamaged payload files to complete operating system file repairs.

Anahtar Kavram

Repairing the Windows Component Store with DISM before System File Checker
Tahmini Süre:1m 30s
Soru 1784Soru

During an equipment refresh, an IT support specialist replaces a failing desktop computer for an employee in the accounting department. The specialist successfully transfers all user data, verifies that financial applications load properly, and obtains user sign-off. Which of the following documentation procedures must the specialist complete within the ticketing and inventory workflow prior to marking the ticket as resolved?

Cevabı ve açıklamayı göster

Cevap: Update the asset management database to link the new system tag to the user and log the retired computer's disposition state.

Cevap

Update the asset management database to link the new system tag to the user and log the retired computer's disposition state.
Updating the asset management system with new serial numbers/tags and recording the decommissioned status of replaced hardware ensures that inventory tracking remains accurate and aligned with organizational documentation standards.

Adım Adım Çözüm

1
Identify necessary documentation actions during hardware replacement workflows.
Recognize that replacing a system impacts both the active ticket resolution log and the organization's Configuration Management Database (CMDB) / asset management inventory.
Accurate IT operations depend on keeping hardware records aligned with user assignments.
2
Update asset tracking records in conjunction with ticket closure.
Assign the replacement device's serial number/asset tag to the user and change the old device's status to retired/decommissioned.
Failing to update asset IDs leads to inventory discrepancies, compliance failures, and lost equipment.

Anahtar Kavram

Documentation and Ticketing System Workflows: Asset Management Integration
Soru 1785Soru

An enterprise IT technician arrives at a scene where a running server is suspected of being compromised during an active data exfiltration incident. Arrange the technician's digital evidence preservation steps in the correct sequence according to standard forensic order of volatility and incident response procedures.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the order of volatility: capture system RAM first, record active network and process states second, create a bit-stream image of non-volatile storage drives third, and complete the chain of custody log fourth.
Digital evidence preservation strictly follows the order of volatility to prevent evidence degradation. The sequence starts with capturing system RAM (highest volatility), followed by recording active processes and network connections, then imaging non-volatile hard drives using a hardware write-blocker, and concluding with completing the chain of custody form to ensure legal defensibility.

Adım Adım Çözüm

1
Preserve the most volatile evidence first.
System RAM and live memory contents are captured to write-protected external storage.
RAM contents are easily altered or destroyed by power loss or routine system operations.
2
Collect active system state information.
Network connections, open ports, and active process tables are logged.
These states change rapidly as network traffic flows and processes terminate.
3
Perform bit-stream imaging of persistent storage.
Secondary storage drives are imaged using a hardware write-blocker.
Non-volatile storage retains data permanently without power and can be safely imaged after volatile data is secured.
4
Finalize legal evidence tracking documentation.
The chain of custody log is filled out with timestamps, identifiers, and handler signatures.
Detailed documentation maintains evidence integrity and admissibility in legal proceedings.

Anahtar Kavram

Order of Volatility and Incident Response Evidence Preservation
Soru 1786Soru

A helpdesk technician is preparing a change request to deploy a critical operating system patch across company workstations. The technician needs to document the step-by-step procedure for returning the workstations to their original functional state if the patch causes unforeseen application instability. Which change management component is the technician preparing?

Cevabı ve açıklamayı göster

Cevap: Rollback plan

Cevap

The correct answer is the rollback plan.
A rollback plan details the precise technical steps required to reverse a change and restore systems to their baseline configuration if an update or deployment fails.

Adım Adım Çözüm

1
Identify the primary purpose of the procedure described in the scenario.
The technician is creating instructions to undo an operating system patch deployment and return workstations to their original operational state.
Analyzing the specific goal of the documentation helps map it directly to formal change management terminology.
2
Correlate the requirement with standard change management components.
A rollback plan (or backout plan) specifically provides the step-by-step instructions to revert changes upon deployment failure.
Standard operational procedures mandate a rollback plan to ensure service restoration and minimize downtime if an update causes issues.

Anahtar Kavram

Rollback Planning in Change Management
Soru 1787Soru

Match each data privacy framework or data classification term on the left with its correct regulatory definition or operational scope on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

PCI-DSS
PHI
PII
GDPR

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

PCI-DSS matches with credit card processing standards; PHI matches with healthcare information; PII matches with personal identity data; GDPR matches with EU data subject rights.
Each data privacy standard or term matches its exact definition: PCI-DSS governs credit card security, PHI governs medical records, PII governs personal identifying information, and GDPR governs EU individual data rights.

