CompTIA A+ Core 2 Practice Test Flashcards
1
Q
Over the day, a user’s computer becomes slow. Then pop-ups start to appear randomly. Later on, the pop-ups become more frequent, and the user notices that internet searchers are using Google when their default search provider is in Firefox. Once the computer starts crashing repeatedly, the user calls for help. Considering all of these data points, what is the best diagnosis of the problem?
A
All of the symptoms listed in this scenario are common to adware and spyware. Another symptom is redirection, where a user tries to open one page but gets sent to another.
2
Q
Ransomware
A
The goal of ransomware is extortion. Ransomware encrypts files to shut down access to data until payment is made.
3
Q
DNS server is corrupted and is mapping domain names to the wrong IP addresses.
A
A DNS server mapping domain names to the wrong IP addresses is an example of a redirection attack, where a user is redirected to a malicious site. It does not generate the other symptoms.
4
Q
HOSTS file is corrupted and is mapping domain names to the wrong IP addresses.
A
HOSTS is a legacy means of mapping domain names and IP addresses. If corrupted and incorrectly mapped, it is a redirection attack, and the other symptoms do not occur.
5
Q
A server administrator wants to run the latest technologies. What technology should the administrator start using which will replace the New Technology File System (NTFS)?
A
Resilient File System (ReFS) is being developed to replace NTFS. ReFS is only available for Pro for Workstations and Enterprise editions and cannot currently be used for the boot volume.
6
Q
ext3
A
Most Linux distributions use some version of the extended (ext) file system to format partitions on mass storage devices. ext3 is a 64-bit file system with journaling support.
7
Q
APFS
A
Where Windows uses NTFS and Linux typically uses ext3 or ext4, Apple Mac workstations and laptops use the proprietary Apple File System (APFS).
8
Q
exFAT
A
exFAT is a 64-bit version of FAT designed for use with removable hard drives and flash media.
9
Q
What uses domain names of components loading on the web page against a vast blacklist?
A
Ad blockers use more sophisticated techniques to prevent displaying anything that does not seem to be part of the site’s main content or functionality.
10
Q
Clearing browsing data
A
Clearing browsing data options are used to delete browsing history. The user can have the browser do this automatically or do it manually.
11
Q
Private browsing mode
A
Private browsing mode disables the caching features of the browser so that no cookies, browsing history, form fields, passwords, or temp files will be stored when the session is closed.
12
Q
Browser sign-in
A
Browser sign-in allows the user to synchronize settings between instances of the browser software on different devices.
13
Q
A technician makes sure that there is no faulty electrical equipment that can pose a risk and places extinguishers nearby. What is this called?
A
Electrical fire safety ensures that equipment is properly stored and away from any flammable material and electrical wires do not start a fire.
14
Q
Equipment grounding
A
Electrical equipment must be grounded. The power plug connects devices such as PCs and printers to the building ground.
15
Q
Proper power handling
A
Proper power handling is done with the correct training. PC power supply units can carry dangerously high levels of voltage. Disconnection of power should be done before repairing a PC.
16
Q
Fuse
A
An electrical device has a fuse appropriate to its maximum current. If the current increases past the fuse capacity, the fuse will blow. However, if the fuse fitted is rated too low, the fuse will blow too easily.
17
Q
What type of data breach can be associated with a specific person or use an anonymized or de-identified data set for analysis and research?
A
Healthcare data refers to medical and insurance records plus associated hospital and laboratory test results.
18
Q
Personal government-issued information
A
Personal government-issued information is issued to individuals by federal or state governments. Personal information may be social security numbers, passports, driving licenses, and birth/marriage certificates.
19
Q
PII
A
Personally identifiable information (PII) is data that can be used to identify, contact, locate an individual or, in the case of identity theft, impersonate that individual.
20
Q
Open-source license
A
The open-source license makes it free to use, modify, and share and makes the program code used to design it available.
21
Q
An analyst is a method that calculates a product of the likelihood and impact of the potential threat category. What is this method?
A
Risk levels are included in the risk assignment that could be expressed as a discrete value or as a traffic light-type of indicator, where red is high, orange is moderate risk, and green is minimal risk.
22
Q
Sandbox testing
A
Sandbox testing is a computing environment designed to replicate the production environment but isolated from it.
23
Q
Rollback plan
A
A rollback plan is when a change can be reversed if it has harmful or unforeseen consequences.
24
Q
End-user acceptance
A
End-user acceptance must be accounted for when a change of plan is implemented. It can be difficult for people to adapt to new processes and easy for them to magnify minor problems into major complaints.
25
A user is conscientious about security after hearing about breaches in the news. The user wants to see if they are up to date on patches for their Apple computer. Where should the user go to check?
The App Store checks daily for new updates/patches and releases of installed apps in macOS. If a new version is available, a notification will be shown against the App Store icon in the dock.
26
Displays
The Displays preference pane allows users to scale the desktop, set the brightness level, calibrate to a given color profile, and configure Night Shift settings to make the display adapt to ambient light conditions.
27
Printers & Scanners
Use the Printers & Scanners preference pane to add and manage print and scan devices.
28
System Preferences
Users can manage network settings either from the Status menu on the right-hand side of the menu bar or via System Preferences.
29
A manager for a large corporation is in charge of client machines and is currently undergoing a lifecycle hardware refresh. They want to optimize the machines to be powerful enough to run applications. The manager also wants to be sure that they are not underpowered either. What can the manager use to determine CPU optimization?
If privileged time is much higher than user time, the central processing unit (CPU) is likely underpowered (it can barely run Windows core processes efficiently).
30
User time
If overall processor time is very high (over 85% for sustained periods), it can be helpful to compare these. Privileged time represents system processes, whereas user time is software applications.
31
Disk queue length
If the disk queue length increases and disk time is high, then the manager has a disk problem.
32
Pages/sec
Pages per second are the number of pages read from or written to disk to resolve hard page faults, which means memory moves processes to the page file.
33
A vulnerability manager is brainstorming different ways to enhance security for their cell phone devices. The company only uses Apple, and so one of the ideas the manager comes up with is to look for anomalistic files that do not belong with Apple for signs of possible malware which did not profile the device and instead just blasted malware out, hoping the operating system would be right. Which of the following would be anomalistic?
An .apk file is a format for Android. The vulnerability manager only has Apple in their environment. Unknown sources enable untrusted apps to be downloaded from a website and installed using the .APK file format.
34
.dmg
DMG (disk image) format is used for simple installs where the package contents need to be copied to the Applications folder.
35
.pkg
PKG format is used where app setup needs to perform additional actions, such as running a service or writing files to multiple folders.
36
.app
The app is placed in a directory with a .APP extension in the Applications folder when it has been installed.
37
An administrator uses a document list that identifies the discrete stages in the use of hardware and software. What is this document called?
The procurement life cycle includes approval request procedure changes, determining budgets, identifying a trusted supplier or vendor for the asset, deploying implementations for installing the asset in a secure configuration, maintenance, and disposal of implements.
38
Warranty
Warranty is the asset record that includes the appropriate procurement documentation.
39
Assigned users
Assigned users are when hardware assets such as workstations, laptops, smartphones, tablets, and software licenses might be assigned to individual user accounts.
