Examkin

Security

442 soru

Tüm türler442Çoktan seçmeli224Çoklu seçim94Eşleştirme71Sıralama53
Soru 181Soru →

A tier 2 IT support technician is reviewing an incident report from a regional office. A visitor wearing a high-visibility utility vest approached the front reception desk, presented a printed fake work order for emergency electrical maintenance, and convinced the receptionist to grant access to restricted communications closets without standard badge verification. Once inside, the intruder installed a rogue hardware keylogger on an unmonitored workstation. Which of the following social engineering techniques was primarily used to gain initial unauthorized physical entry to the facility?

Cevabı ve açıklamayı göster

Cevap: Pretexting

Cevap

The correct threat classification is Pretexting.
Pretexting is the social engineering technique where an attacker crafts a fictitious story or scenario (the pretext), often adopting a persona such as a repair technician or auditor, to trick individuals into granting physical or logical access they should not have.

Adım Adım Çözüm

1
Analyze the attack vector and scenario details.
The attacker physically interacted with staff, posed as a maintenance worker, used a fake work order, and established a plausible narrative to bypass credential checks.
Identifying the method of interaction helps differentiate physical social engineering vectors from digital vectors.
2
Evaluate the definition of Pretexting.
Pretexting is defined by inventing a scenario (a pretext) to persuade a target to perform actions or release sensitive access.
The use of a fake work order and utility uniform directly constitutes creating a fake pretext to gain entry.
3
Distinguish Pretexting from alternative physical and digital threats.
Tailgating relies on physically following someone through a door; spear phishing relies on targeted emails; baiting relies on enticing physical media.
Eliminating misclassified threats ensures accurate identification of the social engineering tactic.

Anahtar Kavram

Pretexting in Social Engineering
Soru 182Soru →

A corporate workstation on a secure network segment has triggered automated endpoint alerts for an active file-encrypting ransomware outbreak. Place the following remediation tasks in the correct sequence according to the official CompTIA 7-step malware removal procedure.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the CompTIA 7-step malware removal process starting from isolation: Quarantine infected system -> Disable System Restore -> Remediate infected system -> Schedule scans and run updates -> Enable System Restore and create a restore point -> Educate the end user.
The CompTIA standard 7-step malware removal process follows a strict order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate end user. In this scenario, symptoms have been identified by the automated alert, making quarantining the host via physical/logical network disconnection the immediate mandatory step, followed consecutively by disabling restore functions, scanning/cleaning, scheduling/updating, re-enabling restore points, and finally user education.

Adım Adım Çözüm

1
Isolate the endpoint from the local network environment.
Network interfaces disabled, satisfying Step 2 (Quarantine the infected system) as symptoms are already identified in the scenario.
Prevents ransomware from spreading laterally to corporate network shares and adjacent systems.
2
Disable System Restore / System Protection on the infected endpoint.
Shadow copies and System Restore points are disabled/cleared, satisfying Step 3.
Prevents malware files stored within restore points from persisting or reinfecting the system post-remediation.
3
Perform malware scan and eradication using updated security tools.
Malicious ransomware binaries and registry entries are purged, satisfying Step 4 (Remediate infected systems).
Removes active malware threats in an isolated boot environment such as Safe Mode.
4
Configure recurring scan schedules and install latest operating system patches.
Automatic scans are scheduled and OS updates applied, satisfying Step 5.
Protects against re-infection and closes vulnerabilities exploited by malware.
5
Re-enable System Protection and create a fresh system baseline snapshot.
System Restore is re-enabled and a clean restore point created, satisfying Step 6.
Establishes a known good configuration baseline for future rollback if necessary.
6
Provide security awareness guidance to the user.
User completes training, satisfying Step 7 (Educate the end user).
Mitigates human risk factors that allowed initial malware entry.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process
Soru 183Soru →

An IT security analyst is tasked with decommissioning a storage array that contains self-encrypting enterprise NVMe solid-state drives (SSDs) holding sensitive customer financial data. The company plans to reuse the SSDs in an internal, non-sensitive testing laboratory. According to NIST SP 800-88 guidelines for media sanitization (Purge level), which of the following actions will securely sanitize the flash storage while keeping the drives operational for reuse?