Adım Adım Çözüm

1
Identify payment processing security standards.
Connect PCI-DSS to credit card data protection.
PCI-DSS stands for Payment Card Industry Data Security Standard.
2
Identify medical data classification terms.
Connect PHI to health information stored by covered entities.
PHI (Protected Health Information) is defined under healthcare privacy regulations.
3
Classify general identity information terms.
Connect PII to details used to distinguish an individual.
PII (Personally Identifiable Information) refers to individual identity markers.
4
Identify regional compliance laws regarding personal privacy.
Connect GDPR to EU citizen data control and erasure rights.
GDPR (General Data Protection Regulation) establishes data rights across the EU.

Anahtar Kavram

Data Privacy Standards and Regulatory Scopes
Soru 1788Soru

An IT technician secures a suspicious USB flash drive discovered plugged into a financial department computer during a security breach. After placing the flash drive in an anti-static evidence bag, which log entry detail is required on the chain of custody documentation to maintain evidence integrity?

Cevabı ve açıklamayı göster

Cevap: The date, timestamp, and full name with signature of the individual releasing and receiving the evidence

Cevap

The chain of custody log must record the date, timestamp, and signatures of both the person handing over and the person receiving the evidence.
Chain of custody forms preserve legal admissibility by recording a continuous, unbroken history of who held the evidence, when it changed hands, and where it was stored. Accurate timestamps alongside signatures of both the releasing and receiving parties ensure accountability.

Adım Adım Çözüm

1
Identify the purpose of chain of custody documentation in digital forensics.
Chain of custody establishes a verifiable record showing who possessed the evidence at all times.
This prevents claims of evidence tampering or unauthorized access when presented in court or internal legal proceedings.
2
Determine the required fields on a chain of custody log.
Essential fields include item description, serial number, date/time of transfer, location, and the printed names and signatures of both the releasing and receiving handlers.
Every transfer of physical possession must be logged without gaps.

Anahtar Kavram

Chain of Custody Documentation Requirements
Soru 1789Soru

An environmental compliance officer uses a custom data-logging application on an Android tablet to submit real-time field observations. During a site survey, the officer reports that the application consistently freezes and stops responding whenever a data upload is initiated, while all other applications and network functions on the tablet work properly. Which of the following actions should an IT technician take FIRST to resolve this issue using the least invasive troubleshooting approach?

Cevabı ve açıklamayı göster

Cevap: Force stop the data-logging application and clear its application cache.

Cevap

Force stop the data-logging application and clear its application cache.
When troubleshooting isolated mobile app freezing or unresponsiveness on an Android device, technicians should follow the least invasive methodology first. Force stopping the hung application and clearing its cached memory resolves temporary state corruption and releases locked resources without wiping user data or device settings.

Adım Adım Çözüm

1
Isolate the scope of the problem.
Since only the specific data-logging app is failing while all other system functions work normally, the issue is localized to that application.
Troubleshooting should target the isolated application rather than system-wide configurations.
2
Apply the least invasive troubleshooting method.
Force stopping the application terminates hung background processes, and clearing its cache removes temporary files that may be corrupted.
This resolves app freezing without removing essential application data, user account credentials, or resetting the device.

Anahtar Kavram

Least-invasive mobile application troubleshooting methodology
Soru 1790Soru

A technician needs to use a chemical solvent to clean internal components during workstation maintenance. Which document should the technician consult to find the required Personal Protective Equipment (PPE), health hazards, and safe handling procedures for this chemical?

Cevabı ve açıklamayı göster

Cevap: The Safety Data Sheet (SDS) provided by the chemical manufacturer

Cevap

The Safety Data Sheet (SDS) provided by the chemical manufacturer
The Safety Data Sheet (SDS) is official documentation provided by chemical manufacturers. It details physical and health hazards, exposure controls, required Personal Protective Equipment (PPE), handling and storage protocols, and emergency response procedures.

Adım Adım Çözüm

1
Identify the safety information required for handling chemical solvents.
The technician needs details regarding health hazards, safe handling, proper ventilation, and required PPE.
Chemical solvents can cause skin irritation or respiratory harm if handled without appropriate safety precautions.
2
Select the standard reference document designated for hazardous material safety information.
Consult the chemical's Safety Data Sheet (SDS).
Safety regulations mandate that chemical manufacturers provide an SDS containing standardized safety and handling instructions for hazardous materials.