40
Knowledge base
Knowledge base (KB) is a repository for articles that answer frequently asked questions (FAQs) and document common or significant troubleshooting scenarios and examples. Each inventory record could be tagged with a cross-reference to an internal knowledge base to implement self-service support and assist technicians.
41
A user has just set up their network and needs to make sure that their network is secure, and no one can log in to the network. Which of the following should the user do?
Change the default password to secure the administrator account. Choose a new strong password of 12 characters or more.
42
Consider the physical placement.
Physical placement of any router or network appliance should be made to a secure location. A non-malicious threat actor could damage or power off an appliance by accident.
43
Perform firmware updates.
Firmware updates are important because it allows the user to fix security holes and support the latest security standards.
44
Locate the SSID.
Service set ID (SSID) is a simple, case-sensitive name that users identify the WLAN. The factory configuration uses a default SSID that is typically based on the device brand or model, which should be changed so users will recognize the network.
45
An IT manager is setting up an image for dispatching airplanes at a major airport. They are trying to lock down the image to run only the dispatch service. One of the layers of security is to block unneeded service ports from communicating, such as email. Where should the manager start?
Windows Defender Firewall determines which processes, protocols, and hosts can communicate with the local computer over the network.
46
Mail
In account settings, email & accounts are where sign-in credentials for other accounts can be added, such as email or social networking, which allows quick access.
47
Sound
The System Settings page in the Settings app presents options for configuring input and output devices, power, remote desktop, notifications, and clipboard (data copying).
48
Device Manager
Device Manager allows users to view and edit the properties of installed hardware. They can change hardware configuration settings, update drivers, or remove/disable devices.
49
What allows a user to download from a vendor’s website and select the correct patch for their device's make and model?
Firmware updates are important because it allows the user to fix security holes and support the latest security standards.
50
Change default password
Change the default password to secure the administrator account. Choose a new strong password of 12 characters or more. This is more secure than leaving the default where someone may be able to easily access.
51
Physical placement
Physical placement of any type of router or network appliance should be made to a secure location. A non-malicious threat actor could damage or power off an appliance by accident.
52
Encryption setting
Encryption settings allow users to set the authentication mode.
53
An endpoint machine administrator configures specific Apple computers designated for users with disability. Where should the administrator look to configure these settings?
The Accessibility preference pane is used to configure assistive vision and sound options, such as VoiceOver narration of screen elements, cursor size and motion settings, zoom tools, display contrast, font sizes, and captioning.
54
Security & Privacy
macOS has options to configure what analytics/telemetry data and personalized information can be collected. Users can adjust these options via the Security & Privacy preference pane.
55
Time Machine
The Time Machine preference pane lets data back up to an external drive or partition formatted using either the Apple File System (APFS) or macOS’s older extended file system.
56
Mission Control
The Mission Control feature is used for window management and enables users to set up multiple desktops.
57
A technician is working with a customer who is being unreasonable. Which of the following skills should the technician use? (Select all that apply.)
1. Identifying early that the customer is angry and trying to calm the situation down by using a low voice and soothing language and focusing on positive actions.
2. Do not take complaints personally and do not express any anger toward the customer.
3. Hang up and be guided by whatever policy an organization has in place, but in general, if a customer is abusive or threatening, issue a caution to warn them about this behavior.
58
Be judgemental.
Being judgmental is not one that will help in this situation. Do not assume that the customer lacks knowledge about the system.
59
The Instagram app on an Android phone will not launch. Which of the following options could fix the problem?
If an app fails to launch, first use Force Stop to quit it and try launching again. In Android, open Settings > Apps. Tap an app, then select Force Stop. In iOS, either swipe up or double-tap the physical Home button, then swipe the app up off the screen.
60
Swiping
Swiping is a mobile gesture that serves several purposes, such as bringing up the notification bar in Android (swipe down from the top of the screen) and bringing up a list of apps in iOS (swipe up from the bottom).
61
AirDrop
AirDrop is an iOS feature that allows file transfer between iOS and macOS devices over Bluetooth.
62
Software Update
Software Update is an iOS option. The comparable Android option is a System Update.
63
A technician is tasked to figure out why a user's Gmail app will not update on their mobile phone. The technician knows several reasons that would cause this to occur. Which of the following would be one of the reasons for this problem?
If an app fails to update, there may be insufficient storage space (Gmail uses a lot of storage). It could also be that the update is incompatible with the existing operating system version, or there is no internet connection.
64
Accelerometer
An accelerometer is a technology that detects when a device changes position and adjusts the screen orientation appropriately.
65
Bluetooth
Bluetooth is used to connect peripheral devices to PCs and mobiles and to share data between two systems.
66
GPS
Global Positioning System (GPS) is a means of determining a receiver's position based on information received from satellites.
67
The operating system update on a user's phone fails. The user verifies the phone's connection to a wall outlet that leads to the office Wi-Fi. Which of the following could be responsible for the update failure?
Updates may be blocked if a device is connected to a metered network. Additionally, if the operating system update is incompatible with the device model, it may cause the update to fail.
68
RADIUS
Remote Authentication Dial-in User Service (RADIUS) is a protocol used to manage remote and wireless authentication infrastructures.
69
NFC
Near-field communication (NFC) is mostly used for contactless payment readers, security ID tags, and shop shelf-edge labels for stock control.
70
WLAN
A wireless local area network (WLAN) uses radios and antennas for data transmission and reception. Most WLANs are based on the IEEE 802.11 series of standards, better known as Wi-Fi. Since the user verified that the phone was connected to Wi-Fi, WLAN would not be an issue.
71
A threat actor uses a technique that instills statements through an unfiltered user response. What is this technique?
SQL injection attack is when the attacker modifies one or more of the basic functions by adding code to some input accepted by the app, causing it to execute the attacker’s own set of SQL queries or parameters.
72
XSS
Cross-site scripting (XSS) attack exploits the fact that the browser is likely to trust scripts that appear to come from a site the user has chosen to visit.
73
Dictionary attack
A dictionary attack is when the software matches the hash to those produced by ordinary words found in a dictionary.
74
Brute force attack
A brute force attack is when the software tries to match the hash against one of every possible combination it could be.
75
Which of the following log-in options require a user to touch a device that takes a digital print?
A fingerprint is a type of bio gesture authentication that uses a sensor to scan the unique features of the user’s fingerprint.
76
Facial recognition
Facial recognition is the bio gesture that uses a webcam to scan the unique features of the user’s face. The camera records a 3-D image using its infrared (IR) sensor to mitigate attempts to use a photo to spoof the authentication mechanism.
77
Security key
Security key uses a removable USB token or smart card. It can also use a trusted smartphone with a near-field communication (NFC) sensor.
78
OU
An organizational unit (OU) is a way of dividing a domain up into different administrative realms. OUs might be created to delegate responsibilities for administering company departments or locations.
79
A user finds that their iPhone 5 starts to run slowly, and a reboot does not solve the slow performance. Which of the following issues could be causing the problem? (Select all that apply.)
1. If a battery is almost out of charge, it could cause slowness, as will a faulty battery or other faulty hardware.
2. If too many apps are open, a phone could become slow because the open apps are consuming most of the phone's resources.
3. An operating system (OS) update on an older phone can severely impact performance.
80
Mesh network
A mesh network provides communication between devices or nodes using some type of mesh networking, such as Z-Wave or Zigbee, which uses less power and makes it easier for smart devices to forward data between nodes.
