Examkin

Security

442 soru

Tüm türler442Çoktan seçmeli224Çoklu seçim94Eşleştirme71Sıralama53
Soru 381Soru →

A helpdesk technician at an architectural design studio is remediating a Windows 11 rendering workstation infected with persistent adware and unauthorized browser extensions. The technician has isolated the system from the network, disabled System Restore, updated the anti-malware signatures, and successfully removed all malicious files during a scan in Safe Mode. Which of the following procedures should the technician perform NEXT to follow the standard CompTIA 7-step malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Schedule automatic anti-malware updates and recurring system scans.

Cevap

The technician should schedule automatic anti-malware updates and recurring system scans.
The standard CompTIA 7-step malware remediation workflow proceeds as follows: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan/remove), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the technician has just finished Step 4 (updating signatures and removing threat files in Safe Mode), the mandatory next step is Step 5: scheduling automatic updates and recurring scans.

Adım Adım Çözüm

1
Identify the completed steps in the CompTIA 7-step malware remediation process.
The technician has completed Step 1 (Identify symptoms), Step 2 (Quarantine system), Step 3 (Disable System Restore), and Step 4 (Remediate system by updating definitions and scanning/removing malware).
Determining the current phase of remediation establishes where the technician is in the mandatory protocol.
2
Determine the next sequential step following Step 4 (Remediate infected systems).
Step 5 in the CompTIA 7-step process is 'Schedule updates and run scans'.
Automating recurring scans and updates ensures ongoing protection against recurring threats before restoring operational features like System Restore.
3
Select the option matching Step 5.
Scheduling automatic anti-malware updates and recurring scans directly corresponds to Step 5.
This action adheres to the strict sequence established by CompTIA security standards.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process Sequence
Tahmini Süre:1m 15s
Soru 382Soru →

A systems administrator is configuring Windows local group security baseline controls across newly deployed workstations. Match each workstation hardening policy control on the left to its corresponding primary risk mitigation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Account Lockout Threshold Policy
Disabling Unused Network Ports and Services
Screen Lock Timeout with Re-authentication
Disabling AutoPlay and AutoRun features

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Account Lockout Threshold Policy matches automated brute-force mitigation; Disabling Unused Network Ports and Services matches attack surface reduction of network channels; Screen Lock Timeout matches prevention of unattended physical access; Disabling AutoPlay/AutoRun matches prevention of automatic executable launching from removable storage.
Each workstation hardening policy directly addresses a distinct attack vector: account lockout limits online password cracking, service/port disabling removes latent attack surface, screen locking secures unattended physical hardware, and disabling AutoPlay blocks weaponized removable media.

Adım Adım Çözüm

1
Analyze each security hardening baseline control
Identified four standard CompTIA A+ Security domain workstation hardening techniques.
Security baseline hardening controls target specific threat vectors across physical, network, system, and media domains.
2
Correlate each control to its primary risk reduction mechanism
Account lockout protects credentials, service disabling protects listening endpoints, screen timeout protects physical sessions, and AutoPlay disabling protects against malicious media execution.
Proper matching requires understanding defense-in-depth principles for local OS configuration.

Anahtar Kavram

Workstation Hardening & Risk Mitigation Alignment
Soru 383Soru →

A desktop technician at a municipal water treatment facility is remediating a Windows 11 workstation used for SCADA oversight that has been infected with persistent adware and unauthorized browser redirects. The technician has already verified the malware symptoms and quarantined the computer from the network. According to the standard CompTIA 7-step malware remediation workflow, which TWO of the following actions should the technician perform NEXT prior to running a full anti-malware scan?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable System Restore in Windows configuration settings.; Update the anti-malware signature definitions and scanning engine.

