Software Troubleshooting

A Windows workstation running an enterprise database utility experiences frequent '(Not Responding)' freezes followed by sudden application crashes during heavy reporting tasks. Task Manager shows moderate CPU (25%) and Memory (40%) utilization, but overall responsiveness drops significantly during file exports. A technician suspects storage subsystem latency is causing the application timeouts and crashes. Which of the following tools and metrics should the technician inspect FIRST to isolate this storage performance bottleneck?

An IT support technician is troubleshooting a Windows 10 computer that fails to boot following an improper shutdown. Upon starting, the system displays the error message "The Boot Configuration Data for your PC is missing or contains errors. Error code: 0xc000000f." The technician boots into the Windows Recovery Environment (WinRE) Command Prompt and attempts to repair the boot configuration by running `bootrec /rebuildbcd`. The command identifies the `C:\Windows` installation, but when attempting to add it to the boot list, it fails with the error message "The requested system device cannot be found." Further inspection using `diskpart` reveals that the system drive utilizes GUID Partition Table (GPT) formatting with an unlettered FAT32 EFI System Partition (ESP). Which of the following commands should the technician execute NEXT to successfully repair the boot files?

A system administrator is troubleshooting a Windows 11 workstation that experiences random application instability. An elevated Command Prompt session was opened, and the administrator executed `sfc /scannow`. The process completed with the message: "Windows Resource Protection found corrupt files but was unable to fix some of them." Further log analysis reveals that the replacement payload files within the local component store are also corrupted. Which of the following commands should the administrator execute NEXT to repair the component store so that system file integrity can be successfully restored?

A field technician reports that a specialized telemetry logging app on a company-issued Android tablet takes a long time to start up, stutters when loading local data, and consumes excessive background memory. Other system utilities and mobile apps on the tablet perform normally. Which of the following initial, least-invasive troubleshooting steps should the technician take to resolve this issue? (Select TWO.)

A healthcare provider reports that a proprietary patient charting application on an Android tablet frequently becomes unresponsive when displaying high-resolution laboratory results. The technician notes that the tablet has sufficient internal storage space, but the application process remains hung in memory even after navigating back to the main menu. The technician wants to restore app responsiveness using the least invasive method while ensuring local application data and login configurations are preserved. Which of the following actions should the technician perform FIRST?

A field technician's mobile tablet loses access to enterprise network resources after returning from a client site. Network logs show that HTTPS traffic from the device is being intercepted by an unauthorized proxy server, and the device's Mobile Device Management (MDM) agent reports a compliance violation. Further investigation reveals a third-party diagnostic utility was recently sideloaded on the device. Which TWO of the following initial actions should the systems administrator perform to remediate the security breach and restore secure connectivity?

A help desk technician is troubleshooting a Windows 11 enterprise workstation that continuously redirects web requests to malicious advertising sites, frequently exhibits pop-up windows, and reverts proxy settings to a rogue IP address. Place the following remediation steps in the correct order to eliminate the browser hijack and restore secure functionality.

During a routine compliance audit, an enterprise mobility administrator discovers that a managed mobile device has been installed with an unauthorized third-party configuration payload containing a rogue Certificate Authority (CA) root certificate. This has resulted in man-in-the-middle certificate warnings whenever the user accesses internal HTTPS sites. Which of the following actions should the administrator take FIRST to mitigate this security risk?

A remote employee reports that while working in a public venue, their corporate-managed smartphone automatically connected to an open Wi-Fi hotspot broadcasting a SSID identical to their office network. Shortly after, corporate email syncing failed, and the device displayed continuous background location tracking activity. Upon inspection, an IT technician suspects a rogue access point attack compromised the device by installing a malicious management payload. Which TWO of the following actions should the technician perform immediately to remediate the security breach and restore secure operation?