81
A helpdesk operator looks at build numbers for Windows as they plan upgrade timelines. The operator investigates the significance of the build numbers. Which of the following are the build numbers based on? (Select all that apply.)
1. The number 16 in build 1607 corresponds to the year (2016) of release.
2. The 07 portion of build 1607 represents the month (07/July) of release. The current version of Windows 10 at the time of writing is 21H2, released in the second half of 2021.
82
Windows version
Versioning is not part of it. Windows 10 and Windows 11 represent the currently supported versions of the Windows client OS.
83
32 bit vs 64 bit
The architecture is not part of it either. Each version and edition of Windows 10 was originally available as 32-bit (x86) or 64-bit (x64) software. A 32-bit CPU can only run the 32-bit editions. A 64-bit CPU can run either.
84
A pet store owner receives an email from their bank with a special financing offer. The owner clicks on the attachment, but it does not open. Later that day, when the owner returns to their computer, it is running very slowly and will not connect to the internet. By the time the IT consultant arrives, the computer has locked up. Which of the following is the best action for the IT consultant given the existing conditions?
The symptoms in this scenario are consistent with a malware infection, even though it could be other causes. As such, running an antivirus scan is the appropriate first step.
85
Run CHKDSK.
CHKDSK is a command-line tool that checks for hard disk errors and can repair them. Problems with the hard disk could cause all of the listed symptoms, except internet access. Moreso, CHKDSK takes a long time to run, so it would not be the best first step in this case.
86
Enable SMART.
SMART (Self-Monitoring, Analysis, and Reporting Technology) is a hard disk monitoring program. It is an alerting tool, not a diagnostic tool.
87
Check the Wi-Fi connection.
Disconnected Wi-Fi could explain the inability to access the internet, but nothing else in this scenario.
88
A penetration tester targeted top-level executives during a test by sending out phishing emails. They received their first shell when the first executive opened the attachment in the phishing email. Once the penetration tester connects to the executive's computer, what command will tell them the location of where their shell landed?
pwd "prints" the working directory, though "printing" will typically mean "display on the terminal," unless stdout is redirected. The working directory is important because commands will default to the working directory without specifying a path.
89
ls
ls lists the contents of a directory similar to dir at the Windows command prompt. Popular parameters include -l to display a detailed (long) list and -a to display all files, including hidden or system files.
90
mv
The mv command is used to move files from one directory to another or rename a file.
91
cp
cp is used to create a copy of files either in the same or different directory with the same or different name.
92
Many mobile apps collect location data. Rogue apps could use location data for criminal purposes, such as burglary. However, many legitimate apps also track a mobile user's location. Why would a legitimate app have interest in a user's location?
Legitimate apps are interested in tracking a user's location for targeted advertising. For example, Facebook tracks the location of its users for that very reason, although it is facing scrutiny over privacy issues.
93
Geotagging
Geotagging is adding geographic data and location to photos. An app would not track a user's location to tag their pictures.
94
Redirection
Redirection is a malware attack, where the malware corrupts the Domain Name System (DNS) and search provider to force users to spoofed sites.
95
Clicks
The pursuit of clicks typically is the area of interest for adware since developers are paid when users click on the advertisements.
96
A company is conducting live meetings between two or more applicants at different sites. What is this called?
Some web-conferencing and videoconferencing software, like Microsoft Teams and Zoom, provides a screen-sharing client that participants may control.
97
Screen-sharing
Screen-sharing is software that is designed to work over HTTPS across the internet. This is secure because the connection is encrypted but also easier to implement as it does not require special firewall rules.
98
Desktop management
Desktop management suites are designed for deployment by a single organization and focus primarily on access control and authorization.
99
File transfer
With file transfer, users can choose a file-sharing protocol that can be used across all connected hosts. It allows configuring permissions on the share and provisioning user accounts that are recognized by both the server and client.
100
A helpdesk professional assists a user with issues booting up their Mac computer. The user reports that there is no drive to boot from. Where will the computer boot from?
When users reboot an Apple Mac, if the startup drive is not available for any reason and it is connected to the internet, the computer will try to boot from a web-based drive.
101
Terminal
The Terminal can be used to access the command-line environment, which uses either the Z shell (zsh) or Bash. Older macOS versions use Bash, while zsh is the default from Catalina up.
102
Force Quit
If a macOS app stops responding, it should be possible to close it down and restart without restarting the computer, using Run Force Quit from the Apple menu or press COMMAND+OPTION+ESC.
103
FileVault
FileVault is a disk encryption product. Encryption protects the data stored on a disk against the possibility that a threat actor could remove it.
104
A software development team is unaware of a developing vulnerability in the system. What is this type of vulnerability?
A zero-day attack is a vulnerability exploited before the developer knows about it or can release a patch. These can be extremely destructive, as it can take the vendor a lot of time to develop a patch, leaving systems vulnerable for days, weeks, or even years.
105
EOL
End of life (EOL) system is where the software vendor no longer provides support or fixes problems.
106
BYOD
Bring your own device (BYOD) provides modeling that allows employees to use personal mobile devices to access corporate systems and data.
107
Impersonation
Impersonation means that the social engineer develops a pretext scenario to interact with an employee.
108
A helpdesk manager assesses older Windows 7 computers their company owns and tries to determine available upgrade paths. Which of the following can NOT be upgraded?
Users cannot upgrade from a Home to an Enterprise edition. If users consider an in-place upgrade, they must check that the current OS version is supported as an upgrade path to the intended version.
109
Windows 7 Home Premium to Windows 10 Pro
Users can upgrade from Windows 7 Home Premium to Windows 10 Home or Pro. With Windows, users have to consider the edition when upgrading.
110
Windows Home to Windows 10 Pro
Users can upgrade from Windows 10 Home to Windows 10 Pro.
111
Windows 7 Pro to Windows 10 Home
Downgrading the edition is supported in some circumstances (Windows 7 Professional to Windows 10 Home, for instance), but this only retains documents and other data, not apps and settings.
112
An employee uses an option to ask for help from a technician with an invitation file protected by a passcode. What is this option?
Microsoft Remote Assistance (MSRA) allows a user to ask for help from a technician or co-worker by an invitation file protected by a passcode. The helper opens the invitation file to connect to the remote system.
113
RMM
Remote Monitoring and Management (RMM) tools are principally designed for use by managed service providers (MSPs).
114
RDP
Remote Desktop Protocol (RDP) implements terminal server and client functionality. RDP authentication and session data are always encrypted.
115
VPN
A virtual private network (VPN) establishes a tunneled link that joins a local computer to a remote network. Establish a VPN link and then use a remote desktop to connect to a host on the private network.
116
A marketing professional normally sends large files to other team members. The IT department recommended using a shared drive and assisted them in setting it up. The project was a very high priority, so the professional collaborated with several members but started receiving reports that some users could not access it sometimes and others could. They eventually figured out that only 20 people at a time seemed to be able to access it. What is causing the issue?
The Share tab in the folder's Properties dialog can customize permissions, change the share name, and limit the number of simultaneous connections. Windows desktop versions are limited to 20 inbound connections.
117
The file server was not properly configured.
If more than 20 users access the share, the data should be stored on file servers rather than local client computers.