Anahtar Kavram

Safety Data Sheets (SDS) and Hazardous Material Handling
Tahmini Süre:45s
Soru 1791Soru

A desktop support technician is troubleshooting an automated network drive mapping script intended to run during user logon on Windows client workstations. The script references environment variables using the `%USERNAME%` syntax, utilizes `IF NOT EXIST` conditional checks for folder paths, and executes command-line network utility commands. Double-clicking the file results in a Windows Script Host runtime error indicating invalid syntax. Which of the following actions will resolve the execution failure while preserving the current script code?

Cevabı ve açıklamayı göster

Cevap: Change the script file extension from `.vbs` to `.bat` so it runs natively within the Windows Command Prompt interpreter.

Cevap

Change the script file extension from `.vbs` to `.bat` so it runs natively within the Windows Command Prompt interpreter.
The script code provided uses standard Windows Batch syntax (`%USERNAME%` for environment variables, `IF NOT EXIST` for conditionals, and command-line utility calls). Saving a batch file with a `.vbs` extension forces Windows to run it through Windows Script Host, which generates a syntax error. Renaming the extension to `.bat` ensures `cmd.exe` interprets the script natively.

Adım Adım Çözüm

1
Analyze the syntax constructs presented in the problem statement.
The script uses `%USERNAME%` for environment variable expansion, `IF NOT EXIST` for file/directory conditional branching, and command-line commands.
These constructs belong exclusively to Windows Batch (`.bat` / `.cmd`) scripting.
2
Identify the cause of the runtime error.
The file was saved with a `.vbs` extension, causing Windows to invoke Windows Script Host (WSH/`wscript.exe`), which expects VBScript syntax.
WSH fails to parse Batch control constructs and variable syntax, throwing a syntax error.
3
Determine the corrective action to maintain existing script code.
Renaming the file extension to `.bat` directs the operating system to use `cmd.exe` as the interpreter.
This allows all existing Batch constructs to execute without requiring syntax modifications.

Anahtar Kavram

Basic Scripting Languages and File Extensions
Soru 1792Soru

A field support technician is performing hardware decommissioning on several mobile workstations. While disassembling a unit, the technician observes that the lithium-ion battery pack has severely swollen, causing the device chassis to crack and exposing the battery housing. Which of the following represents the safest immediate procedure for handling and disposing of this compromised battery?

Cevabı ve açıklamayı göster

Cevap: Place the battery into a cool, non-conductive, fire-rated container filled with an inert absorbent like sand, and route it to a certified hazardous waste disposal facility.

Cevap

The correct safety procedure is to place the swollen lithium-ion battery into a cool, non-conductive, fire-rated container surrounded by an inert material such as sand or cell-container filler, and arrange for disposal through a certified hazardous waste recycling facility.
Swollen lithium-ion batteries contain built-up gas due to internal cell damage or overcharging, placing them at high risk of thermal runaway. Placing the damaged battery in a fire-rated container filled with an inert absorbent material insulates it against thermal impact and contains potential flames. Sending the battery to a certified hazardous waste recycling facility fulfills environmental safety guidelines.

Adım Adım Çözüm

1
Identify the hazard severity of the swollen lithium-ion battery.
Recognize that physical swelling indicates internal gas buildup, cell degradation, and high susceptibility to thermal runaway.
Deformed battery structures are volatile and must be handled with extreme care to prevent fire or explosion.
2
Apply proper physical containment and isolation measures.
Isolate the component in a non-combustible, non-conductive container lined with thermal insulation material (e.g., sand or vermiculite).
If thermal runaway occurs, containment prevents flames and toxic fumes from igniting surrounding workspace materials.
3
Follow environmental compliance regulations for hazardous chemical disposal.
Transport the battery to a designated hazardous waste processing site rather than standard trash or regular e-waste bins.
CompTIA standards and environmental safety regulations mandate specialized processing for dangerous chemical waste.