Cevap

The technician should disable System Restore in Windows settings and update the anti-malware signature definitions.
Following quarantine (Step 2), the technician must proceed sequentially to Step 3 (Disable System Restore) and Step 4a (Update anti-malware definitions). Disabling restore points ensures malware cannot hide within volume shadow copies, and updating definitions ensures the anti-malware engine can recognize the specific adware and browser hijacking components during the subsequent scan.

Adım Adım Çözüm

1
Identify current progress in the CompTIA 7-step malware remediation procedure.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine infected systems) have already been completed.
Determining the current phase establishes what immediate remediation actions are required.
2
Select Step 3 of the malware remediation procedure.
System Restore must be disabled.
Disabling System Restore prevents clean restore points from being contaminated and prevents infected restore points from reinfecting the system.
3
Select Step 4a of the remediation process before running the scan.
Update the anti-malware software and definition files.
Up-to-date signature files ensure maximum threat detection coverage during the subsequent full system scan (Step 4b).

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Tahmini Süre:1m 30s
Soru 384Soru →

A network technician is installing smart environmental monitoring sensors throughout a corporate data center. These embedded IoT devices run a lightweight, proprietary firmware that cannot support endpoint security software or Mobile Device Management (MDM) agent enrollment. Which of the following strategies best secures these embedded devices against unauthorized access while protecting the internal network?

Cevabı ve açıklamayı göster

Cevap: Place the embedded sensors on a dedicated, logically isolated VLAN with restricted firewall rules.

Cevap

Placing the embedded sensors on a dedicated, logically isolated VLAN with restricted firewall rules is the best security approach.
Embedded systems and IoT devices frequently run restricted or proprietary operating systems that cannot support agent-based endpoint security software or MDM management. The industry standard approach for securing these devices is network segmentation (such as placing them on a dedicated VLAN) paired with restrictive firewall access control lists (ACLs) to ensure they cannot initiate unauthorized communication with internal corporate assets.

Adım Adım Çözüm

1
Identify constraints of embedded IoT devices.
Recognize that these devices run specialized firmware unable to support standard MDM agents, antivirus software, or active endpoint management.
Embedded systems often have limited computing resources and non-standard operating systems.
2
Evaluate risk mitigation controls for unmanaged endpoints.
Determine that compensating network security controls, such as micro-segmentation and strict access control lists (ACLs), must be used.
Logical isolation limits the blast radius if an unmanaged embedded system is targeted or compromised.
3
Select the appropriate network isolation technique.
Assign the IoT devices to a separate virtual local area network (VLAN) isolated from production workstations and server subnets.
A separate VLAN enforces traffic restriction at the network boundary.

Anahtar Kavram

Embedded System Security & Network Isolation
Soru 385Soru →

A desktop technician is implementing security hardening baseline policies on several standalone Windows workstations used by temporary contractors in a corporate office. The workstations must automatically secure active user sessions during periods of inactivity and restrict unauthorized local administrative capabilities. Which of the following security configurations best achieves these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a password-protected screen saver timeout after 5 minutes of inactivity and disable the built-in Guest account.

Cevap

Configure a password-protected screen saver timeout after 5 minutes of inactivity and disable the built-in Guest account.
Enforcing a screen lock with a short inactivity timeout and requiring authentication upon resume prevents unauthorized personnel from hijacking an open session. Disabling unused built-in accounts, such as the Guest account, directly aligns with CompTIA security best practices for reducing the workstation attack surface.

Adım Adım Çözüm

1
Identify the primary security requirements for workstation hardening in the scenario.
Requirements are preventing unauthorized access to unattended active sessions and disabling unused default account attack vectors.
Hardening best practices require session lock controls and attack surface reduction.
2
Evaluate operating system security settings that enforce session protection.
Configuring a short screen lock/screensaver timeout requiring password re-entry ensures that inactive desktops lock automatically.
This mitigates unauthorized physical interaction when a user leaves their desk.
3
Evaluate local account hardening controls.
Disabling built-in accounts such as the Guest account prevents anonymous access.
Default and unneeded accounts should always be disabled to minimize local vulnerability paths.