118
The proxy settings are not properly configured on client machines.
The proxy settings will not affect users' ability to access the file share in this scenario. It could cause issues accessing the internet, however.
119
DNS settings are intermittent.
If the domain name system (DNS) were causing an issue, the users would not be limited to 20 people. It is possible that load-balanced DNS servers could cause issues if one is incorrect.
120
A server administrator sets up jobs that will copy over files on various servers. They want it to detect if the file was transferred successfully and, if not, resend the file. Which command is optimal for server administrators to perform this task?
Robocopy command (or "robust copy") is another file copy utility. Microsoft now recommends using robocopy rather than xcopy. Robocopy is designed to work better with long file names and NTFS attributes.
121
xcopy
The xcopy command is a utility that allows users to copy the contents of more than one directory at a time and retain the directory structure.
122
move
The move command provides the ability to transfer files contained in a single directory. It uses a three-part syntax: command Source Destination, where Source is the drive name, path, and name of the files to be moved/copied.
123
copy
The copy command also allows transferring files contained in a single directory.
124
A user is only able to read data on the file. What account management policy is this?
Restrict user permission.
125
Change default administrator account.
These default accounts have practical limitations and consequently are the ultimate target for threat actors. Any use of the default administrator account must be logged and accounted for.
126
Disable guest accounts.
Disabling guest accounts allow unauthorized access to the computer and may provide some sort of network access too. It is only enabled to facilitate password-less file sharing in a Windows workgroup.
127
Restrict login times.
Restrict login times are typically used to prevent an account from logging in at an unusual time of the day or night or during the weekend.
128
A user likes to watch Netflix on their phone while on the treadmill. The user turns the phone sideways for better viewing, but this time, the picture did not orient to landscape as it always has. Which of the following could cause this issue?
When a screen does not autorotate, it could be that the rotation lock is enabled. In iOS, the rotation lock is found in the Control Center. In Android, the rotation lock is found in the navigation bar.
129
Rotation lock is disabled.
If the rotation lock is disabled, the screen should autorotate. If it does not, the problem is probably hardware-related.
130
Screen lock is enabled.
Screen Lock is a security feature for mobile devices. If enabled, it activates if the device is unused or the user activates it. Most devices require a pin or password to unlock the screen.
131
Screen lock is disabled.
Screen Lock is a security feature for mobile devices. If it is disabled, no pin or password is required. Generally, some swipe gestures will unlock the screen.
132
What is a type of employee device that must meet the profile that the company requires, and the employee will have to agree on the installation of corporate apps and to some level of oversight and auditing?
Bring your own device (BYOD) is a mobile device owned by the employee. The mobile is usually the most popular with employees but poses the most difficulties for security and network managers.
133
COBO
A corporate-owned business only (COBO) device is the company's property and may only be used for company business.
134
COPE
Corporate-owned, personally enabled (COPE) is when the company chooses and supplies the device and remains the company's property. The employee may use it to access personal email, social media accounts, and personal web browsing.
135
CYOD
Choose your own device (CYOD) is like COPE, but the employee can choose the device they want from a list.
136
A user's phone begins to act strangely, with apps responding slowly and pop-up ads appearing frequently. When the user calls the help desk and explains the issues, the technician says it sounds like malware. What other symptoms would be common to a malware infection on a mobile phone? (Select all that apply.)
1. Fake security warnings are a common symptom of malware infection. Scareware uses these to persuade users to install an app or give a Trojan app additional permissions.
2. Redirection attacks are a common symptom, where malware corrupts the Domain Name System (DNS) and search provider to force users to spoofed sites. This might disrupt access to legitimate sites, generate certificate warnings, and cause slow network performance.
137
APK sideloading
APK (Android Package) sideloading refers to downloading apps for Android phones from a source other than Google's Play store.
138
Increased Response Times
A lockout occurs after a maximum number of failed sign-in attempts.
139
A server administrator locks down security on their golden client image but is concerned about potentially breaking things in the environment. They decided to set up a test image for test users in various departments before full implementation. What should the administrator use to make individual configuration changes to the image?
The Windows registry provides a remotely accessible database for storing operating system, device, and software application configuration information. The administrator can use the Registry Editor (regedit.exe) to view or edit the registry.
140
gpedit.msc
The Group Policy Editor (gpedit.msc) provides a more robust means of configuring many Windows settings than editing the registry directly.
141
services.msc
The Services console (services.msc) starts, stops, and pauses processes running in the background. In order to make configuration changes, regedit.exe in this group of options would be used.
142
shell:startup
The Startup tab lets administrators disable programs added to the Startup folder (type shell: startup at the Run dialog to access this).
143
A user requests a site's certificate, but an evil twin intercepts the request and presents a spoofed certificate, which the user's browser accepts. What has just happened? (Select all that apply.)
1. An on-path attack is when a threat actor, such as an evil twin, intercepts traffic between two hosts. In this case, it was via a spoofed digital certificate.
2. In the middle of the session, the evil twin intercepts traffic between two hosts; this was known as a "Man-in-the-Middle" attack in a former time.
3. Since the user's browser has accepted the spoofed digital certificate, the user believes they have a secure session, even though they do not.
144
A rootkit attack
A rootkit is a malware that modifies system files, often at the kernel (root) level.
145
A server administrator hears weekly about companies breached by malware. What is the most significant impact the server administrator is likely worried about?
When selecting applications for installation on desktops, proper security considerations need to be made regarding potential impacts to the device (computer) and the network.
146
Support
With support, the software might be available with paid-for support to obtain updates, monitor and fix security issues, and provide technical assistance.
147
Training
With training, complex apps can have a substantial and expensive user-training requirement which can be an ongoing cost as new versions can introduce interface or feature changes.
148
Licensing
With licensing, commercial software must be used within the constraints of its license but is likely to restrict the number of devices on which the software can be installed.
149
A user disables some of the laptops' services, thinking it would speed up performance. After restarting the laptop, "One or more services failed to start" appears. When the IT specialist opens the Services snap-in, they identify the failed service and restart it, but that does not fix it. Which of the following scenarios best explains why the restart did not work?
Most Windows services are dependent on other services to run. If the user disabled a service that the failed service depended on, it would fail to start.
150
The IT specialist should have restored the failed service instead of restarting.
Service is restored if it is missing or has been deleted. The failed service still exists but failed to start due to disabled dependency.
151
The failed service was set to delayed start.
Setting a service to delayed start is a way to improve Windows boot time since these services will not start until all other services are loaded. This setting will not cause a service to fail.
152
The failed service was deleted.
If the failed service were deleted, it would not have appeared as a service that failed to start.
153
Which of the following malware tries to extort money from the victim?
Spyware is malware that can perform browser reconfigurations, such as allowing tracking cookies, changing default search providers, opening arbitrary pages at startup, adding bookmarks, and many more.
154
Ransomware Virus
Viruses are concealed within the code of an executable process image stored as a file on a disk.
155
Trojan
Trojans are malware concealed within an installer package for software that appears to be legitimate. The malware will be installed alongside the program and executed with the same privileges.
156
Boot sector virus
Boot sector viruses can infect the boot sector code or partition table on a disk drive.
157
A company has hundreds of employees who use the same software on their computers, so they offer a company product key to access the software. What is this product?
