Tüm alıştırma soruları

3551 soru

Soru 1801Soru

A smartphone user connects to an unencrypted public wireless network and immediately receives repeated untrusted certificate warnings while attempting to visit secure enterprise websites. Which of the following is the most likely cause of these warnings?

Cevabı ve açıklamayı göster

Cevap: The mobile device connected to a rogue access point attempting a man-in-the-middle attack.

Cevap

The mobile device connected to a rogue access point attempting a man-in-the-middle attack.
The correct option identifies a rogue access point carrying out a man-in-the-middle attack. When an unauthorized access point intercepts encrypted web traffic, it presents invalid or self-signed certificates to the client device, triggering browser warnings.

Adım Adım Çözüm

1
Analyze the reported symptom and trigger environment.
The user is connected to an open public Wi-Fi network and experiencing browser certificate warnings on HTTPS websites.
Public open Wi-Fi networks present high risks for wireless spoofing and unauthorized traffic interception.
2
Evaluate the technical cause of untrusted certificate alerts.
An attacker operating an Evil Twin or rogue access point is intercepting web traffic and proxying SSL/TLS connections using self-signed or invalid certificates.
Browsers flag certificates as untrusted when the issuer domain or CA signature does not match the requested website.

Anahtar Kavram

Rogue Access Points and Man-in-the-Middle Attacks
Soru 1802Soru

A technician is writing a basic administrative script to automate system log compression when disk space is low. In what sequential order should the logical components of this conditional script be structured?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct logical sequence is: 1) Initialize environmental variables to define the log directory path and threshold limit, 2) Evaluate the conditional statement checking if available disk space is below the defined threshold, 3) Execute the compression command on the target log files inside the conditional block, and 4) Close the conditional construct and output a completion status message.
The correct order follows standard script execution logic: setting environment parameters first, testing the condition, executing the conditional action block, and cleanly closing the construct with status output.

Adım Adım Çözüm

1
Identify variable declaration requirements.
Path and threshold variables are defined at the top of the script.
Scripts process data sequentially from top to bottom; variables must exist before being referenced.
2
Place the conditional evaluation block.
Disk space condition check is evaluated.
Control constructs rely on evaluating a boolean condition prior to executing contained code.
3
Nest the execution payload.
Log compression executes if the evaluated condition is true.
The core action belongs within the body of the conditional block.
4
Finalize construct and exit.
The block is terminated and a message is emitted.
Proper syntax requires terminating conditional structures (such as fi in Bash or closing braces in PowerShell) to finish execution cleanly.

Anahtar Kavram

Basic Scripting Control Constructs and Execution Order
Soru 1803Soru

An incident responder is dispatched to preserve digital evidence from a powered-on server suspected of exfiltrating sensitive corporate files to an unauthorized remote address. To ensure forensic integrity and prevent critical evidence from being overwritten, the responder must acquire evidence following standard order of volatility guidelines. In what sequence should the responder capture the following data components, starting from the most volatile data to the least volatile data?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence from most volatile to least volatile is: CPU cache and registers, followed by System RAM and process state, then temporary swap/page files, non-volatile disk storage, and finally archived backup media and physical logs.
In computer forensics, the Order of Volatility dictates collecting evidence based on how quickly data can be lost. CPU cache and registers fluctuate at processor speeds (nanoseconds) and must be captured first. Main memory (RAM) and network state hold live session data lost at shutdown. Swap/page files hold secondary memory data on disk. Fixed magnetic or solid-state drive storage retains data persistently, and offline archival media/logs remain intact indefinitely without power.