Cevabı ve açıklamayı göster

Cevap: Execute a cryptographic erase (CE) command utilizing the drive firmware and Physical Security ID (PSID).

Cevap

Execute a cryptographic erase (CE) command utilizing the drive firmware and Physical Security ID (PSID).
Executing a cryptographic erase (CE) via drive firmware and PSID deletes or overwrites the internal Media Encryption Key (MEK) stored on self-encrypting drives (SEDs). Without this key, all stored data becomes permanently unrecoverable cipher text, satisfying security compliance while keeping the physical NVMe SSD functional for redeployment.

Adım Adım Çözüm

1
Identify media type and disposition goals
The target drives are flash-based solid-state drives (NVMe SSDs) with built-in hardware encryption (SEDs) intended for hardware reuse.
Selection of data destruction techniques depends directly on physical storage architecture and whether the hardware will be destroyed or redeployed.
2
Evaluate sanitization methods for solid-state drive reuse
Physical destruction prevents reuse. Degaussing is ineffective on flash memory. OS formatting and basic logical overwriting leave inaccessible data remnants due to SSD wear-leveling and over-provisioning.
SSD controllers abstract physical flash blocks, requiring firmware-level sanitization methods.
3
Select the appropriate NIST SP 800-88 Purge method
Cryptographic erase (CE) / Sanitize Block Erase securely destroys the Media Encryption Key (MEK), rendering all stored data permanently unreadable while leaving the drive usable.
Cryptographic Erase fulfills Purge-level sanitization requirements for self-encrypting SSDs prior to redeployment.

Anahtar Kavram

Cryptographic Erase and Solid-State Drive (SSD) Sanitization
Tahmini Süre:1m 30s
Soru 184Soru →

An IT administrator is deploying automated maintenance scripts on a Windows 11 Pro system. When these scripts execute operations requiring elevated privileges while an administrative user is logged in, execution halts due to an interactive elevation prompt appearing on the dimmed desktop. The administrator needs to adjust the Local Security Policy (secpol.msc) so that elevation requests for administrative users in Admin Approval Mode proceed automatically without user interaction or desktop dimming. Which policy setting should the administrator configure?

Cevabı ve açıklamayı göster

Cevap: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode -> Elevate without prompting

Cevap

Configure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Elevate without prompting' in Local Security Policy.
In Windows Local Security Policy (secpol.msc), configuring 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Elevate without prompting' allows applications and scripts launched by administrative accounts to automatically acquire administrative privilege tokens without halting for user consent or dimming the display.

Adım Adım Çözüm

1
Open Local Security Policy console by running secpol.msc.
Navigates to the local security management snap-in.
Security policies governing UAC prompts for local accounts are managed under Security Settings.
2
Navigate to Security Settings -> Local Policies -> Security Options.
Displays all granular User Account Control policy options.
UAC policies are configured under the Local Policies Security Options node.
3
Locate 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' and set its value to 'Elevate without prompting'.
Administrative elevation requests bypass consent prompts automatically.
This configuration allows background tasks and administrative scripts to execute elevated tasks seamlessly without halting for interactive confirmation.

Anahtar Kavram

User Account Control Security Policy Elevation Behavior
Tahmini Süre:1m 15s
Soru 185Soru →

An IT forensic technician is preparing to transport a confiscated smartphone containing critical evidence to a secure testing facility. To ensure the device cannot be wiped remotely or altered via cellular or wireless networks while in transit, which of the following physical security controls should be used?

Cevabı ve açıklamayı göster

Cevap: A Faraday bag

Cevap

A Faraday bag is the appropriate physical control to isolate the mobile device from all wireless communication signals during transit.
A Faraday bag provides electromagnetic shielding that blocks all incoming and outgoing wireless signals (cellular, Wi-Fi, Bluetooth, GPS). This physically prevents remote wipe commands or unauthorized network connectivity while the mobile phone is transported.