A corporate-use license is for multiple users, which means the company can install the software on an agreed-upon number of computers for its employees to use simultaneously. The company will offer a valid license with the product key. These can be non-expired licenses as well.
158
Personal license
A personal license allows the product to be used by a single person at a time, though it might permit installation on multiple personal devices.
159
Data retention requirements
Data retention requirements are regulations that set a maximum period for data retention. The regulation might also demand that information be retained for a minimum period.
160
DRM
Digital music and video are often subject to copy protection and digital rights management (DRM).
161
Which of the following backup procedures state that users should have three copies of their data across two media types, with one copy held off-line and off-site?
3-2-1 backup rule is a best-practice maxim that users can apply to their backup procedures to verify that they are implementing a solution to mitigate the widest possible range of disaster scenarios.
162
GFS
Grandfather-father-son (GFS) is a backup rotation scheme that uses son tapes to store the most recent data and have the shortest retention period. Grandfather tapes are the oldest and have the longest retention period.
163
Frequency
Frequency is the period between backup jobs. If the edits are much more difficult to reconstruct, the backup frequency might need to be measured in hours, minutes, or seconds.
164
Synthetic
The synthetic full backup is not generated directly from the original data but instead assembled from other backup jobs.
165
An employee enters the web address of their local newspaper to check for news on the company, and a site pops up with many click-bait celebrity stories. The employee re-enters the address assuming a misspelling but returns to the same page. When the help desk technician arrives, which of the following troubleshooting steps would be appropriate?
This scenario describes a redirection when a user tries to open one page but is sent to another. Here, it appears adware is driving traffic to another site to increase clicks. Since HOSTS maps domain names to IP addresses, the HOSTS file in the registry would show malicious entries to re-route IP addresses.
166
Check to see if the DNS browser is configured correctly.
The Domain Name Server (DNS) is a server, not a browser. However, the nslookup command can be used to check DNS records.
167
Check to see if the newspaper website's certificate is expired.
Any problem with a website's certificate will likely generate a message. It will not send a user to another website.
168
Check the System Configuration Utility.
The System Configuration Utility modifies various settings and files that affect how the computer boots and loads Windows.
169
An attacker is trying multiple times to login into a user’s phone, but the phone ends up being disabled. What is this called?
Failed attempts lockout is when a maximum number of incorrect sign-in attempts occur within a certain period. Once the maximum number of incorrect attempts has been reached, the account will be disabled.
170
Concurrent logins
Concurrent logins limit the number of simultaneous sessions a user can open. Most users should only need to sign in to one computer at a time.
171
Use timeout/screen lock
Use timeout/screen lock is when the desktop is locked if the system detects no user-input device activity. Users should not rely on this and lock the computer manually when leaving it unattended.
172
Disable AutoRun
Disable AutoRun so that malware can not be installed automatically. Some versions of Windows require an optical disc inserted or USB drive to be attached so that the AutoRun command installs.
173
A technician must remove all corporate accounts and files from an employee’s device but leave personal applications, accounts, settings, and files untouched. What is this called?
Enterprise wipe can be performed against corporate containers only. The device must be enrolled with MDM.
174
Remote wipe
Remote wipe allows users to remotely erase the data on the device if the device is stolen or lost.
175
Profile security requirements
Profile security requirements document the details of the secure implementation of a device. These policies are applied to different employees and different sites or areas within the site.
176
Locator application
A locator application finds a device if it is lost or stolen. Once set up, the phone's location can be tracked from any web browser when it is powered on.
177
A user has a Mac computer but likes Windows better for functionality and compatibility purposes. The user wants to sell their computer on an online marketplace and wipe their presence from the computer. Which of the following will help them accomplish this?
The Disk Utility app can be used to verify or repair a disk or file system. It can also be used to erase a disk with security options if users are selling or passing on a Mac.
178
Finder
The Finder is the macOS equivalent of File Explorer in Windows. It lets the user navigate all the files and folders on a Mac.
179
Remote Disc
Since 2016, no Apple Mac has been sold with an inThe Remote Disc app, which lets users access a CD/DVD drive on another Mac or Windows computer.
180
Dock
The Dock at the bottom of the screen gives one-click access to users' favorite apps and files, similar to the taskbar in Windows.
181
After installing Windows 10 on an old computer, a computer technician is stumped when the computer continues to boot to a blank screen. Determine which ones could conceivably fix the blank screen from the available solutions. (Select all that apply.)
1. A blank screen following a Windows installation could be caused by several factors, including an interruption to the installation process and an incomplete install. (Repairing Windows) could address this.
2. Updating the graphics driver is another possible remedy since the driver may be outdated and incompatible with Windows 10.
182
Run the IDLE debugger.
IDLE is the Python Integrated Development and Learning Environment. While IDLE does have a debugger, it is for Python scripts, not Windows issues.
183
Defrag the hard drive.
Defragging the hard drive is done to optimize file storage and improve sluggish performance. It would not fix a blank screen.
184
A technician is cleaning a computer and notices dust forming over the fan blades and ventilation slots. What can the technician use to perform dust cleanup? (Select all that apply.)
1. A compressed air blaster can be used to dislodge dust from difficult-to-reach areas. When performing this sort of maintenance within a controlled area, wear an appropriate air-filter mask and goggles.
2. The PC vacuum cleaner can be used to blow air and suction to replace the need for the compressed air canister. Such vacuums should be labeled as toner safe.
3. Natural bristle brushes remove dust from inside the system unit, especially from the motherboard, adapter cards, and fan assemblies.
185
Domestic vacuum
Domestic vacuum appliances should not be used as they can produce high levels of static electricity.
186
After starting the computer and signing in, a user notices the desktop takes a long time to load. Evaluate the following Windows operating system problems to determine the one that best diagnoses what could be causing the slowness.
When a computer starts normally, and a user logs in normally, the desktop is slow to load; a (corrupted user file) is likely a culprit.
187
Time drift
Time drift occurs when the time on the motherboard and the server gets out of sync. Using GPS-synchronized time sources or a pool of internet sources will address time drift.
188
Corrupted registry
A corrupted registry likely would prevent the computer from booting, or it would boot to a blue screen of death (BSOD).
189
Invalid boot disk
An invalid boot disk means the system has failed to boot, which is not true in this scenario.
190
A security analyst notices an unauthorized disclosure of customers' data at the company. What type of data is breached?
Personally identifiable information (PII) is data that can be used to identify, contact, or locate an individual or impersonate that individual in the case of identity theft. PII is any representation of information that authorizes the identity of an individual.
191
Open-source license
The open-source license makes it free to use, modify, and share and makes the program code used to design it available.
192
Healthcare data
Healthcare data refers to medical and insurance records plus associated hospital and laboratory test results.
193
Chain of custody
The chain of custody form records where, when, and who collected the evidence, handled it subsequently, and stored it.
194
A Linux administrator sets up a development environment where they can install and test new packages. Which of the following commands will help the administrator accomplish this? (Select all that apply.)
1. apt-get is a command interface for the Advanced Packaging Tool (APT). APT is used by Debian distributions and works with .deb format packages.
2. yum is the command interface for YUM. Yum install PackageName installs a new application.