Adım Adım Çözüm

1
Identify the order of volatility framework (RFC 3227 standards used in forensic acquisition).
Recognize that data disappearing fastest under power state changes or process cycles must be captured first.
Capturing data in reverse order would destroy highly ephemeral data like CPU state and RAM contents.
2
Place CPU registers and cache at the top of the sequence.
CPU cache and registers are established as position 1.
Registers change constantly at CPU clock speed cycles (nanoseconds).
3
Order main system memory (RAM), ARP/routing tables, and running process structures next.
System RAM and network connection tables are established as position 2.
RAM contents are lost immediately upon system shutdown or reboot.
4
Sequence virtual memory/page files and temporary storage above persistent block storage.
Swap/page files and temporary disk caches are established as position 3.
Virtual memory relies on local drive space but is dynamically modified by the OS during active operations.
5
Place non-volatile hard drive partitions and offline archives at the end of the acquisition process.
Disk images are position 4, and offline backup media/paper logs are position 5.
Persistent magnetic/flash media and offline backups retain state without power, making them the least volatile assets.

Anahtar Kavram

Order of Volatility in Forensic Data Acquisition
Soru 1804Soru

An IT technician needs to configure remote support capabilities for an enterprise environment. The requirements specify establishing secure, encrypted command-line management for remote headless Linux servers, as well as providing interactive desktop support to remote Windows 11 Enterprise users without terminating their active local desktop sessions. Which of the following protocol and tool choices MUST be implemented to fulfill these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Open TCP port 22 on the network firewall to facilitate secure shell connections.; Utilize Microsoft Remote Assistance to perform interactive screen-sharing support sessions.

Cevap

The correct configurations are opening TCP port 22 for secure shell access and utilizing Microsoft Remote Assistance for interactive screen-sharing support.
Secure Shell (SSH) over TCP port 22 supplies encrypted terminal access ideal for managing Linux machines. Microsoft Remote Assistance (MSRA) enables interactive support sessions where the remote technician and the local user view and control the desktop environment concurrently.

Adım Adım Çözüm

1
Identify the protocol required for secure command-line administration of headless Linux servers.
SSH (Secure Shell) encrypts traffic and operates over TCP port 22, fulfilling the server management requirement.
Telnet operates on TCP port 23 in cleartext and is inherently insecure, while RDP is primarily used for graphical interface management.
2
Determine the appropriate tool for interactive Windows desktop support that maintains the user's active session.
Microsoft Remote Assistance (MSRA) provides dual-control screen sharing where both the user and technician interact simultaneously.
Standard Remote Desktop Protocol (RDP) on client Windows editions locks or disconnects the local logged-in user upon connection.

Anahtar Kavram

Remote management protocol selection and session sharing behaviors
Soru 1805Soru

An IT technician is tasked with documenting the transfer of a seized workstation hard drive to a forensic analyst during an incident investigation. Which of the following details MUST be recorded on the chain of custody log during this transfer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The date and timestamp of the evidence transfer; The full name and signature of both the transferring technician and the receiving analyst

Cevap

The chain of custody log must include the date and timestamp of the transfer, as well as the full names and signatures of both the person releasing and the person receiving the evidence.
Maintaining an unbroken chain of custody requires logging the exact date and timestamp of the transfer alongside the names and signatures of both the releasing technician and the receiving analyst. This establishes legal accountability and proves continuous control of the evidence.

Adım Adım Çözüm

1
Identify the purpose of a chain of custody log
Recognize that the form serves to track evidence ownership, custody transfers, and integrity over time.
Chain of custody forms require strict legal and procedural accountability.
2
Evaluate required documentation fields for evidence transfer
Identify that the transfer timestamp and signatures of both handlers (releasing and receiving) are essential.
Without timestamps and signatures, proof of continuous custody is broken.

Anahtar Kavram

Chain of Custody Documentation Requirements
Tahmini Süre:1m 0s
Soru 1806Soru

An IT support technician is dispatched on-site to troubleshoot a workstation issue for a user who experienced an unexpected application crash. What is the correct sequence of professional communication and customer interaction steps the technician should execute from start to finish?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with greeting the user and actively listening, followed by asking clarifying questions and setting expectations, obtaining consent and respecting privacy during service, and concluding with verifying the resolution, documenting the ticket, and following up.
The proper sequence follows the established customer communication lifecycle: establishing rapport via greeting and active listening, asking clarifying questions to set expectations, acquiring permission and ensuring privacy during troubleshooting, and closing with solution verification, documentation, and follow-up.