Adım Adım Çözüm

1
Identify the threat presented in the scenario.
The main threat is unauthorized remote access or remote wiping of the device over cellular, Wi-Fi, or Bluetooth networks.
Securing physical evidence requires maintaining digital chain of custody and preventing data destruction.
2
Evaluate physical security controls for electromagnetic shielding capability.
Faraday bags create a metallic enclosure (Faraday cage effect) that prevents radio frequency (RF) signals from penetrating.
Without RF signals, the device cannot receive remote wipe commands or connect to outside networks.
3
Distinguish from non-shielding physical controls.
Tamper-evident seals, cable locks, and RFID tags serve physical anti-theft, inventory, or anti-tampering functions but lack electromagnetic shielding capabilities.
Selecting a control designed for physical theft or tracking will not mitigate the network-based threat of a remote wipe.

Anahtar Kavram

Faraday Enclosure / Signal Shielding
Soru 186Soru →

A security administrator is hardening a standalone Windows 11 workstation. The organization requires that administrators must re-enter credentials on a secure desktop when elevating privileges, standard users must be automatically denied elevation without a prompt, and the changes must take effect immediately without a reboot. Arrange the following administrative steps in the correct logical sequence to accomplish this configuration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: Open the Local Security Policy console (secpol.msc) with elevated privileges, navigate to Security Settings > Local Policies > Security Options, configure the administrator elevation prompt behavior to prompt for credentials on the secure desktop, configure the standard user elevation prompt behavior to automatically deny elevation requests, and execute gpupdate /force from an elevated Command Prompt.
To achieve granular security control over UAC prompt behaviors, the administrator must first open secpol.msc with administrative privileges and navigate to Security Settings > Local Policies > Security Options. Next, the administrator configures the prompt behavior for administrators to require credentials on the secure desktop. Then, the prompt behavior for standard users is set to automatically deny elevation requests. Finally, running gpupdate /force in an elevated Command Prompt forces the operating system to re-read and enforce the local security baseline immediately without restarting.

Adım Adım Çözüm

1
Launch Local Security Policy console
The Local Security Policy snap-in (secpol.msc) opens with full administrative access.
Administrative rights are required to view and modify security settings across the system.
2
Locate UAC policy settings
Expand Security Settings > Local Policies > Security Options in the navigation pane.
User Account Control behavior policies are maintained specifically under the Security Options subfolder.
3
Set Administrator UAC prompt behavior
Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
This satisfies the explicit requirement for administrative users to re-enter credentials on a secure desktop during privilege elevation.
4
Set Standard User UAC prompt behavior
Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This satisfies the requirement to suppress credentials prompts and automatically reject elevation requests initiated by non-admin accounts.
5
Apply policy updates without rebooting
Execute gpupdate /force in an elevated Command Prompt window.
This forces the operating system to immediately update and enforce local policy changes without restarting the workstation.

Anahtar Kavram

Windows Local Security Policy (secpol.msc) User Account Control Policy Hardening
Soru 187Soru →

A helpdesk technician has confirmed that a company laptop is infected with a trojan that is generating unauthorized network traffic. Following the standard CompTIA malware remediation process, which action should the technician take NEXT?

Cevabı ve açıklamayı göster

Cevap: Isolate the computer by disconnecting its wired network cable and disabling Wi-Fi.

Cevap

Isolate the computer by disconnecting its wired network cable and disabling Wi-Fi.
According to the standard CompTIA 7-step malware remediation workflow (1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected system, 5. Schedule updates/scans, 6. Enable System Restore/create restore point, 7. Educate user), the immediate step following symptom identification is quarantining the system. Disconnecting network connections isolates the system to contain the threat.