Anahtar Kavram

Workstation Hardening Baselines and Account Hygiene
Tahmini Süre:1m 15s
Soru 386Soru →

An IT security technician is establishing mobile endpoint policies for corporate-issued smartphones used by remote staff. Which TWO of the following configurations should the technician enforce via Mobile Device Management (MDM) to protect stored sensitive data in the event of theft and prevent the execution of unvetted third-party software?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable storage encryption and remote wipe capabilities; Disable application sideloading and restrict installation to trusted enterprise repositories

Cevap

The technician should enable storage encryption with remote wipe capabilities and disable application sideloading to restrict installations to trusted repositories.
Enabling full storage encryption protects confidential data stored on mobile devices if stolen, while remote wipe allows security teams to erase data over the air. Restricting app installations by disabling sideloading ensures users cannot install potentially malicious unverified third-party software.

Adım Adım Çözüm

1
Identify the protection requirement for lost or stolen hardware.
Full device storage encryption ensures data cannot be read offline, and remote wipe allows administrators to erase device contents upon theft.
Addressing data loss due to physical theft requires cryptographic protection at rest and remote sanitization capabilities.
2
Identify the protection requirement for preventing unvetted application execution.
Disabling sideloading ensures devices only install software signed and verified by approved app stores or enterprise repositories.
Unvetted applications installed from untrusted sources often bypass vendor malware checks and introduce malicious payloads.

Anahtar Kavram

Mobile Device Management (MDM) Security Controls and Application Hardening
Tahmini Süre:1m 15s
Soru 387Soru →

A desktop technician at an autonomous agricultural equipment monitoring facility is remediating a Windows 11 workstation infected with rogue adware and tracking spyware. The technician has already identified the malware symptoms on the system. Place the following remediation steps in the correct order to resolve the incident according to CompTIA best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of remediation steps is: 1) Disconnect the infected workstation from the network, 2) Disable Windows System Restore, 3) Update anti-malware signatures and execute a full scan, 4) Re-enable Windows System Restore and create a new restore point, 5) Conduct security awareness training with the operator.
The standard CompTIA 7-step malware removal process must be performed in exact sequence: (1) Identify malware symptoms, (2) Quarantine infected systems, (3) Disable System Restore, (4) Remediate infected systems (update definitions then scan/use removal tools), (5) Schedule updates and scans, (6) Enable System Restore and create a restore point, and (7) Educate the end user. Following this sequence isolates the threat early, prevents malware persistence in recovery points, cleans the system thoroughly, re-establishes protection baselines, and mitigates future occurrences.

Adım Adım Çözüm

1
Isolate the infected host from the network environment.
Network communication is halted, preventing potential lateral movement or data exfiltration.
CompTIA Step 2 requires quarantining the system immediately after symptom identification.
2
Turn off Windows System Restore.
Existing restore points containing malicious files are cleared and no new corrupted snapshots are saved.
CompTIA Step 3 ensures that infected state data is not archived into backup restore points.
3
Update malware definitions and execute a comprehensive system scan.
The malware is detected using the latest signatures and safely purged from disk and memory.
CompTIA Step 4 dictates updating definition files first, followed by scanning and remediation.
4
Enable System Restore and generate a fresh restore point.
A clean recovery baseline is created for the fully remediated operating system.
CompTIA Step 6 restores rollback capability only after verifying the system is entirely clean.
5
Provide threat awareness training to the primary user.
The user learns best practices to prevent similar malicious software infections in the future.
CompTIA Step 7 completes the process by educating the user to minimize future risk.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Soru 388Soru →

An IT security technician is auditing embedded smart security cameras mounted around a company perimeter. The audit indicates that the devices broadcast their network services automatically using Universal Plug and Play (UPnP) and accept remote administrative connections over unencrypted HTTP. Which of the following is the best remediation measure to secure these embedded IoT devices?