Adım Adım Çözüm

1
Greet the user and listen actively.
Establishes professional rapport and captures the user's description of the problem.
CompTIA standards state that technicians should introduce themselves, maintain a professional tone, and avoid interrupting the user during the initial explanation.
2
Clarify details and set expectations.
Gathers precise technical context while preparing the customer for the troubleshooting workflow.
Asking open-ended clarifying questions and expressing empathy builds trust and establishes realistic completion timelines.
3
Request consent and respect customer privacy.
Protects sensitive data and physical property before executing changes.
Technicians must request consent before rebooting or altering system settings and avoid viewing confidential physical or digital property.
4
Verify functionality, document, and follow up.
Ensures problem resolution and completes ticket administrative requirements.
Demonstrating the working fix to the user, logging complete ticket notes, and scheduling a follow-up ensure long-term satisfaction.

Anahtar Kavram

Professional Customer Interaction Workflow
Soru 1807Soru

A systems administrator at an international software company is configuring a telemetry platform that collects IP addresses, account usernames, and usage logs from clients residing in the European Union. A developer proposes applying a SHA-256 cryptographic hash to these identifiers prior to storage and processing without obtaining user consent, claiming that hashed data is fully anonymized and exempt from data privacy laws. Which of the following best evaluates this proposal under the General Data Protection Regulation (GDPR)?

Cevabı ve açıklamayı göster

Cevap: The proposal is non-compliant because pseudonymized data (such as hashed identifiers) remains personal data under GDPR and still requires a lawful basis for processing.

Cevap

The proposal is non-compliant because pseudonymized data (such as hashed identifiers) remains personal data under GDPR and still requires a lawful basis for processing.
Under GDPR, personal data includes online identifiers such as IP addresses and account usernames. Replacing direct identifiers with cryptographic hashes is considered pseudonymization rather than full anonymization. Because pseudonymized data can still be linked back to individual subjects through cross-referencing or dictionary attacks, it remains fully subject to GDPR regulations and requires a lawful basis for processing.

Adım Adım Çözüm

1
Analyze the data type being collected.
IP addresses, usernames, and usage logs linked to EU citizens constitute Personally Identifiable Information (PII) under GDPR scope.
GDPR broadly defines personal data as any information relating to an identified or identifiable natural person.
2
Evaluate the technical measure (SHA-256 hashing) against GDPR definitions.
Hashing replaces identifiers with pseudonyms but does not render the data irreversibly anonymous, placing it in the category of pseudonymized data.
Recital 26 of GDPR explicitly states that personal data which has undergone pseudonymization remains personal data.
3
Determine compliance requirements.
Because pseudonymized data remains personal data under GDPR, processing it without a valid legal basis (such as consent or legitimate interest) violates compliance.
Organizations must adhere to GDPR principles for all personal data regardless of whether pseudonymization techniques were applied.

Anahtar Kavram

GDPR Scope and Pseudonymization vs. Anonymization
Soru 1808Soru

An IT technician is preparing to update software on corporate workstations following organizational policy. In what order should the technician execute the stages of the standard change management process?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper chronological sequence of the change management lifecycle is: 1) Define the purpose and scope of the proposed change, 2) Perform a risk analysis and draft a comprehensive rollback plan, 3) Submit the change request to the Change Advisory Board (CAB) for authorization, 4) Notify affected end users of the scheduled maintenance window, and 5) Implement the change and execute post-implementation testing.
The standard CompTIA change management workflow dictates defining purpose and scope first, followed by performing risk analysis and preparing a rollback plan. Next, formal authorization must be granted by the Change Advisory Board (CAB). Once authorized, end users are notified, and lastly, the change is implemented and verified through post-implementation testing.