Anahtar Kavram

Handling and Disposal of Swollen Lithium-Ion Batteries
Soru 1793Soru

An IT security specialist is analyzing a corporate workstation where web requests across all installed browsers (Google Chrome, Microsoft Edge, and Mozilla Firefox) are consistently redirected to an unauthorized external portal. Command-line `nslookup` queries resolve domain names to correct IP addresses, but browser network traffic is being forcibly routed through a rogue local proxy address. Additionally, an unwanted browser toolbar automatically reinstalling itself upon system reboot is traced to a compromised group policy registry key. Which of the following remediation actions should the specialist take to resolve these browser security issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Inspect and remove unauthorized proxy server configurations within the operating system network settings.; Delete unauthorized browser policy registry keys and extension force-install policies from the local machine management hives.

Cevap

The specialist should remove unauthorized OS network proxy configurations and delete malicious browser policy registry keys to stop proxy redirection and persistent extension re-installation.
The correct remediation actions require addressing both the network redirection vector and the persistence mechanism. System proxy settings intercept and route all browser traffic to rogue servers even when local DNS resolution is intact. Removing these unauthorized proxy settings restores clean traffic flow. Additionally, rogue browser extensions managed via Windows Registry policies (such as policy forced-install lists) will continuously reinstall toolbars until the malicious policy keys are deleted.

Adım Adım Çözüm

1
Identify the underlying redirection and persistence vectors.
Discovered system proxy settings routing browser traffic to a rogue server and policy registry keys maintaining malicious extensions.
Since DNS lookups resolve correctly via command line but browser traffic is hijacked, system proxy settings and browser enforcement policies are the primary vectors.
2
Remove the rogue proxy server settings.
Restored direct OS network routing for HTTP and HTTPS browser traffic.
System proxy configurations force all installed browsers to send traffic to the designated proxy server regardless of DNS resolution.
3
Clean up compromised policy registry keys and force-installed extensions.
Prevented malicious toolbars and extensions from reinstalling automatically.
Group Policy and registry ExtensionInstallForcelist keys re-download and re-enable extensions even after manual browser removal.

Anahtar Kavram

Browser Redirect and Remediation Techniques
Soru 1794Soru

A senior systems administrator is preparing a change request for an upcoming upgrade to the organization's central identity management and single sign-on (SSO) infrastructure. The administrator has documented the purpose of the change, defined the scope of affected directory services, conducted a risk assessment, and scheduled the maintenance window. Which of the following critical components must still be included in the change request documentation before it is submitted to the Change Advisory Board (CAB) for review and authorization?

Cevabı ve açıklamayı göster

Cevap: A documented rollback plan detailing step-by-step procedures to revert the infrastructure to its prior state if the upgrade encounters critical failures

Cevap

The change request documentation must include a documented rollback plan detailing step-by-step procedures to revert the infrastructure to its prior state if the upgrade fails.
In enterprise IT operational procedures, a formal change request submitted for CAB approval must include a comprehensive rollback plan alongside purpose, scope, risk analysis, and notification schedules. The rollback plan guarantees a clear remediation path to restore services if the implementation fails.

Adım Adım Çözüm

1
Analyze the change management lifecycle phase in the scenario.
The administrator is preparing the change proposal before submitting it to the Change Advisory Board (CAB).
The CAB requires a complete change proposal containing purpose, scope, risk analysis, implementation plan, rollback plan, and notification plan prior to authorization.
2
Identify the missing essential documentation component.
The administrator has defined the purpose, scope, risk assessment, and schedule, but has omitted the rollback plan.
Standard operational procedures mandate that every change request must specify how to safely revert changes if an unintended service disruption or deployment failure occurs.
3
Evaluate the incorrect choices.
Post-implementation testing cannot occur in production before approval, individual user sign-offs are not required, and skipping sandbox testing violates change management policies.
These choices represent procedural errors or improper workflow sequences within change management.

Anahtar Kavram

Essential Documentation Components of a Formal Change Request
Soru 1795Soru

An IT technician is setting up a point-of-sale system for a retail business. The store owner requests that customer credit card numbers and three-digit security codes be saved in cleartext on a local workstation to streamline recurring transactions. Which of the following compliance standards directly prohibits storing unencrypted payment card data and sensitive authentication information?

Cevabı ve açıklamayı göster

Cevap: PCI-DSS

Cevap

PCI-DSS (Payment Card Industry Data Security Standard)
PCI-DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Storing unencrypted cardholder data or sensitive authentication values (such as CVV/CVC codes) post-authorization is a strict violation of PCI-DSS requirements.