195
ip
As part of the iproute2 package, the ip command has options for managing routes and the local interface configuration. The command ip addr replicates the basic reporting functionality of ifconfig (show the current address configuration).
196
df
df ("disk free") lets the user view the device's free space, file system, total size, space used, percentage value, and mount point.
197
A remote computer administrator is managing clients in rigorous conditions. The clients keep overheating and often have issues. The administrator wants to run regular checks for damage or corruption. Which of the following will help them accomplish this?
Historically, most attended installations and upgrades were run by booting from optical media (CD-ROM or DVD). The optical drive must be set as the priority boot device. (SFC)
198
A new employee is going over the site safety handbook about correct ways of carrying objects, so they do not damage the object or get injured. What is this called?
Lifting techniques are included in site safety handbooks and guidance sets out in jobs to show employees that lifting a heavy object in the wrong way can damage their back or cause muscle strains and damage the object.
199
Safety goggles
Safety goggles are used to minimize the risk of burns from corrosive materials such as broken batteries, cellphones, tablets, or irritation from particles such as toner or dust.
200
Air filter mask
An air filter mask that fits over the mouth and nose is a recommended face covering when working with compressed air, toner spills, or working in a dusty environment. An air filter mask will not protect the eyes.
201
Trip hazard
Trip hazards are caused by putting any object in pathways where people walk.
202
A user calls the help desk with issues consistent with a malware infection, although the user received no alert. The technician confirms that there was no malware alert. Which of the following options would be an appropriate next step? (Select all that apply.)
1. Since the installed antivirus software did not pick up the malware infection, scanning the system with a different antivirus product is a good option since some products pick up what others do not.
2. The antivirus software may not have detected the malware infection because it was not updated. Updating antivirus software before running scans is a best practice.
203
Log on to the system as an administrator.
Logging on to a malware-infected system as an administrator exposes their privileged account access credentials for the malware to exploit.
204
Remove the malware.
Removing the malware is a few steps ahead of the current scenario.
205
Different desktop styles introduced by a new OS version or changing from one OS to another can generate issues as users struggle to navigate the new desktop and file system. An upgrade project must take account of this and prepare training programs.
A Windows client administrator plans to upgrade their OS in the current environment. What is one of the most important considerations for the upgrade?
206
TPM 2.0
While the scenario did not specify which OS the administrator was upgrading to, Windows 11 requires a CPU or motherboard supporting trusted platform module (TPM) version 2.
207
Journaling
When data is written to an NTFS volume, it is re-read, verified, and logged via journaling. In the event of a problem, the sector concerned is marked as bad and the data relocated.
208
Dynamic Disks
The Dynamic Disks feature allows multiple physical disks to be combined into volumes.
209
Which of the following devices come in the form of adapters, trailing sockets, or filter plugs, with the protection circuitry built into the unit?
Surge suppressors are passive protection devices that can filter out the effects of surges and spikes.
210
Compressed air blaster
A compressed air blaster can be used to dislodge dust from difficult-to-reach areas. When performing this sort of maintenance within a controlled area, wear an appropriate air-filter mask and goggles.
211
Antistatic bags
Antistatic bags are packages that reduce the risk of ESD because it is coated with a conductive material.
212
Anti-ESD strap
Anti-ESD wrist straps should fit snugly around the wrist or ankle so that the metal stud makes contact with the skin. Wearing an anti-ESD wrist strap causes the static charge to dissipate more effectively.
213
Employees are expected to stay updated on skills and knowledge to cope with changing threat types. Which of the following covers this?
Security-awareness training is usually delivered to employees at all levels, including end-users, technical staff, and executives. The training includes anti-phishing, software firewalls, passwords, malware threats, and more.
214
Anti-malware
Anti-malware is computer software used to avoid, identify, and eliminate malware. Anti-malware is like antivirus software but for more up-to-date malware.
215
Recovery mode
Recovery mode is the step-by-step processing of manual removal to disable persistence mechanisms and reconfigure the system to its secure baseline.
216
OS reinstallation
OS reinstallation is when antivirus software is not able to recover data from infected files, and a user must complete a system restore.
217
When making major adjustments to a project, a security technician will have to assess the business and technical merits as well as the risks of the adjustment plan. What documentation will need to be submitted?
Change board approvals are when a serious change request is made, and approvals go to a change advisory board (CAB). The CAB should include stakeholders for departments, users, or customers whom the change will impact and those proposing it, technicians responsible for implementing it, and managers/directors who can authorize the budget.
218
Sandbox testing
Sandbox testing is a computing environment designed to replicate the production environment but isolated from it.
219
Rollback plan
A rollback plan is when a change can be reversed if it has harmful or unforeseen consequences.
220
Risk levels
Risk levels are included in the risk assignment that could be expressed as a discrete value or as a traffic light-type of indicator, where red is high, orange is moderate risk, and green is minimal risk.
221
A software engineer uses the “data protection” option for the apps on their mobile device. This option is subject to the second round of encoding using a key derived from and protected by the user’s credentials. What is this method?
Device encryption is enabled automatically when a user configures a passcode lock on the device.
222
Remote backup application
A remote backup application is the backup of data, apps, and settings to the cloud. A user may choose to use a different backup provider or a third-party provider like Dropbox.
223
Profile security requirements
Profile security requirements document the details of the secure implementation of a device. These policies are applied to different employees and different sites or areas within the site.
224
Locator application
A locator application finds a device if it is lost or stolen. Once set up, the phone's location can be tracked from any web browser when it is powered on.
225
A local jewelry maker sets up a booth at a craft fair. When the first customer makes a purchase, the vendor's contactless card reader will not recognize the customer's wallet app. Which of the following could solve the problem?
Contactless card readers use near-field communication (NFC). NFC normally works at up to two inches (6 cm), so moving the device closer to the reader could solve the problem.
226
Turn on airplane mode.
Turning on airplane mode will disconnect NFC.
227
Use biometric authentication.
Biometric authentication allows a user to perform a biometric scan to operate an entry or access a system. Typical features used include facial pattern, iris, retina, fingerprint pattern, and signature recognition.
228
Enable RFID.
Radio Frequency ID (RFID) is a means of identifying and tracking objects, such as parcels, equipment, or access badges, using specially encoded tags.
229
An IT professional helps to fix their friend's computer. The computer is running extremely slow. The IT professional notices the operating system is running Home edition. Which of the following is the only service available for the Home edition?
Remote Desktop Protocol (RDP) allows users to connect to the machine and operate it over a network. While the Home edition has the RDP client software, it does not support an RDP server.
230
Group policy editor is available when using the Windows Home edition and is used to create and apply OS and software application settings. (TorF)
Group Policy Editor (gpedit.msc) is used to create and apply OS and software application settings. The editor is not available in the Home edition.
231
BitLocker is not available when using the Windows Home edition and enables the user to decrypt all the information on a disk drive. (TorF)
BitLocker enables the user to encrypt all the information on a disk drive. BitLocker is not supported in Windows Home edition.
232
Windows Home, Pro, and Enterprise can join a domain network, whereas Education does not. (TorF)
Pro/Enterprise editions support Hyper-V, and the Home edition does not.
233
Which of the following alternatives can a customer select from when an issue cannot be resolved remotely? (Select all that apply.)
1. The repair option for the customer will need clear instructions about how to pack and return the item to a repair center along with a ticket-tracking number and returned-merchandize authorization (RMA).