Adım Adım Çözüm

1
Identify parameters of the change
The purpose and scope are clearly defined.
Understanding what is being changed and why is necessary before evaluating potential impacts.
2
Evaluate impact and plan for recovery
Risks are documented and a rollback strategy is created.
Board review requires knowing potential risks and having a strategy to revert if deployment fails.
3
Seek governance approval
The Change Advisory Board (CAB) reviews and approves the request.
Changes to production systems require authorization to ensure alignment with business needs and security.
4
Inform stakeholders
Users are alerted to potential service disruption and timeframes.
Timely notifications allow business units to prepare for planned outages.
5
Deploy and validate
The change is applied and confirmed functional via testing.
Post-implementation testing verifies that the change achieved its goal without breaking services.

Anahtar Kavram

Standard Change Management Lifecycle
Soru 1809Soru

A support technician is processing a service desk request from an employee who cannot access a corporate application following a recent security update. Place the steps of the ticketing system workflow in the correct sequential order from initial receipt to ticket completion.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of the ticketing workflow is: 1) Log the incident with user and asset details, 2) Categorize the ticket and assign priority level, 3) Perform diagnostic testing to identify the root cause, 4) Apply the fix and record resolution notes, and 5) Confirm functionality with the user and close the ticket.
The standard CompTIA/ITIL incident ticketing lifecycle follows five sequential phases: Logging -> Categorization/Prioritization -> Investigation/Diagnosis -> Resolution/Documentation -> Verification/Closure. Initial logging records baseline details, triage assigns urgency and category, investigation pinpoint the root cause, technical resolution fixes the issue alongside documentation, and user verification ensures satisfaction prior to ticket closure.

Adım Adım Çözüm

1
Record initial incident information
Ticket is created with user and system baseline data.
Establishes a tracking record in the ticketing system.
2
Triage by categorizing and prioritizing
Ticket is classified with impact/urgency rating and routed appropriately.
Determines handling priority and SLA compliance timelines.
3
Investigate and diagnose the root cause
Technician isolates the exact cause of the failure through testing.
Required before attempting targeted technical resolution.
4
Implement solution and document resolution notes
The issue is fixed and technical remediation steps are documented for future reference.
Ensures knowledge management updates and technical completion.
5
Verify with user and close ticket
User confirms resolution and ticket state moves to closed.
Prevents premature ticket closure without end-user satisfaction verification.

Anahtar Kavram

Ticketing System Lifecycle and Incident Management Workflow
Soru 1810Soru

A technician is preparing a workstation to replace an internal expansion card while adhering to proper electrostatic discharge (ESD) safety controls. Place the operational steps in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with disconnecting all power and cabling from the computer, followed by positioning and grounding the anti-static mat, then putting on and attaching the anti-static wrist strap to the grounded mat, and finally opening the computer case to replace the card.
Establishing proper ESD safety procedures requires isolating power sources first, preparing and grounding the anti-static work mat second, securing personal ESD wrist grounding third, and performing internal hardware manipulation last.

Adım Adım Çözüm

1
Disconnect external power sources and cables
Electrical safety is ensured by eliminating shock potential before manipulating hardware.
Shutting off and unplugging power is the baseline safety requirement before introducing anti-static tools or opening the chassis.
2
Set up and ground the anti-static mat
An ESD-safe surface area is established for laying down components.
The mat must be bonded to earth ground so static charges bleed off safely before components touch it.
3
Equip and connect the anti-static wrist strap
The technician's body potential is equalized with the ESD mat ground.
Personal grounding prevents static accumulation on the technician's body from transferring to ESD-sensitive components.
4
Open chassis and handle internal components
Internal hardware can be safely serviced without ESD risk.
Component manipulation must only occur after ESD protection controls are fully active.