Adım Adım Çözüm

1
Identify the current step in the CompTIA 7-step malware removal process.
The technician has already identified and verified the malware infection (Step 1).
Recognizing the starting stage determines the proper sequential response.
2
Determine Step 2 of the 7-step malware removal process.
Step 2 is to quarantine the infected system.
Quarantining/isolating the host prevents malware from spreading to other network assets or communicating with external command-and-control servers.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process - Quarantine
Tahmini Süre:1m 0s
Soru 188Soru →

A technician needs to adjust the User Account Control (UAC) notification settings on a Windows 11 computer so that prompts still appear when programs try to make changes to the system, but the secure desktop screen dimming effect is disabled. Which setting on the UAC slider should the technician choose?

Cevabı ve açıklamayı göster

Cevap: Notify me only when apps try to make changes to my computer (do not dim my desktop)

Cevap

The setting 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' provides UAC prompts without dimming the desktop.
Selecting 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' ensures that User Account Control still generates elevation prompts whenever software attempts system modifications, but it renders the prompt within the standard user desktop environment rather than dimming the screen via Secure Desktop.

Adım Adım Çözüm

1
Identify the requirement
The goal is to receive notifications for application changes while eliminating the desktop dimming delay.
The Secure Desktop feature dims the screen, which can cause graphics performance issues on certain display drivers.
2
Evaluate the UAC slider options
The third slider level from the top explicitly specifies 'do not dim my desktop' while maintaining prompt notifications for application changes.
Selecting this level modifies the UAC behavior accordingly.

Anahtar Kavram

User Account Control (UAC) Slider Notification Levels
Soru 189Soru →

A technician needs to sanitize several solid-state drives (SSDs) containing sensitive company data. The drives must remain functional so they can be reassigned to non-sensitive workstations. Which of the following data sanitization methods should the technician perform?

Cevabı ve açıklamayı göster

Cevap: Perform an ATA Secure Erase or cryptographic erasure on the drives.

Cevap

An ATA Secure Erase or cryptographic erasure should be performed on the solid-state drives.
Applying an ATA Secure Erase command or cryptographic erasure purges the contents of flash memory cells or destroys the cryptographic keys protecting the drive, ensuring the data is permanently unrecoverable while preserving the hardware for redeployment.

Adım Adım Çözüm

1
Identify the media type and operational requirements.
The target devices are solid-state drives (SSDs) that must be preserved for reuse rather than physically destroyed.
Flash-based storage requires software-based sanitization techniques specifically designed for non-magnetic media.
2
Select a sanitization method compatible with flash storage reuse.
ATA Secure Erase or cryptographic erasure purges all stored data without damaging the underlying drive components.
Degaussing fails on solid-state media, and basic OS formatting leaves raw data readable by forensic utilities.

Anahtar Kavram

Sanitization Methods for Solid-State Storage
Soru 190Soru →

As an IT security technician reviewing recently logged security events across the organization, match each security incident scenario to its corresponding social engineering or threat classification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Shoulder Surfing
Dumpster Diving
Watering Hole Attack
Typosquatting

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Shoulder Surfing matches the observation of PIN entry. Dumpster Diving matches searching un-shredded trash bins. Watering Hole Attack matches compromising a heavily visited industry website. Typosquatting matches mistyping a domain URL to land on a spoofed site.
Each attack vector accurately maps to its defined operation: shoulder surfing focuses on visual observation of data input; dumpster diving searches physical waste for information; watering hole attacks compromise trusted third-party sites; and typosquatting leverages common domain name spelling errors.

Adım Adım Çözüm

1
Analyze physical observation threat vectors
Secretly observing credential input from across the room describes direct visual observation, which is shoulder surfing.
Recognizing physical visibility vulnerabilities.
2
Identify physical paper document theft methods
Searching through un-shredded corporate waste containers outside a facility fits the definition of dumpster diving.
Differentiating physical disposal security breaches from digital attacks.
3
Evaluate web-based targeted infection strategies
Compromising a third-party site known to be visited by targets to deliver malware is a strategic web compromise (watering hole attack).
Distinguishing strategic target compromise from mass phishing.
4
Evaluate domain mistyping attacks
Relying on user typing mistakes to present fake sites is typosquatting.
Connecting URL input errors with spoofing mechanisms.