Cevabı ve açıklamayı göster

Cevap: Disable UPnP on the devices, isolate them on a dedicated IoT network segment, and enforce HTTPS for administrative connections.

Cevap

Disable UPnP on the devices, isolate them on a dedicated IoT network segment, and enforce HTTPS for administrative connections.
The correct answer addresses the specific vulnerabilities identified in the audit. Embedded IoT devices require attack surface reduction (disabling unneeded services like UPnP), encryption of management channels (HTTPS), and logical isolation (dedicated IoT VLAN) to prevent lateral movement across the internal corporate network.

Adım Adım Çözüm

1
Identify vulnerabilities in the embedded camera setup.
Discovered exposed UPnP discovery services and cleartext HTTP administration channels.
Embedded IoT devices often ship with risky convenience features enabled by default.
2
Apply embedded system hardening controls.
Disable UPnP to block unauthorized network discovery, restrict management traffic to HTTPS, and isolate devices on a segmented VLAN.
Minimizes the attack surface and prevents unauthorized network traversal if a single camera is compromised.

Anahtar Kavram

Embedded System and IoT Security Hardening
Soru 389Soru →

An IT support specialist is hardening newly deployed desktop computers in a corporate training center accessible to visiting contractors and temporary staff. To enforce account security best practices and minimize the local attack surface on these endpoints, which of the following actions should the technician take?

Cevabı ve açıklamayı göster

Cevap: Disable the built-in Guest account and rename the default local Administrator account while creating unique maintenance accounts.

Cevap

Disable the built-in Guest account and rename the default local Administrator account while creating unique maintenance accounts.
Disabling default accounts such as Guest and securing built-in Administrator accounts is a fundamental OS hardening baseline step that removes predictable targets for credential attacks.

Adım Adım Çözüm

1
Identify the security requirement for endpoint account hardening.
Recognize that default accounts present a known target for unauthorized access.
Hardening best practices require reducing the attack surface by eliminating default or unnecessary accounts.
2
Evaluate account management controls.
Disabling the Guest account and renaming the default Administrator account neutralizes common brute-force target names.
Attackers frequently attempt automated login attacks using standard default account names like 'Guest' or 'Administrator'.

Anahtar Kavram

Workstation Hardening Account Baselines
Soru 390Soru →

An IT technician is tasked with performing baseline workstation hardening on a newly deployed Windows system before issuing it to an employee. In which sequential order should the technician perform these hardening steps to establish proper security controls from account access to session security?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct procedural order is: first, disable the built-in Guest account and rename the default Administrator account; second, configure local password complexity and account lockout policies; third, disable AutoRun and AutoPlay for external media; and fourth, enable a screen lock timeout requiring a password on resume.
The correct order follows standard baseline security principles: eliminating high-risk default account exposure first, establishing robust user authentication rules second, restricting dangerous system automation (AutoRun/AutoPlay) third, and finalizing local physical session security (screen lock timeouts) fourth.

Adım Adım Çözüm

1
Address account vulnerabilities by disabling the Guest account and renaming the default Administrator account.
Known default account vectors are closed, preventing unauthorized privilege escalation.
Securing default credentials must occur before enabling broader account governance policies.
2
Define password complexity and lockout policies in Local Security Policy.
User authentication rules are hardened against dictionary and brute-force attempts.
Password and lockout baselines enforce credential strength for all created user profiles.
3
Configure Local Group Policy to disable AutoRun and AutoPlay.
Automatic background execution from connected USB or optical media is suppressed.
Restricting peripheral execution protects the system from drive-by hardware infection.
4
Set the screen saver timeout and enforce password protection upon waking.
Active user sessions lock automatically during periods of inactivity.
Session protection prevents unauthorized physical access when an authorized user steps away.