Anahtar Kavram

Proper sequencing of ESD protection controls during hardware maintenance
Tahmini Süre:1m 0s
Soru 1811Soru

A corporate IT technician discovers an active network intrusion on an administrative workstation where unauthorized data exfiltration is currently taking place. In what sequence should the technician perform the incident response, evidence preservation, and chain of custody procedures from first to last?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with reporting the incident, followed by isolating the host from the network, capturing volatile RAM memory, imaging the hard drive with a hardware write blocker, and finally completing the chain of custody log prior to securing physical evidence.
The correct sequence follows standard CompTIA incident response guidelines and forensic best practices. First, the technician reports the breach to initiate official escalation. Next, the network connection is severed to contain exfiltration without altering live state. Volatile memory (RAM) is captured next in accordance with the order of volatility. The system is then powered down to image non-volatile storage using a write blocker. Finally, the evidence is logged on a chain of custody form and stored securely.

Adım Adım Çözüm

1
Report the security breach and document initial observations according to escalation protocols.
Establishes formal incident management tracking and authorizes containment actions.
Proper reporting ensures security management is aware of the threat before technical steps begin.
2
Isolate the compromised system by disconnecting network connectivity.
Halts active exfiltration without altering memory contents or shutting down system processes.
Containment is the immediate technical priority to prevent further unauthorized data transfer.
3
Acquire volatile memory (RAM) and active system state.
Preserves transient forensic evidence that will be wiped if the system reboots or powers off.
Adheres to the order of volatility (RAM is more volatile than fixed mass storage).
4
Power off the machine and create a forensic image of non-volatile storage using a write blocker.
Generates a bit-stream copy of the drive for analysis without altering original evidence.
Non-volatile media is captured after RAM, and write blocking ensures evidence integrity.
5
Fill out the chain of custody log and store the drive in a tamper-evident container.
Establishes verifiable tracking of evidence custody, timestamps, and handling integrity.
Unbroken documentation is legally required to prove evidence has not been tampered with.

Anahtar Kavram

Incident Response Workflow, Order of Volatility, and Chain of Custody Maintenance
Tahmini Süre:3m 0s
Soru 1812Soru

A system administrator is writing an automated administrative script to safely archive old system diagnostic logs from client workstations to prevent storage exhaustion. To ensure script safety and avoid runtime execution exceptions, place the following script construction steps into their proper logical execution sequence from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct logical execution sequence is: First, declare and initialize script variables; second, evaluate a conditional branch to verify the target directory exists; third, instantiate a loop construct to iterate through the retrieved files; and fourth, perform a conditional comparison inside the loop body to execute the archive command.
In basic administrative scripting across Shell, PowerShell, or Python, programs follow a strict control flow sequence. Variables defining directory paths and numerical thresholds must be initialized first. Next, a conditional branch tests the environment to ensure target locations exist. Once verified, a loop construct iterates through the files, and specific file processing actions are executed inside the loop body based on sub-conditions.

Adım Adım Çözüm

1
Initialize parameters and environment variables
Script storage locations and integer age limits are defined in memory.
Scripting constructs require variables to be populated before they are evaluated in conditional statements or loops.
2
Perform environment state checking via conditional branching
The target folder's presence is verified before proceeding.
Attempting to query or read a non-existent file path causes unhandled runtime failures in scripting environments.
3
Begin container iteration using a loop construct
The script accesses the array of log file objects one by one.
Iteration constructs allow repeating operational logic over collections of system objects.
4
Execute conditional comparison and file action inside loop body
Only log files exceeding the integer threshold are archived.
Actionable script commands must be scoped within the iteration body to evaluate each item individually.

Anahtar Kavram

Logical sequence of scripting constructs (variables, conditional branches, loops, and execution bodies)
Soru 1813Soru

A home healthcare nurse reports that a vital patient chart application on an iOS tablet regularly freezes and becomes unresponsive while recording patient data during visits. A mobile technician needs to resolve the performance issue using standard least-invasive-first troubleshooting procedure. In what sequence should the technician perform these actions, arranged from least invasive to most invasive?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The technician should troubleshoot mobile app issues from least invasive to most invasive: first force close the application, next soft reset the device, then offload or update/reinstall the application, and finally perform a factory reset of the device as a last resort.
CompTIA CompTIA A+ software troubleshooting methodology requires technicians to mitigate issues using the least invasive action first. Terminating the application process is non-destructive and instantaneous. If the issue persists, restarting the device clears memory. If application files are corrupted, reinstalling or updating the app resolves the problem. A factory reset wipes all data and settings, making it the final, most invasive troubleshooting step.