2. The replacement option for the customer must be given clear instructions for how the product will be delivered or how it can be re-ordered, and whether the broken product must be returned.
234
Proper documentation
Proper documentation should be provided so that the customer knows what to expect in terms of supported items, how long incidents may take to resolve, and so on.
235
Clarify customer statements
Clarify customer statements by asking the customer’s expectations of what will be done and when the problem will be fixed.
236
Which of the following will block untrusted application sources from running?
Anti-malware applications designed for mobile devices tend to work more like content filters to block access to known phishing sites and block adware/spyware activity by apps.
237
Failed login attempts
Failed login attempts mean that the device locks for a set period if an incorrect passcode or bio gesture is used; this deters attempts to guess the passcode or use a spoofed biometric.
238
OS updates
OS updates are as critical as it is for a desktop computer. The install base of the iOS is generally better at applying updates because of the consistent hardware and software platform.
239
Firewall
Firewall applications for mobile devices can monitor app activity and prevent connections to ports or IP addresses.
240
A manager for a Linux server team recently purchased new software which will help to streamline operations, but they are worried that in IT, there is a high turnover of personnel. The manager wants to ensure they can obtain updates, monitor and fix security issues, and are provided technical assistance. What impact is the manager trying to mitigate?
Given the unpredictable state of IT staffing, the software might be available with paid-for (support) to obtain updates, monitor and fix security issues, and provide technical assistance.
241
Licensing
With licensing, commercial software must be used within the constraints of its license but is likely to restrict the number of devices on which the software can be installed.
242
Training
Complex apps can have a substantial and expensive user-training requirement, which can be an ongoing cost as new versions can introduce interface or feature changes.
243
Network
When selecting applications for installation on desktops, proper security considerations need to be made regarding potential impacts to the device (computer) and the network.
244
What are their options when a company wants to create and deliver a custom app for their employees without using a public store? (Select all that apply.)
1. Apple operates enterprise developer and distribution programs to allow private app distribution via Apple Business Manager.
2. Google's Play Store has a private channel option for enterprise app distribution called Managed Google Play.
245
Developer Mode
Developer mode is a mobile-device feature designed for testing apps during development. It has no connection to how an app is delivered, whether publicly or privately.
246
Bootleg App Store
A bootleg app store is where users can find bootleg apps that closely mimic legitimate apps; this is a way of pirating apps without paying for them. It is not a private distribution channel.
247
A new employee calls the help desk because their phone will not connect to the office Wi-Fi. When the technician asks about the phone model, the employee says it is an iPhone 5. The technician immediately knows the problem. Which of the following could be the problem?
Since the technician knew the problem based on the phone model, the most likely cause would involve configuration issues between the device and the wireless access point related to the 802.11 standard or the GHz band.
248
Signal strength
Signal strength can be affected by distance but not likely by the phone model.
249
Interference
The phone model would not impact interference from other devices or thick walls or metal.
250
Throttling
Concerning smartphones, throttling refers to a purposeful reduction in phone performance by a manufacturer's update to the device that instructs it not to perform at its maximum capabilities.
251
A curious user looks through their local logs and sees errors in region-coding copy-protection mechanisms. What type of device is generating these logs?
Consumer DVDs and Blu-rays feature digital rights management (DRM) and region-coding copy-protection mechanisms.
252
USB
A flash drive is also called a USB drive, thumb drive, or pen drive. It is simply a flash memory board with a USB connector and protective cover.
253
SSD
A solid-state drive (SSD) uses flash memory technology to implement persistent mass storage. Flash memory performs much better than the mechanical components used in hard disk drives.
254
External drive
External storage devices are also used for backup and data transfer or provide a drive type not available as an internal unit.
255
A technician sets up a company’s network and uses a method that lets employees know which network is the company’s network. What is this called?
Service set ID (SSID) is a simple, case-sensitive name that users identify the WLAN. The factory configuration uses a default SSID that is typically based on the device brand or model, which should be changed so users will recognize the network.
256
UPnP
The universal plug-and-play (UPnP) framework sends instructions to the firewall with the correct configuration parameters to allow applications to work.
257
DHCP reservation
The Dynamic Host Configuration Protocol (DHCP) reservation means that the DHCP server always assigns the same IP address to the host. A user can usually choose which IP address this should be.
258
Firmware updates
Firmware updates are important because it allows the user to fix security holes and support the latest security standards.
259
A transportation company wants to set up software that gathers statistics from the controller area network for trailers hauling loads, enabling them to adjust processes to optimize cost savings. What type of adapter will the company need to send the statistics back to their cloud network?
Wireless Wide Area Network (WWAN) uses a cellular adapter to connect to the internet via a provider's network. These networks are typically metered with a set data limit.
260
VPN
A virtual private network (VPN) connects the components and resources of two (private) networks over another (public) network.
261
Wired
Almost all wired network connections are based on some Ethernet. The adapter's media type must match the switch it is connected to.
262
Wireless
While WWAN could be considered wireless, wireless generally refers to a computer that connects to the 2.4 or 5 GHz spectrum with a limited physical range.
263
The IT Department has learned that a new employee starts on Monday and will need a computer just before the weekend. There is a used PC in the storeroom. A " no operating system found " message appears when the computer is rebooted after a technician installs Windows 10 on the computer with the hard drive partition style set to support Unified Extensible Firmware Interface (UEFI). Determine which of the following scenarios would generate that message.
The hard drive stores the files for the operating system, so a damaged hard drive will generate the "no operating system found" message.
264
Application crash
Applications do not load until after login, and the operating system would have to be found to load and display a login screen.
265
Faulty motherboard
It is unlikely that a faulty motherboard would lead to a "no operating system found" error. It is more likely to cause the system not to boot, not recognize peripherals, or suffer the blue screen of death (BSOD).
266
Corrupted MBR
Unified Extensible Firmware Interface (UEFI) generally does not interact with the Master Boot Record (MBR). The MBR is part of the legacy BIOS boot process.
267
An administrator assists the human resources department in testing access to their new cloud-based training site. Unfortunately, the site cannot be accessed due to the organizational security policy. Which of the following should the administrator use to assist them?
The Certificate Manager (certmgr.msc) console shows which certificates have been installed and provides a mechanism for requesting and importing new certificates.
268
diskmgmt.msc
The Disk Management (diskmgmt.msc) console displays a summary of any fixed and removable disks, which includes hard disk drives (HDDs), solid-state drives (SSDs), and optical drives.
269
taskschd.msc
The Task Scheduler (taskschd.msc) runs software and scripts according to calendar or event triggers which would not help diagnose and troubleshoot internet connectivity issues.
270
lusrmgr.msc
The Local Users and Groups (lusrmgr.msc) console provides an advanced interface for creating, modifying, disabling, and deleting user accounts.
271
A computer administrator sets up a client workstation to join a centrally managed network. What options should the administrator configure to do this?
Access work or school under the Account settings app joins the computer to a centrally managed domain network.
272
Sign-in options
Configure sign-in options under Account settings using a fingerprint reader or PIN to access the computer rather than a password. The computer can also be set to lock automatically from here.
273
Apps
The Apps group is used to view and remove installed apps and Windows Features in the Settings app. Users can also configure which app should act as the default for opening, editing, and printing particular file types and manage which apps run at startup.