Anahtar Kavram

Workstation Baseline Hardening Sequence
Soru 391Soru →

An IT support specialist at a solar power generation monitoring facility is remediating a Windows 11 workstation infected with rogue spyware. The specialist has already identified the malware symptoms, disconnected the system from the network to isolate it, and disabled System Restore in Windows. According to the standard CompTIA 7-step malware remediation process, which of the following actions should the specialist perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware software signature definitions using an offline update package.

Cevap

Update the anti-malware software signature definitions using an offline update package.
According to CompTIA's official 7-step malware remediation process, once the system is quarantined (Step 2) and System Restore is disabled (Step 3), the technician must remediate the infected system (Step 4). The first part of remediation (Step 4a) is updating the anti-malware software signature files and engine. Because the system was isolated from the network during quarantine, deploying updated definitions via offline media is necessary before launching remediation scans (Step 4b).

Adım Adım Çözüm

1
Review the CompTIA 7-step malware remediation framework order.
The steps are: 1. Identify symptoms, 2. Quarantine, 3. Disable System Restore, 4. Remediate (a. Update definitions, b. Scan/remove), 5. Schedule scans/updates, 6. Enable System Restore & create restore point, 7. Educate user.
CompTIA strictly enforces this sequential methodology.
2
Identify the current progress established in the scenario stem.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) have already been completed.
The next action must be Step 4a: Update the anti-malware signatures/engine.
3
Select the option corresponding to Step 4a.
Updating anti-malware signatures using an offline update package is the immediate required step.
Because the machine is quarantined from the network, definition updates must be installed via offline media before scanning.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Best Practices
Tahmini Süre:1m 0s
Soru 392Soru →

An IT security administrator is updating the enterprise Mobile Device Management (MDM) baseline for corporate endpoints and field devices. Match each mobile security control on the left with its primary security objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Containerization
Geofencing
Sideloading restriction
Remote wipe

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Containerization matches isolating corporate data into encrypted logical storage spaces. Geofencing matches enforcing context-aware security profiles based on physical location. Sideloading restriction matches preventing installation of unverified software binaries. Remote wipe matches sanitizing storage and returning endpoints to factory defaults.
Each security control targets a distinct endpoint protection layer: containerization isolates corporate data partitions on mobile devices; geofencing adjusts device behavior using physical boundaries; sideloading restrictions mitigate untrusted application installations; and remote wipe protects data on missing hardware by wiping local storage.

Adım Adım Çözüm

1
Identify the purpose of Containerization
Matches isolating corporate data into an encrypted logical storage space
Containerization creates a secure virtual compartment on mobile endpoints to prevent data leakage between personal and business applications.
2
Identify the purpose of Geofencing
Matches enforcing context-aware security profiles based on physical location
Geofencing establishes virtual geographic boundaries to trigger security controls, such as disabling camera features inside secure facilities.
3
Identify the purpose of Sideloading restriction
Matches preventing the installation of unverified software binaries
Disabling application sideloading mitigates malware exposure by restricting installation sources exclusively to enterprise-managed repositories or official stores.
4
Identify the purpose of Remote wipe
Matches sanitizing storage and returning an endpoint to factory defaults
Remote wipe commands ensure that compromised or stolen devices are completely cleared of sensitive organizational assets.

Anahtar Kavram

Mobile Device Security Controls and Management Features
Soru 393Soru →

A security technician is configuring operating system baseline settings for a workstation that will be deployed to a high-security research facility. The workstation must adhere to the principle of least functionality by reducing unnecessary network-facing vulnerabilities before network placement. Which of the following workstation hardening practices directly accomplishes this objective?

Cevabı ve açıklamayı göster

Cevap: Disabling unneeded background services and unrequired OS features to minimize the system attack surface.

Cevap

Disabling unneeded background services and unrequired OS features to minimize the system attack surface.
Disabling unnecessary background OS services, applications, and ports directly implements system hardening by enforcing the principle of least functionality. Reducing running components minimizes the potential attack surface available to unauthorized network actors.