Adım Adım Çözüm

1
Force quit the unresponsive application.
Clears transient memory state for the specific app with zero risk to data or system settings.
Always start with the minimal action focused specifically on the failing application process.
2
Reboot (soft reset) the mobile device.
Clears system RAM and resets OS services without deleting data.
If terminating the app process does not work, the underlying operating system resources must be refreshed.
3
Offload/reinstall or update the application.
Fixes broken code or corrupted installation files for the application.
Reinstalling targets application software integrity specifically before taking system-wide destructive measures.
4
Factory reset the device.
Restores the operating system to factory defaults and removes all local data and custom configurations.
Wiping the device is extremely disruptive and time-consuming, so it must only be used after all application-level and non-destructive steps fail.

Anahtar Kavram

Mobile OS Troubleshooting Methodology (Least Invasive First)
Soru 1814Soru

A company's incident response team has completed the initial containment of a compromised database administrator workstation. An IT specialist is tasked with transporting the internal solid-state drive, which has been placed in a sealed evidence bag, to an off-site forensic laboratory. Which of the following actions must the specialist perform at the exact moment the drive is handed over to the laboratory analyst to maintain an unbroken chain of custody?

Cevabı ve açıklamayı göster

Cevap: Have the receiving analyst inspect the tamper-evident seal, sign the custody log, and record the precise date and time of the physical transfer.

Cevap

Have the receiving analyst inspect the tamper-evident seal, sign the custody log, and record the precise date and time of the physical transfer.
Chain of custody protocols dictate that whenever physical evidence moves from one handler to another, both parties must record the exact date and time, verify that the evidence seal is intact, and sign the custody log. This guarantees chronological accountability and evidence integrity for forensic analysis and legal proceedings.

Adım Adım Çözüm

1
Identify the primary purpose of chain of custody during physical evidence handoff.
Chain of custody ensures legal admissibility by documenting continuous control and verifying evidence integrity.
Any gap in documentation or unverified transfer invalidates digital evidence in court.
2
Determine the mandatory protocol items required when relinquishing physical possession to another party.
Both the relinquishing party and receiving party must sign the transfer form, log the exact date and time, and confirm the evidence packaging integrity.
This establishes clear accountability and proves the evidence was not tampered with while in transit.

Anahtar Kavram

Chain of custody maintenance and physical evidence documentation protocols
Soru 1815Soru

A corporate IT technician is notified that a remote employee's workstation may have been compromised by malware capable of exfiltrating credentials over the network. The workstation is currently powered on and connected to the internal office network via Ethernet. Which of the following immediate first-responder actions should the technician take to contain the threat while preserving volatile digital evidence? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disconnect the network cable from the workstation; Capture system RAM to external storage prior to shutting down

Cevap

The technician should disconnect the network cable from the workstation and capture system RAM to external storage prior to shutting down.
Disconnecting the physical network cable isolates the system from the network to stop data exfiltration without clearing volatile memory. Capturing system RAM prior to any shutdown ensures that volatile evidence (such as active connections and processes) is preserved in accordance with the order of volatility.

Adım Adım Çözüm

1
Isolate the compromised workstation from the local network by removing the network cable.
Network communication and active exfiltration are immediately blocked while preserving the powered-on state.
Isolation stops further data leakage and prevents the threat from spreading laterally across the enterprise network.
2
Capture volatile RAM using specialized forensic acquisition tools onto external media.
Volatile memory content is successfully saved for evidence analysis.
Order of volatility dictates capturing RAM before powering off or restarting the system, as memory contains volatile evidence like encryption keys and running malicious artifacts.