Anahtar Kavram

Classification of physical and digital social engineering threat vectors
Soru 191Soru →

An IT compliance manager is preparing to decommission a fleet of enterprise laptops containing NVMe Solid State Drives (SSDs) that held sensitive financial data. The assigned technician suggests utilizing an electromagnetic degausser to sanitize the drives prior to sending them off-site for recycling. Which of the following best explains why the compliance manager should reject the technician's proposed method?

Cevabı ve açıklamayı göster

Cevap: Degaussing is ineffective on solid-state drives because data is stored in semiconductor flash memory microchips rather than magnetic media.

Cevap

Degaussing is ineffective on solid-state drives because data is stored in semiconductor flash memory microchips rather than magnetic media.
Degaussing exposes storage media to high-intensity magnetic fields, neutralizing the magnetic alignment of data on hard disk drives (HDDs) and magnetic tapes. Solid State Drives (SSDs) contain non-volatile semiconductor flash memory chips without magnetic components, rendering electromagnetic degaussers completely ineffective for data sanitization.

Adım Adım Çözüm

1
Identify the media type being decommissioned.
The target drives are NVMe Solid State Drives (SSDs), which rely on NAND flash memory storage.
Determining media architecture (solid-state vs. magnetic) is required to choose a valid sanitization method.
2
Analyze the mechanism of the proposed sanitization method (degaussing).
Degaussing uses powerful electromagnetic fields to demagnetize and scramble data on magnetic platters or tapes.
Degaussing relies entirely on magnetic susceptibility to remove data.
3
Evaluate why degaussing fails for the target media.
Flash memory cells store data electronically via electrical charges in floating-gate transistors, not magnetic domains.
Magnetic exposure leaves data on solid-state drives completely intact, requiring alternative methods such as physical shredding, cryptographic erase, or built-in secure purge utilities.

Anahtar Kavram

Data Destruction and Sanitization Compatibility across Storage Media Types
Soru 192Soru →

A field technician is troubleshooting a Windows 11 desktop computer that was flagged for an active Trojan and spyware infection. The technician has already physically disconnected the network cable and turned off Wi-Fi to isolate the host. Which TWO of the following steps should the technician perform NEXT before initiating anti-malware scans and removal tools? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Protection on all local storage volumes.; Boot the system into Safe Mode or an isolated recovery environment.

Cevap

The technician must disable System Protection on all local storage volumes and boot the system into Safe Mode or an isolated recovery environment.
Under the standard CompTIA 7-step malware remediation process, once symptoms are identified and the system is quarantined (isolated from the network), the technician must proceed to disable System Restore (Step 3) to clear infected recovery snapshots. Following this, the technician prepares for remediation (Step 4) by updating scanner definitions and booting into Safe Mode to prevent active malware processes from hooking into system memory.

Adım Adım Çözüm

1
Analyze current progress within the CompTIA 7-Step Malware Remediation Process.
Step 1 (Identify malware) and Step 2 (Quarantine infected system) are complete.
The system was identified as infected and isolated from network connections.
2
Perform Step 3: Disable System Restore in Windows.
System Protection is turned off across all local drives, purging existing restore points.
Prevents malware from hiding in hidden system volume information folders or restoring itself after remediation.
3
Prepare for Step 4: Remediate infected systems by isolating execution context.
The machine is booted into Safe Mode.
Prevents malware persistence mechanisms and active rootkits from executing during scanner installation and execution.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Procedure
Tahmini Süre:2m 0s
Soru 193Soru →

Match each physical security control mechanism on the left with its primary protective objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Access control vestibule
Privacy filter
Vehicle bollard
Cable lock

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Access control vestibule matches with mitigating tailgating via interlocking doors. Privacy filter matches with narrowing screen viewing angles to prevent shoulder surfing. Vehicle bollard matches with preventing vehicular ramming attacks. Cable lock matches with anchoring hardware to immovable fixtures to prevent physical equipment theft.
Each physical security control serves a specific defense objective: access control vestibules prevent tailgating by enforcing single-person entry through interlocking doors; privacy filters block shoulder surfing by narrowing monitor viewing angles; vehicle bollards absorb vehicle impacts to protect building structures; and cable locks physically secure hardware assets to permanent fixtures to prevent physical equipment theft.