Adım Adım Çözüm

1
Analyze the scenario requirements.
Identified the need to enforce the principle of least functionality and reduce network attack vectors on a new workstation.
Workstation hardening mandates turning off default features, open ports, and services that are not strictly necessary for system operation.
2
Evaluate the technical effectiveness of each security control.
Turning off unused background services closes listening ports and removes unnecessary software execution paths.
Every active service represents a potential entry point for exploits if unpatched or misconfigured.

Anahtar Kavram

Workstation Hardening via Service Reduction
Tahmini Süre:1m 15s
Soru 394Soru →

A desktop technician at a live broadcast news production studio is responding to a malware incident on a Windows 11 workstation. The machine was disconnected from the local network after pop-ups and unusual background network traffic were detected. The technician has confirmed the presence of rogue spyware and has already disabled System Restore on the machine. Which TWO actions should the technician perform NEXT to adhere to the CompTIA 7-step malware remediation process? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the local anti-malware software engine and definition signatures using an offline installation package; Perform a full system scan in Safe Mode using specialized anti-malware removal tools

Cevap

Updating the anti-malware software and definition signatures offline, followed by performing a full system scan in Safe Mode using dedicated removal tools.
According to the CompTIA 7-step malware remediation process, once the technician has identified the symptoms (Step 1), quarantined the system (Step 2), and disabled System Restore (Step 3), the next phase is Step 4: Remediate the infected system. This phase consists of two parts: first updating anti-malware software and signature definitions (Step 4a), and second using scanning and removal techniques such as Safe Mode or pre-boot environments (Step 4b). Updating definitions offline ensures the quarantined system gets the latest signatures without reconnecting to the network.

Adım Adım Çözüm

1
Review the current progress in the 7-step remediation workflow
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) are already completed.
Determines the exact position in the standard procedure.
2
Identify the sub-steps of Step 4: Remediate Infected Systems
Step 4a requires updating signatures/definitions (via offline media since the host is quarantined), and Step 4b requires scanning and removing infected files.
Remediation cannot effectively eradicate threats without up-to-date threat signatures and execution in an isolated state like Safe Mode.
3
Select the correct actions matching Step 4a and Step 4b
Updating definitions offline and running a scan in Safe Mode are selected as the immediate next steps.
Subsequent steps like scheduling scans (Step 5), re-enabling System Restore (Step 6), and end-user education (Step 7) must wait until remediation succeeds.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process (Step 4: Remediate Infected Systems)
Soru 395Soru →

An organization permits employees to access corporate email and proprietary internal applications on their personal mobile devices under a Bring Your Own Device (BYOD) policy. The IT security administrator must ensure that corporate data can be erased remotely if a device is lost or an employee departs, without destroying the employee's personal photos and files. Which of the following security controls BEST fulfills this requirement?

Cevabı ve açıklamayı göster

Cevap: Containerization

Cevap

Containerization separates corporate data from personal data on mobile devices, allowing administrators to execute a selective wipe of business information while leaving personal files intact.
Containerization establishes an isolated, encrypted environment on personal devices specifically for corporate data and applications. Through MDM/MAM administration, IT teams can issue a selective wipe command that removes only the corporate container and its encrypted keys, preserving the user's personal media, personal apps, and configuration settings.

Adım Adım Çözüm

1
Analyze the administrative goal and constraints
The administrator must enable remote wiping of corporate data on BYOD endpoints while preserving employee personal data.
BYOD security policies require balancing corporate data protection with employee privacy.
2
Evaluate technical features of mobile security controls
Containerization creates a logically separated, encrypted compartment for enterprise apps and storage on the smartphone.
This logical boundary allows Mobile Device Management (MDM) or Mobile Application Management (MAM) software to issue a selective wipe target limited strictly to the corporate container.
3
Select the optimal control
Containerization directly satisfies the requirement for selective data erasure.
Other options either perform an all-or-nothing factory reset or focus on unrelated physical and network transport security.