Anahtar Kavram

Incident Isolation and Volatile Evidence Preservation
Soru 1816Soru

A system administrator observes that multiple domain-joined workstations consistently open an unwanted advertisement page whenever Microsoft Edge is launched. The administrator confirms that DNS queries using `nslookup` resolve accurately to internal servers, and manual inspection confirms the local `hosts` file contains no rogue IP mappings. Additionally, resetting browser user settings and clearing local cache only resolves the issue temporarily, as the unwanted URL re-populates as the startup page upon system reboot. Which of the following actions should the administrator take NEXT to permanently eliminate the redirection?

Cevabı ve açıklamayı göster

Cevap: Inspect and delete unauthorized Registry keys under the Group Policy policy hives, then audit Active Directory GPOs for malicious modifications.

Cevap

Inspect and delete unauthorized Registry keys under the Group Policy policy hives, then audit Active Directory GPOs for malicious modifications.
Removing unauthorized Group Policy registry keys and auditing Active Directory GPOs targets the root cause of persistent browser redirects. When browser settings continuously revert back to an unauthorized URL after every reboot despite manual resets, an active Group Policy Object (GPO) or malicious policy registry key (under HKLM/HKCU Policy hives) is enforcing the setting upon system startup.

Adım Adım Çözüm

1
Analyze the persistent symptom after standard remediation steps failed.
Standard browser resets and clearing local profile data failed to persist across reboots, indicating an external policy mechanism is reapplying the settings.
When local browser configurations revert after a system reboot, central management tools like Windows Group Policy or malicious registry policies are enforcing the settings.
2
Rule out network-level and local host file redirects.
DNS resolution via `nslookup` is verified correct and the `hosts` file contains no malicious entries.
Verifying DNS and hosts files narrows the root cause specifically to browser configuration management rather than name resolution tampering.
3
Locate and remediate enforced policy entries in the Windows Registry and Active Directory GPOs.
Removing forced policy registry keys under `HKLM\SOFTWARE\Policies\Microsoft\Edge` or `HKCU\SOFTWARE\Policies\Microsoft\Edge` and fixing the domain GPO prevents automatic re-application of the home page setting.
Policies applied via GPO write to protected registry paths that override user-configured browser preferences during startup and system boot.

Anahtar Kavram

Group Policy Registry Enforced Browser Hijacking Remediation
Soru 1817Soru

A helpdesk technician suspects that a desktop computer on the corporate network is actively compromised by malware attempting to spread across the network. Which immediate action should the technician take first to contain the incident while preserving volatile system memory for analysis?

Cevabı ve açıklamayı göster

Cevap: Disconnect the network cable and disable all wireless connections on the system

Cevap

Disconnect the network cable and disable all wireless connections on the system
Disconnecting network interfaces immediately isolates the system to prevent malware from spreading across the network or exfiltrating data, while keeping the machine powered on so volatile evidence in RAM remains preserved for analysis.

Adım Adım Çözüm

1
Identify the primary incident response objective for an active network security incident
Containment of the threat is the immediate priority to prevent lateral spread.
Active malware on a network-connected host poses an immediate risk to other systems.
2
Select the appropriate isolation technique that preserves digital evidence
Unplugging network cables or turning off Wi-Fi/Bluetooth disconnects network traffic.
Network isolation stops data exfiltration and network propagation without shutting down the system, preserving volatile RAM.

Anahtar Kavram

Incident Response First Responder Priorities: Isolation and Preservation
Tahmini Süre:45s
Soru 1818Soru

Following an abrupt power loss during an optional update, a Windows workstation begins experiencing intermittent system instability alongside missing DLL error messages upon startup. A technician needs to restore driver stability and repair core operating system file integrity. Which TWO of the following actions should the technician perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Device Manager to perform a driver rollback on the hardware modified prior to the power failure.; Execute sfc /scannow from an administrative Command Prompt to scan and restore damaged system files.