Adım Adım Çözüm

1
Identify the primary protective function of an access control vestibule
Access control vestibules utilize dual interlocking doors to allow access to only one person at a time.
This directly mitigates tailgating (piggybacking) by unauthorized personnel into sensitive areas.
2
Identify the primary protective function of a privacy filter
Privacy filters polarize or restrict screen light output to narrow viewing angles.
This prevents visual eavesdropping or shoulder surfing by passersby.
3
Identify the primary protective function of a vehicle bollard
Bollards act as heavy vertical perimeter barriers engineered to withstand kinetic impact.
They protect building entrances and exterior walls from vehicle ramming attacks.
4
Identify the primary protective function of a cable lock
Cable locks secure computing hardware to sturdy, stationary objects.
They inhibit opportunistic physical theft of portable or stationary hardware assets.

Anahtar Kavram

Physical Security Controls
Tahmini Süre:1m 30s
Soru 194Soru →

A cybersecurity technician is resolving a security incident on a corporate endpoint. The technician identified a stealth keylogger infection, isolated the system from the network, disabled System Restore, updated the security software in Safe Mode, and successfully completed malware removal and verification. Which of the following actions must the technician perform next to adhere to the standard CompTIA malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Configure scheduled operating system updates and automated anti-malware scans.

Cevap

Configure scheduled operating system updates and automated anti-malware scans.
According to the standard CompTIA 7-step malware remediation framework, the steps must be performed in exact sequence: 1) Identify symptoms, 2) Quarantine infected system, 3) Disable System Restore, 4) Remediate infected systems (update anti-malware and scan/remove), 5) Schedule updates and run recurring scans, 6) Enable System Restore and create a restore point, 7) Educate the user. Since the scenario completes Step 4 (remediation and removal), the immediate next step required is Step 5 (scheduling updates and recurring scans).

Adım Adım Çözüm

1
Review the completed steps against the CompTIA 7-step malware remediation framework.
Steps 1 (Identify), 2 (Quarantine), 3 (Disable System Restore), and 4 (Remediate/Remove malware) have been performed.
Tracking completed steps identifies where the technician currently sits in the remediation workflow.
2
Identify the mandatory next sequence step following Step 4 (Remediate infected systems).
Step 5 is 'Schedule updates and run recurring scans'.
Scheduling updates and scans ensures continuous protection against recurring or unpatched vulnerabilities before enabling restore capabilities.
3
Select the option representing Step 5.
Configuring scheduled OS updates and automated anti-malware scans is selected.
This matches the exact procedural requirement of Step 5.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Soru 195Soru →

A desktop support specialist is hardening standalone Windows 11 Pro workstations located in a public library environment. To satisfy new compliance mandates, the specialist must ensure that standard account users are completely blocked from attempting privilege elevation, and that administrative users must explicitly type their password on a isolated screen whenever an elevation request occurs. Which TWO of the following policy settings in Local Security Policy (secpol.msc) under Security Options should the specialist configure?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'; Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'

Cevap

The technician must configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' satisfies the requirement to prevent standard users from attempting privilege elevation. Setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop' ensures administrators must enter their full password on an isolated secure desktop screen before privilege elevation is granted.

Adım Adım Çözüm

1
Analyze standard user requirement
Standard users must not be permitted to enter administrator credentials when an elevation prompt occurs.
Setting the standard user elevation policy to 'Automatically deny elevation requests' suppresses credential prompts and rejects unauthorized privilege escalation attempts immediately.
2
Analyze administrator user requirement
Administrative users must be forced to authenticate explicitly on an isolated screen.
Setting administrator behavior in Admin Approval Mode to 'Prompt for credentials on the secure desktop' forces password entry on the secure desktop, preventing malware interference.

