Operating Systems
This built-in Windows application provides a graphical interface for browsing, copying, moving, and organizing files and folders.
What is File Explorer?
This security method requires users to verify their identity using two or more different categories of authentication factors, such as a password and a fingerprint.
What is MFA (Multifactor Authentication)?
An employee receives an email impersonating the company IT department, asking them to click a link and enter their username and password on a fraudulent website.
What type of social engineering attack is this?
What is phishing?
A Windows application stops responding, but the rest of the operating system remains functional. Which Windows utility can a technician use to terminate the unresponsive application?
What is Task Manager?
Before handling sensitive internal computer components, a technician wears a grounded wrist strap to reduce the risk of damaging electronic hardware.
What type of electrical discharge is this equipment designed to prevent?
What is ESD (Electrostatic Discharge)?
A technician needs to display a Windows computer's complete TCP/IP configuration, including its MAC address, assigned DNS servers, DHCP server, and IP address. Which command should the technician execute?
What is ipconfig /all?
An organization ensures that employees receive only the permissions necessary to perform their assigned job responsibilities, reducing the potential damage from compromised accounts.
What security principle is being implemented?
What is the principle of least privilege?
A user receives a fraudulent text message claiming that their bank account has been locked. The message contains a link to a fake login page designed to steal their credentials.
What specific type of phishing attack uses SMS or text messaging?
What is smishing (SMS phishing)?
A smartphone display remains in portrait mode even when the device is turned sideways. The device's motion sensors are working normally.
Which common operating system setting should the technician check first?
What is screen rotation lock or the automatic screen rotation setting?
An IT department contracts with an external support provider. The agreement specifies expected service availability, response times, and resolution targets.
What three-letter acronym identifies this type of agreement?
What is an SLA (Service-Level Agreement)?
A macOS user needs to locate a previously saved Wi-Fi password. Which built-in Apple utility manages saved credentials, passwords, and certificates?
What is Keychain Access?
A company requires Windows laptops to have their entire operating system drives encrypted to protect sensitive information if the laptops are lost or stolen. The solution can use a TPM to protect encryption keys.
Which Windows security feature should be enabled?
What is BitLocker Drive Encryption?
An attacker creates a wireless access point with the same SSID as a nearby legitimate company wireless network.
Employees unknowingly connect to the fraudulent access point, allowing the attacker to intercept or manipulate their network traffic.
What type of attack is being performed?
What is an evil twin attack?
An Android smartphone application repeatedly crashes immediately after opening. Other applications function normally, and the affected application's data is already synchronized with its cloud account.
Before uninstalling or reinstalling the application, what less disruptive application-specific troubleshooting action should the technician attempt?
What is clearing the application's cache?
An IT technician designs a backup strategy following the 3-2-1 backup rule.
According to this rule, how many copies of the data should exist, how many different types of storage media should be used, and how many copies should be maintained offsite?
What are three total copies of the data, stored on two different types of storage media, with at least one copy maintained offsite?
A Linux administrator executes the command chmod 750 script.sh. Describe the permissions assigned to the file's owner, group, and all other users.
What are read, write, and execute for the owner; read and execute for the group; and no permissions for others?
A technician configures a Windows shared folder with the following permissions:
Share permissions: Read
NTFS permissions: Modify
A user connects to the folder over the network and can open files but cannot save changes.
What effective permission does the user have over the network, and why?
What is Read permission, because the more restrictive combination of share and NTFS permissions determines effective access over a network share?
A technician investigates a compromised workstation and discovers that malicious commands executed through PowerShell without installing a traditional executable malware file.
The malicious code ran primarily in system memory, allowing it to evade some signature-based antivirus detection methods.
What category of malware best describes this technique?
What is fileless malware?
After a technician updates a workstation's graphics driver, Windows begins displaying blue screen errors during normal startup.
The workstation successfully boots into Safe Mode, and no hardware issues are detected.
What is the most appropriate corrective action to address the suspected driver-related failure?
What is rolling back the recently updated graphics driver to the previously working version?
A company performs a full backup every Sunday and incremental backups Monday through Saturday.
A server experiences a critical failure Wednesday evening, after Wednesday's scheduled backup completed.
To restore the server to its most recent backup state, which backup sets must be restored, and why?
What are Sunday's full backup, followed by Monday's, Tuesday's, and Wednesday's incremental backups in sequence, because incremental backups contain changes since the previous backup of any type?
A Windows 11 workstation repeatedly experiences system instability. The technician runs sfc /scannow, but Windows reports that some corrupted system files could not be repaired.
The technician suspects corruption in the Windows component store itself.
Identify the command-line tool and command used to repair the component store, and the command that should be run afterward to recheck and repair system files.
What are DISM /Online /Cleanup-Image /RestoreHealth, followed by sfc /scannow?
A company wants to replace its shared wireless network password with an authentication system where every employee uses individual credentials.
The solution must authenticate users through a centralized server and allow IT to revoke one employee's access without changing the credentials of everyone else.
Identify the appropriate WPA security mode, the port-based authentication framework, and the centralized authentication service.
What are WPA2-Enterprise or WPA3-Enterprise, IEEE 802.1X, and RADIUS (Remote Authentication Dial-In User Service)?
A technician responds to a company workstation after employees report that documents have suddenly become encrypted and a message demands payment for a decryption key.
The workstation is still connected to the corporate network, and several shared folders are accessible.
Identify the malware category and the two immediate actions the technician should take before attempting remediation.
What are ransomware, isolating or quarantining the infected workstation from the network, and reporting or escalating the incident according to the organization's incident response procedures?
A Windows user reports that their web browser constantly redirects searches to unfamiliar websites and displays numerous unwanted advertisements.
The technician determines that:
Other browsers on the workstation operate normally.
Windows DNS settings are correct.
A recently installed browser extension has excessive permissions and was obtained from an untrusted source.
Identify the likely cause and two appropriate corrective actions.
What is a malicious or unwanted browser extension, removing or disabling the extension and resetting affected browser settings, and performing a reputable anti-malware scan to check for additional compromise?
During an internal security investigation, a technician is authorized to collect digital evidence from a running workstation suspected of being involved in unauthorized access to confidential company information.
The investigation requires preserving evidence that could disappear if the system loses power.
Identify which type of evidence should be collected before less volatile storage data, and the formal documentation process that records who collected, handled, transferred, and controlled the evidence.
What are volatile evidence such as system RAM, collected according to the order of volatility, and chain of custody documentation?