274
What is referred to as data on persistent storage like HDDs, SSDs, and thumb drives?
Data on persistent storage, like HDDs, SSDs, and thumb drives, is known as data-at-rest. To protect data-at-rest against these risks, the information stored on a disk can be encrypted.
275
Disable AutoRun
Disable AutoRun so that malware can not be installed automatically. Some versions of Windows require an optical disc inserted or USB drive to be attached so that the AutoRun command installs.
276
Disable Autoplay
Disabling Autoplay will make the computer unable to play new content automatically.
277
Use timeout/screen lock
Use timeout/screen lock is when the desktop is locked if the system detects no user-input device activity. Users should not rely on this and lock the computer manually when leaving it unattended.
278
What component storage prevents static electricity from discharging?
Antistatic bags are packages that reduce the risk of ESD because it is coated with a conductive material.
279
ESD straps
Anti-electrostatic discharge (ESD) straps are worn to dissipate static charges effectively. The band should fit snugly around the wrist or ankle so that the metal stud contacts the skin.
280
ESD mats
Electrostatic discharge (ESD) mats are used to organize sensitive components. The mats contain a snap connected to the wrist or leg strap.
281
Dissipative packaging
Dissipative packaging is light pink or blue packaging that reduces the buildup of static in the general vicinity of the contents by being slightly more conductive than normal.
282
A technician uses filesystem-level encryption on some files that need to be encrypted on their device. What is this called?
The Encrypting File System (EFS) feature of the New Technology File System (NTFS) supports file and folder encryption. EFS is not available in the Home edition of Windows. The encryption key used by EFS is associated with the username and password.
283
Port security
Port security triggers are based on the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP) port number used by the application protocol.
284
Application security
Application security triggers are based on the process that listens for connections.
285
Inheritance
Inheritance permission assigned to a folder is automatically inherited by the file and subfolder created under the folder.
286
What method gets a system back up and running before the recommended amount of time elapses?
A rollback plan is when a change can be reversed if it has harmful or unforeseen consequences.
287
Change board approval
Change board approvals are when a serious change request is made, and approvals go to a change advisory board (CAB). The CAB should include stakeholders for departments, users, or customers whom the change will impact and those proposing it, technicians responsible for implementing it, and managers/directors who can authorize the budget.
288
Sandbox testing
Sandbox testing is a computing environment designed to replicate the production environment but isolated from it.
289
Risk levels
Risk levels are included in the risk assignment that could be expressed as a discrete value or as a traffic light-type of indicator, where red is high, orange is moderate risk, and green is minimal risk.
290
An IT manager, who is in charge of the client image, considers enabling a data at rest solution. Where can the manager go to enable the built-in Microsoft solution?
The System Settings page in the Settings app presents options for configuring input and output devices, power, remote desktop, notifications, and clipboard (data copying). BitLocker disk encryption is here.
291
Devices and Printers
The Devices and Printers applet in the Control Panel provides an interface for adding devices manually and shortcuts to the configuration pages for connected devices.
292
Programs and Features
The Programs and Features Control Panel applet is the legacy software management interface. Users can use it to install and modify desktop applications and Windows Features.
293
Network and Sharing
Network and Sharing Center is a Control Panel applet that shows status information.
294
A server administrator experiences performance issues on a server and needs to narrow down the source of the problem. The server is an externally facing website with high visibility for the company. The longer the site is having issues, the more customers might notice and possibly damage the company's reputation. What can the administrator use to view and log performance statistics? (Select all that apply.)
1. Resource Monitor (resmon.exe) is used to view and log performance statistics. A Microsoft Management Console (MMC) contains one or more snap-ins used to modify advanced settings for a subsystem.
2. Performance Monitoring (perfmon.msc) is also used to view and log performance statistics. The administrator can use this to identify the source of the issue.
3. Device Manager (devmgmt.msc) allows the administrator to view and edit the properties of installed hardware. Users can change hardware configuration settings, update drivers, or remove/disable devices.
295
msinfo32.exe
The System Information (msinfo32.exe) tool produces a comprehensive report about the system’s hardware and software components.
296
What technique is often used to exhibit fake antivirus and security warnings or other malicious advertising?
Pop-ups can be used by malicious actors to scare a user with fake antivirus or security warnings.
297
Untrusted source
An untrusted source is when an installer cannot be verified through a digital signature or has been a security risk and is likely to expose the user to unwanted adverts. Some untrusted sources do not block ads or have pop-up blockers.
298
Trusted source
As the browser is a security-critical type of software, it is particularly important to use a trusted source, such as an app store. Likewise, if installed as a desktop application, the user should ensure using a reputable vendor.
299
Private browsing mode
Private browsing mode disables the caching features of the browser so that no cookies, browsing history, form fields, passwords, or temp files will be stored when the session is closed.
300
What can use a trusted platform module chip in the computer to tie the use of a fixed disk to a particular motherboard?
BitLocker is a disk encryption product available with all Windows editions except for the Home edition. Full disk encryption carries a processing overhead, but modern computers usually have the processing capacity to spare. It can also be used with removable drives in its BitLocker To Go form.
301
Port security
Port security triggers are based on the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP) port number used by the application protocol.
302
Application security
Application security triggers are based on the process that listens for connections.
303
Inheritance
Inheritance permission assigned to a folder is automatically inherited by the file and subfolder created under the folder.
304
A technician runs an isolated test that allows them to run the program without impacting the system. What is this called?
Sandbox testing is a computing environment designed to replicate the production environment but isolated from it.
305
End-user acceptance
End-user acceptance must be accounted for when a change of plan is implemented. It can be difficult for people to adapt to new processes and easy for them to magnify minor problems into major complaints.
306
Rollback plan
A rollback plan is when a change can be reversed if it has harmful or unforeseen consequences.
307
Affected systems
Affected systems must be considered in the implementation of change. Companies should first attempt to test the change for the most significant or major changes.
308
A technician configures a method to run some server application from a network and make it accessible to the internet. What is this method?
Port forwarding means that the router requests an internet host for a particular service and sends the request to a designated host on the LAN.
309
DHCP reservation
The Dynamic Host Configuration Protocol (DHCP) reservation means that the DHCP server always assigns the same IP address to the host. A user can usually choose which IP address this should be.
310
Disabling unused ports
Disabling unused ports so that only the enabled services will be enabled. If a service is unused, then it should be accessible. If a port-forwarding rule is no longer required, it should be disabled or deleted completely.
311
UPnP
The universal plug-and-play (UPnP) framework sends instructions to the firewall with the correct configuration parameters to allow applications to work.
312
An attacker uses a set of tools designed to gain control of a computer and can create a backdoor with system-level privileges without the user noticing. What is this called?
A rootkit is a malware that uses an exploit to escalate privileges after installation. The malware runs as a root with unrestricted access to everything from the root of the file system.
313
Ransomware
Ransomware is malware that tries to extort money from the victim.
314
Keylogger
Keylogger is spyware that actively attempts to steal confidential information by recording keystrokes. The attacker will usually hope to discover passwords or credit card data.
315
Cryptominer
Cryptominer hijacks the resources of the host to perform cryptocurrency mining. Cryptomining is often performed across botnets which are also referred to as cryptojacking.