Anahtar Kavram

Configuring Local Security Policy (secpol.msc) User Account Control security options for elevation prompt behaviors.
Soru 196Soru →

An IT technician is tasked with decommissioning a batch of enterprise magnetic hard disk drives (HDDs) containing sensitive corporate financial data. Place the administrative and technical steps in the correct chronological order from first to last to ensure compliance with data sanitization standards and chain of custody guidelines.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence is: 1) Log drive serial numbers and complete chain-of-custody forms, 2) Expose magnetic hard drives to high-density degaussing, 3) Transport sanitized drives via secure courier, 4) Perform physical industrial shredding and obtain a Certificate of Destruction, and 5) Update asset records and archive the Certificate of Destruction.
The proper decommission lifecycle requires logging serial numbers to establish chain of custody first, purging magnetic media via degaussing to prevent data exposure in transit, transporting the media securely under custody, executing physical destruction while securing a Certificate of Destruction, and finally closing asset records in the tracking system with attached validation certificates.

Adım Adım Çözüm

1
Establish inventory baseline and documentation.
All drive serial numbers are cataloged with initial chain of custody established.
Proper inventory accounting before physical movement prevents lost or stolen media.
2
Perform local data purge via degaussing.
Magnetic fields on drive platters are completely demagnetized.
Degaussing purges data locally so unencrypted data is not exposed during off-site transportation.
3
Relocate media using tracked chain of custody.
Drives arrive safely at the third-party destruction facility.
Tracked courier services maintain accountability between company premises and vendor facilities.
4
Execute physical destruction and obtain validation.
Drives are shredded into fragments and a Certificate of Destruction is signed.
Physical destruction prevents hardware re-use, and the certificate serves as legal proof of disposal.
5
Finalize corporate inventory logs.
Asset database records drives as destroyed with linked audit documentation.
Completes corporate lifecycle procedures and fulfills compliance audit requirements.

Anahtar Kavram

Chain of Custody and Media Destruction Lifecycle
Tahmini Süre:2m 0s
Soru 197Soru →

A desktop support technician needs to change the User Account Control (UAC) notification level on a standalone Windows 11 computer. In what sequential order should the technician perform the steps to complete this configuration?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is to open the User Account Control settings applet from the Start menu, adjust the notification slider, click OK to submit the changes, and confirm the resulting administrative UAC elevation prompt.
To modify UAC settings in Windows, the technician must first open the configuration interface via Search or Control Panel. Next, the slider is moved to set the desired notification behavior. After setting the slider, clicking OK submits the changes, which triggers an administrative UAC prompt requiring explicit confirmation to save the new policy.

Adım Adım Çözüm

1
Search for and open Change User Account Control settings from the Start menu.
The User Account Control Settings configuration window opens.
Accessing the applet interface is necessary before any settings can be modified.
2
Adjust the vertical slider to the target notification setting.
The desired UAC notification behavior is selected.
The slider defines when Windows notifies the user about application changes.
3
Click the OK button at the bottom of the window.
Windows initiates the process to apply the modified security policy.
Submitting the configuration form triggers the system validation process.
4
Click Yes on the User Account Control authorization prompt.
The new UAC setting is committed to the registry.
System-wide security policy adjustments require explicit administrative approval.

Anahtar Kavram

Configuring User Account Control settings using the Windows GUI
Soru 198Soru →

An IT technician is preparing a batch of retired magnetic hard drives for permanent disposal according to organizational security procedures. Place the hardware decommission and disposal steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: Log asset tags and serial numbers -> Degauss or purge drive data -> Subject drives to physical shredding -> Obtain and archive the Certificate of Destruction.
Proper data disposal protocol requires documenting asset serial numbers first to establish chain of custody. Next, the drives undergo data sanitization (such as degaussing magnetic platters) to ensure confidentiality during handling. The sanitized drives are then physically shredded. Finally, the vendor issues a formal Certificate of Destruction to confirm compliance and finalize the audit trail.