Cevap

Rolling back the modified driver in Device Manager and running `sfc /scannow` from an administrative Command Prompt.
The correct procedures involve performing a driver rollback in Device Manager to replace the unstable driver with its previous version, and running `sfc /scannow` from an elevated Command Prompt to scan and restore corrupted system files.

Adım Adım Çözüm

1
Address the hardware driver instability by reverting to the previous functional driver version.
Device Manager reinstalls the backup driver binaries, eliminating crashes caused by corrupted or partially installed device drivers.
Restoring driver stability prevents further kernel faults while running repair tools.
2
Open an elevated Command Prompt and execute System File Checker.
The command `sfc /scannow` verifies the cryptographic signatures of system binaries and replaces corrupted files from the component store.
SFC specifically targets missing or corrupt system files such as OS DLLs.

Anahtar Kavram

Resolving System File Corruption and Driver Issues
Soru 1819Soru

A system administrator is creating a native shell script to automate routine backup tasks on a Linux server. Which file extension should the administrator assign to this script?

Cevabı ve açıklamayı göster

Cevap: .sh

Cevap

The administrator should assign the .sh file extension to the Linux shell script.
The .sh file extension designates a shell script executable within Linux and Unix command shells such as Bash.

Adım Adım Çözüm

1
Identify the target operating system and scripting environment from the scenario.
The server runs Linux, requiring a native Linux shell script environment (such as Bash).
Script extensions correspond directly to their target operating systems and shell runtimes.
2
Match the Linux shell environment with its designated file extension.
.sh is identified as the standard file extension for shell scripts.
Unix and Linux shell scripts conventionally use the .sh extension.

Anahtar Kavram

Basic scripting language file extensions and execution environments
Soru 1820Soru

An IT technician accidentally spills a liquid cleaning solvent onto the floor in an equipment repair depot. Arrange the following steps in the correct order, from first to last, to safely manage and remediate the chemical spill according to safety standards and environmental controls.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for managing a chemical cleaning solvent spill is: First, consult the Safety Data Sheet (SDS) for hazard information and PPE requirements; second, don the appropriate PPE; third, apply absorbent material from the outer edges inward to contain the spill; fourth, collect and seal the contaminated material in a labeled hazardous waste container; fifth, dispose of the hazardous waste following environmental regulations.
The correct procedural order ensures safety at every stage: initial hazard assessment (consulting the SDS) must precede physical interaction; putting on PPE ensures technician safety prior to contact; diking the perimeter prevents spreading; sealing the material isolates vapors; and regulatory disposal fulfills environmental compliance mandates.

Adım Adım Çözüm

1
Consult the chemical Safety Data Sheet (SDS).
Identify specific health risks, handling hazards, and required Personal Protective Equipment (PPE).
Approaching a chemical spill without knowing its toxicity or proper precautions exposes the technician to chemical burns, toxic fumes, or fire hazards.
2
Equip the specified PPE.
Ensure physical protection for eyes, skin, and respiratory system before approaching the chemical.
PPE must be worn before physical remediation begins to prevent accidental exposure.
3
Contain and absorb the spill from the perimeter inward.
Prevent the liquid from spreading across the floor or reaching environmental drains.
Diking the outer edge first minimizes the affected area before absorbing the central spill volume.
4
Collect and seal the contaminated absorbent media into a designated hazardous waste container.
Isolate the chemical hazard for safe transport.
Absorbed solvents still off-gas harmful vapors and present contact hazards until properly sealed.
5
Dispose of the waste container per SDS and local environmental regulations.
Complete environmentally compliant disposal.
Hazardous chemicals cannot be discarded in standard refuse bins or municipal water systems.

Anahtar Kavram

Chemical Spill Management and SDS Compliance
ÖncekiSayfa 91 / 178Sonraki
Tüm alıştırma soruları — CompTIA A+ (Core 1 & Core 2) | Examkin