A restaurant server reports that the primary point-of-sale (POS) order-entry application on an Android handheld device becomes increasingly sluggish and slow to register touch inputs after several hours of active deployment during a shift. The tablet's operating system navigation and all other built-in utilities continue to perform normally. Which of the following actions should the technician perform FIRST to address this performance issue with the least operational disruption?

A corporate site manager reports that a specialized blueprint annotation application on an enterprise Android tablet frequently freezes and becomes unresponsive after several hours of continuous site inspections. The technician confirms that available device storage is sufficient and all other mobile applications are operating smoothly. According to standard mobile OS troubleshooting methodology, which of the following actions should the technician perform FIRST using the least invasive approach?

An enterprise employee reports receiving continuous, realistic Windows system pop-up alerts warning of severe virus infections and prompting them to call an unauthorized helpline. The technician observes that these pop-ups originate from the desktop Notification Center even when no web browser windows are actively open. A detailed review of running processes, startup items, and scheduled tasks reveals no malicious executables. Which of the following troubleshooting actions should the technician perform to permanently stop these pop-up alerts?

An employee reports that after downloading a third-party battery optimization utility from an unverified website onto their corporate Android device, the phone frequently displays persistent overlay advertisements and battery drain. When the technician attempts to uninstall the application via the standard Application Manager, the Uninstall button is grayed out. Which of the following is the BEST initial action to revoke the application's elevated permissions and allow standard uninstallation?

A tier-2 desktop support technician is investigating a Windows 11 workstation where users report persistent pop-up advertisement redirects. While auditing the browser environment, the technician removes a rogue browser add-on, but finds that a local HTTP proxy setting pointing to address $127.0.0.1:8080$ automatically reinstates itself in the system network settings every time the computer restarts. Which of the following actions should the technician perform NEXT to permanently resolve the redirect issue?

A IT support technician is troubleshooting a user's workstation where opening any website in the primary web browser results in immediate redirection to an ad-heavy third-party search engine. During initial investigation, the technician finds an unrecognized browser extension running and discovers that the system's local network settings have been changed to direct HTTP traffic through a suspicious external port. Which of the following actions should the technician perform to resolve the browser redirection and restore proper internet routing? (Select TWO.)

A technician resolves a browser hijacking issue on a user's computer by clearing browser settings, resetting the default search engine, and removing unauthorized extensions. However, as soon as the user restarts the computer and launches the web browser, the search engine and homepage immediately revert back to the malicious redirection site. Which of the following is the MOST likely cause of the persistent browser modification?

A systems administrator is responding to an alert on a standalone Windows point-of-sale terminal that is exhibiting unauthorized background network connections and altered registry run keys. The administrator has verified the malware infection and immediately unplugged the network cable to isolate the workstation. According to CompTIA's standard 7-step malware removal procedures, which of the following actions should the administrator perform NEXT?

An IT technician on an offshore logistics terminal is servicing a dedicated cargo-manifest workstation that is infected with persistent ransomware and trojan spyware. The technician has already identified the symptoms and isolated the infected machine from the local area network and wireless access points. According to the CompTIA 7-step malware removal process, which of the following actions must the technician perform NEXT before running a full system scan to remediate the infected endpoint? (Select TWO.)

A corporate workstation running Windows 11 experiences malicious web search redirects and untrusted SSL certificate warnings across all installed web browsers (Google Chrome, Microsoft Edge, and Mozilla Firefox). A technician notices that all HTTP and HTTPS traffic is being routed through an unfamiliar local IP address on port 8080 regardless of which browser is opened. Which of the following actions should the technician perform FIRST to stop the system-wide traffic redirection?

A systems administrator at an automated distribution facility notices that a Windows-based picking console is periodically dropping local service responses, running unprompted background tasks, and generating unauthorized outbound connections. The administrator confirms a malware infection and immediately quarantines the console by disconnecting its Ethernet cable and turning off all wireless radios. According to CompTIA's standard 7-step malware removal procedures, which of the following actions should the administrator perform NEXT?