Anahtar Kavram

BYOD Security Controls and Mobile Containerization
Soru 396Soru →

A desktop technician at an online retail fulfillment center is troubleshooting a Windows 11 workstation. The machine was isolated from the network after an employee reported rogue browser pop-ups and unauthorized system settings changes. The technician has verified the malware symptoms, quarantined the workstation, and disabled System Restore. Which of the following is the NEXT step the technician should perform according to the standard CompTIA malware remediation process?

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware software and signature definition files.

Cevap

Update the anti-malware software and signature definition files.
According to the CompTIA 7-step malware remediation process, once System Restore has been disabled (Step 3), the technician must begin remediation (Step 4). Remediation specifically requires updating anti-malware software and definition files (Step 4a) before executing full system scans and removal techniques (Step 4b).

Adım Adım Çözüm

1
Review the CompTIA 7-step malware remediation process sequence.
Process order: 1. Identify symptoms, 2. Quarantine, 3. Disable System Restore, 4. Remediate (a. Update anti-malware, b. Scan/remove), 5. Schedule updates/scans, 6. Enable System Restore & create restore point, 7. Educate user.
CompTIA standards mandate a strict sequence to ensure complete malware eradication.
2
Identify current progress in the scenario.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) are already complete.
Determines the precise entry point into the remediation workflow.
3
Determine the mandatory next sub-step.
Sub-step 4a is updating the anti-malware software and signature definition files prior to scanning (4b).
Updating definitions ensures the scanner has the newest threat signatures to detect and remove the active infection effectively.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process
Tahmini Süre:1m 15s
Soru 397Soru →

A desktop technician is establishing baseline security settings for standalone Windows laptops issued to remote sales personnel. The technician must ensure that the laptops automatically lock when left unattended and that malicious code cannot execute automatically when a USB drive is plugged in. Which of the following actions should the technician perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable AutoPlay and AutoRun features for all removable storage media.; Configure screen saver timeout settings and enforce password re-authentication on resume.

Cevap

The technician should disable AutoPlay and AutoRun features for all removable media and configure screen saver timeout settings requiring password re-authentication on resume.
Disabling AutoPlay and AutoRun mitigates risks associated with malicious flash drives by stopping automatic file execution. Configuring a screen saver timeout with password protection guarantees that unattended systems lock automatically, satisfying local physical security hardening baselines.

Adım Adım Çözüm

1
Address the requirement to prevent automatic execution of software from USB devices.
Disabling AutoPlay and AutoRun ensures inserted drives will not execute commands automatically without user interaction.
AutoRun and AutoPlay policies serve as primary hardening defenses against USB-borne malware vectors.
2
Address the requirement to prevent physical access to unattended workstations.
Configuring a short screen saver timeout that requires a password upon resume locks the operating system session.
Screen saver locking protects local confidentiality if an employee leaves their device unattended in a public or remote environment.

Anahtar Kavram

Workstation Security Baselines and Removable Media Policies
Soru 398Soru →

An IT technician working at a logistics corporate headquarters is remediating a Windows workstation infected with rogue antivirus software. The technician has already identified the symptoms, isolated the machine from the network, and disabled System Restore. Which of the following actions should the technician perform NEXT before launching a full system anti-malware scan?

Cevabı ve açıklamayı göster

Cevap: Update the anti-malware engine and signature definitions using an isolated media device.

Cevap

The technician should update the anti-malware engine and definition files prior to performing a full system scan.
According to the CompTIA 7-step malware remediation process, Step 4 is 'Remediate infected systems', which consists of two sequential parts: sub-step 4a (Update anti-malware software and definitions) followed by sub-step 4b (Scan and use removal techniques). Since the workstation is isolated from the network, definitions must be updated via external out-of-band media before initiating the scan.