Adım Adım Çözüm

1
Document assets for tracking
Serial numbers and asset tags are logged into the inventory tracking database.
Maintaining chain of custody requires recording asset details before performing any physical processing.
2
Sanitize media content
Magnetic media is degaussed or purged.
Data sanitization protects sensitive corporate information prior to physical movement or third-party handling.
3
Perform physical hardware destruction
Media is physically shredded into unrecoverable fragments.
Physical destruction completes the media disposition process.
4
Collect compliance validation
Signed Certificate of Destruction is received and stored for auditing.
Audit verification occurs only after physical disposal has taken place.

Anahtar Kavram

Hardware Decommissioning and Media Disposal Lifecycle
Soru 199Soru →

An IT technician is investigating a security incident on a graphic designer's workstation. The designer reports that while visiting a popular, reputable industry news forum they browse daily, a malicious script executed in the background and attempted to steal their corporate login credentials. Forensic analysis confirms that attackers compromised the third-party website specifically to target users in the graphic design sector. Which of the following social engineering attacks occurred in this scenario?

Cevabı ve açıklamayı göster

Cevap: Watering hole attack

Cevap

Watering hole attack
A watering hole attack specifically targets a group of users by identifying and infecting a legitimate, trusted website that the group frequently visits. The attacker waits for the targets to visit the compromised site to execute malicious code or harvest credentials.

Adım Adım Çözüm

1
Analyze the attack vector described in the scenario.
The attacker compromised a legitimate, frequently visited industry website rather than directly contacting the user.
Identifying the medium of attack helps distinguish web-based social engineering from direct communications.
2
Evaluate the intent and target group.
The attack specifically aimed at users within a particular industry sector who regularly visit that resource.
Targeting a specific demographic through a common resource site is the defining characteristic of a watering hole attack.
3
Map the observed behavior to standard CompTIA threat classifications.
Compromising a gathering site frequented by target victims matches the definition of a watering hole attack.
This confirms the correct social engineering classification.

Anahtar Kavram

Watering Hole Attack
Soru 200Soru →

An IT technician is preparing to decommission an enterprise storage system containing magnetic backup tapes, traditional magnetic Hard Disk Drives (HDDs), and Solid-State Drives (SSDs). The organization plans to refurbish and resell the SSDs, while the magnetic tapes and HDDs will be rendered completely unreadable before physical disposal. Which TWO of the following statements represent proper data destruction or sanitization practices for these media types?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Degaussing is effective for rendering data unrecoverable on magnetic tapes and HDDs, but it is ineffective for sanitizing SSDs.; Performing an ATA Secure Erase or cryptographic erase is an appropriate sanitization method for SSDs intended for resale.

Cevap

The correct practices are using degaussing for magnetic media (tapes and HDDs) while recognizing its ineffectiveness on SSDs, and executing an ATA Secure Erase or cryptographic erase on SSDs intended for resale.
Degaussing is effective exclusively for magnetic media such as magnetic tapes and traditional hard drives because it disrupts magnetic alignment. Solid-state drives use non-magnetic NAND flash storage, making degaussing ineffective. For SSDs planned for resale, methods such as ATA Secure Erase or cryptographic erase sanitize all NAND cells while maintaining drive usability.

Adım Adım Çözüm

1
Identify the media types and disposition goals in the scenario.
The media includes magnetic tapes and HDDs targeted for destruction, and SSDs designated for refurbishment/resale.
Different storage technologies require specific sanitization and disposal techniques based on whether hardware will be reused or destroyed.
2
Select sanitization methods for hardware intended for resale.
SSDs intended for resale require logical sanitization methods like ATA Secure Erase or cryptographic erase that purge all memory cells without damaging hardware functionality.
Physical destruction or degaussing would render the drive unusable or fail to sanitize flash memory.
3
Evaluate destruction methods for magnetic media.
Magnetic tapes and HDDs can be degaussed using strong magnetic fields, whereas degaussing has no impact on non-magnetic SSD semiconductor chips.
Degaussing disrupts magnetic domains on platters and tapes, whereas SSDs store electrical charges in floating-gate transistors.

Anahtar Kavram

Selecting appropriate data sanitization and destruction techniques based on storage media architecture (magnetic vs. flash) and hardware disposition goals.
ÖncekiSayfa 10 / 23Sonraki