Adım Adım Çözüm

1
Identify the data type involved in the scenario
The scenario specifically deals with payment card data, including full credit card numbers and security codes.
Determining the data classification narrows down the applicable compliance framework.
2
Match the data classification with its governing regulatory standard
Payment card information (PCI) and cardholder data are governed by PCI-DSS.
PCI-DSS sets mandatory technical security requirements for any organization that stores, processes, or transmits credit card details.

Anahtar Kavram

Payment Card Industry Data Security Standard (PCI-DSS) Compliance Requirements
Soru 1796Soru

A system administrator needs to perform unattended after-hours maintenance on a remote workstation running Windows 11 Pro at a branch office. The technician successfully connects to the corporate network via VPN and verifies IP connectivity to the workstation. However, attempts to initiate a Remote Desktop Connection fail immediately. Local firewall rules allow TCP port 3389. Which of the following is the most likely cause of this connection failure?

Cevabı ve açıklamayı göster

Cevap: Remote Desktop is disabled in the System settings on the remote workstation.

Cevap

Remote Desktop is turned off by default in Windows 11 Pro System settings and must be explicitly enabled to allow incoming RDP connections.
While Windows 11 Pro includes the host component for Remote Desktop Protocol (RDP), the service is disabled by default for security. The administrator must navigate to System Settings (or System Properties) on the target device and enable Remote Desktop to accept incoming connections on TCP port 3389.

Adım Adım Çözüm

1
Analyze the technical requirements and scenario parameters.
The technician is using VPN (network layer access verified) and needs unattended access over RDP (TCP port 3389 allowed in firewall) to a Windows 11 Pro system.
Eliminating network and firewall obstacles isolates the issue to OS configuration on the target machine.
2
Evaluate Windows edition capabilities and default configurations.
Windows 11 Pro supports hosting RDP incoming sessions, but the feature is disabled by default in Windows for security hardening.
Without enabling 'Allow remote connections to this computer' in System Properties/Settings, incoming RDP traffic on port 3389 is rejected by the OS service listener.
3
Select the correct root cause.
The setting permitting remote access is turned off on the target host.
Enabling Remote Desktop in System settings starts the underlying Remote Desktop Services listener.

Anahtar Kavram

Windows Remote Desktop configuration and edition capabilities
Soru 1797Soru

A technician suspects that a mobile device has connected to a rogue wireless network and transmitted sensitive data. Place the standard incident response steps in the correct order to mitigate the security threat.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence to mitigate a rogue Wi-Fi connection incident is: First, enable Airplane Mode to isolate the device; second, remove the rogue network profile; third, update compromised user account credentials; and finally, disable Airplane Mode to reconnect to a safe, secure network.
The correct troubleshooting sequence follows standard incident response procedures: isolate the compromised device immediately (Airplane Mode), remove the malicious configuration (forget rogue network profile), protect user identity (reset account credentials), and safely restore connectivity to a trusted network.

Adım Adım Çözüm

1
Isolate the mobile device
Enabling Airplane Mode immediately terminates active Wi-Fi connections, halting data leakage.
Containment is the first priority when responding to network security compromises.
2
Remediate auto-connect settings
Forgetting the rogue network profile ensures the device will not attempt auto-reassociation.
Prevents immediate re-infection or unintended connection upon disabling Airplane Mode.
3
Secure account credentials
Resetting passwords revokes access for any unauthorized party who may have captured authentication tokens.
Rogue access points often capture cleartext or hash-based user credentials.
4
Restore safe operations
Rejoining a legitimate enterprise network confirms secure service restoration.
Allows the user to resume normal operations safely.

Anahtar Kavram

Mobile Device Security Incident Containment and Remediation
Tahmini Süre:1m 0s
Soru 1798Soru

An executive returning from an international business trip reports that corporate mobile applications on an enterprise-managed tablet are failing to connect to internal company servers. A security log review reveals that an untrusted third-party root CA certificate was installed on the device while connected to a public hotel network, causing the Mobile Device Management (MDM) client to mark the device as non-compliant and revoke enterprise network access profiles. Which of the following is the FIRST action an administrator should take to resolve the connectivity issue securely?

Cevabı ve açıklamayı göster

Cevap: Remove the untrusted root certificate, verify MDM policy compliance, and re-issue the enterprise security configuration profile.