Adım Adım Çözüm

1
Analyze the current state within the CompTIA 7-step malware remediation process.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) have already been completed.
Determines the appropriate next sequential remediation action required.
2
Identify the sub-components of Step 4 (Remediate the infected systems).
Sub-step 4a is updating anti-malware software/signatures, and sub-step 4b is scanning and executing removal techniques.
Antivirus software cannot effectively detect or clean current threat signatures unless updated first.
3
Select the correct action matching Step 4a.
Updating anti-malware definitions using isolated/out-of-band media (since the system is disconnected from the network).
Ensures the scanner has the latest detection patterns before scanning.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process Order
Soru 399Soru →

A systems administrator is provisioning standalone Android-based digital signage kiosks deployed in public transit stations. The administrator needs to protect these embedded endpoints against unauthorized software installation, interface tampering, and OS-level access by members of the public. Which TWO of the following security configurations should be implemented to best harden these devices?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce application whitelisting and enable a single-app kiosk mode profile to restrict navigation.; Disable hardware interface options such as USB debugging and restrict firmware access with administrative credentials.

Cevap

The administrator should enforce application whitelisting with kiosk mode and disable USB debugging while securing firmware access.
Hardening embedded kiosks requires restricting the software layer through application whitelisting and kiosk mode profiles, alongside locking down physical debugging interfaces like USB debugging and securing bootloader/firmware settings.

Adım Adım Çözüm

1
Identify software restrictions required for public-facing embedded kiosks.
Configuring single-app kiosk mode combined with application whitelisting ensures users cannot leave the designated app interface or run unapproved software.
Public terminals are highly vulnerable to unauthorized software installation and operating system navigation.
2
Identify physical and hardware interface hardening measures.
Disabling USB debugging and protecting firmware modifications prevents physical access exploits via external media or debug connections.
Physical access to exposed ports like USB can allow attackers to bypass software controls if debugging interfaces remain active.

Anahtar Kavram

Embedded System and Kiosk Device Hardening Controls
Soru 400Soru →

A technician is responding to a malware incident on a workstation at a community medical clinic. The system is showing pop-up warnings and redirecting browser traffic. Place the following remediation actions in the correct sequential order according to the standard CompTIA 7-step malware removal process.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order follows the standard CompTIA 7-step malware removal methodology: 1) Quarantine the infected system, 2) Disable System Restore, 3) Update anti-malware signatures and scan, 4) Re-enable System Restore and create a restore point, and 5) Educate the end user.
The CompTIA standard 7-step malware removal process follows a specific logical sequence: 1) Identify symptoms, 2) Quarantine system, 3) Disable System Restore, 4) Remediate infected systems (update definitions and scan), 5) Schedule updates and scans, 6) Enable System Restore and create restore point, and 7) Educate end user. The items provided map directly to steps 2, 3, 4, 6, and 7 in exact chronological order.

Adım Adım Çözüm

1
Isolate the compromised system from the local environment.
Network communication is terminated, preventing malware spread.
Quarantine (Step 2) must occur before modifying system settings or performing scans.
2
Disable System Restore.
Existing restore points containing malicious files are cleared and new automatic restore points are suspended.
Disabling System Restore (Step 3) ensures malware cannot persist in Windows system restore points.
3
Remediate the infected system.
Anti-malware signatures are updated and malicious payloads are detected and removed.
Updating definitions and scanning (Step 4) removes the active infection from the machine.
4
Re-enable System Restore and create a clean restore point.
System protection is restored using a clean state baseline.
Re-enabling System Restore (Step 6) guarantees future recovery options without reintroducing cleared malware.
5
Conduct end-user training.
The user is informed about security best practices.
End-user education (Step 7) completes the workflow to help prevent future infections.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process
ÖncekiSayfa 20 / 23Sonraki
Security Alıştırma Soruları — CompTIA A+ (Core 1 & Core 2) — Sayfa 20 | Examkin