Cevap

Remove the untrusted root certificate, verify MDM policy compliance, and re-issue the enterprise security configuration profile.
The correct response addresses the actual security violation by removing the untrusted root CA certificate that caused the MDM non-compliance state. Once the unauthorized certificate is removed, forcing an MDM compliance check allows the system to re-issue the necessary enterprise connectivity profiles safely.

Adım Adım Çözüm

1
Identify the root cause of the non-compliance state
The installation of an untrusted third-party root CA certificate triggered the MDM client's automated remediation policy, revoking corporate access.
Enterprise MDM solutions monitor device compliance and block access when unauthorized payload changes or certificate installations occur.
2
Remediate the unauthorized device state
Delete the untrusted root certificate from the device's credential store.
This removes potential man-in-the-middle exposure and returns the system certificate store to a trusted state.
3
Re-establish compliance and network access
Force an MDM policy compliance check and re-deploy the required enterprise network access profiles.
Once the device passes compliance checks, enterprise network profiles and VPN configurations can be restored safely.

Anahtar Kavram

MDM Certificate Compliance and Mobile Security Remediation
Soru 1799Soru

Match each remote access technology or protocol on the left with its primary operational security or network characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Remote Desktop Protocol (RDP)
Secure Shell (SSH)
Microsoft Remote Assistance (MSRA)
Telnet

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

RDP matches with full graphical desktop access over TCP port 3389; SSH matches with encrypted CLI administration over TCP port 22; MSRA matches with invitation-based interactive desktop session sharing; Telnet matches with unencrypted plain text command-line access over TCP port 23.
Each technology is correctly paired with its specific security and operational characteristic: RDP provides full remote GUI access on TCP 3389; SSH delivers encrypted CLI access on TCP 22; MSRA enables user-invited session sharing; and Telnet sends unencrypted CLI traffic on TCP 23.

Adım Adım Çözüm

1
Identify the protocol transport and port specifications for terminal protocols.
SSH uses TCP port 22 (encrypted CLI), whereas Telnet uses TCP port 23 (unencrypted CLI).
Security protocols separate encrypted management protocols like SSH from legacy plain text protocols like Telnet.
2
Differentiate Windows graphical remote management solutions.
RDP allows complete administrative login over TCP 3389, while MSRA requires user initiation and invitation for interactive assistance.
RDP is designed for independent desktop connectivity, whereas MSRA is structured for collaborative user assistance.

Anahtar Kavram

Remote Access Protocols, Port Numbers, and Security Boundaries
Soru 1800Soru

An IT operations manager is preparing to transition an enterprise on-premises VoIP PBX infrastructure to a hosted cloud communications solution. To comply with standard CompTIA A+ change management procedures, arrange the following operational phases in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence for the change management lifecycle is: 1) Define purpose/scope and conduct risk analysis, 2) Formulate the plan for change and documented rollback plan, 3) Submit the change request to the Change Advisory Board (CAB) for authorization, 4) Issue end-user notifications detailing the maintenance window, and 5) Perform the migration and complete post-implementation testing.
The standard CompTIA change management workflow mandates that an IT professional first define the scope and conduct a risk analysis. Next, detailed implementation and rollback plans must be authored. Only after these plans are finalized is the proposal submitted to the Change Advisory Board (CAB) for approval. Once authorized, end users are notified of the maintenance window. Finally, the migration is executed and post-implementation testing verifies system stability.

Adım Adım Çözüm

1
Identify the initial assessment phase
Defining the purpose, scope, and potential risk analysis forms the foundational baseline of any formal change request.
Without establishing scope and risk, technical plans cannot be appropriately constructed.
2
Identify the plan development phase
Creating the plan for change and the mandatory rollback plan.
CAB approval requires complete technical and recovery plans prior to submission.
3
Identify the governance and approval phase
Submitting the complete proposal to the Change Advisory Board (CAB).
Changes cannot be scheduled or communicated as approved until stakeholders and the CAB authorize the proposal.
4
Identify the pre-implementation communication phase
Notifying affected end users and business units about the scheduled maintenance window.
End users must be given advance warning of planned service disruptions.
5
Identify the execution and verification phase
Deploying the VoIP migration and executing post-implementation testing to confirm success.
The final step validates system functionality before closing the change ticket.

Anahtar Kavram

CompTIA A+ Change Management Lifecycle
Tahmini Süre:2m 0s
ÖncekiSayfa 90 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin