Computers 2h

Question #351

Topic 1

A technician successfully removed malicious software from an infected computer after running updates and scheduled scans to mitigate future risks. Which of the following should the technician do next?

• • A. Educate the end user on best practices for security.

• • B. Quarantine the host in the antivirus system.

• • C. Investigate how the system was infected with malware.

• • D. Create a system restore point.

Answer explanation

Before educating the user you should create a system restore point.

CompTIA has identified a seven-step best practice procedure for malware removal: 1. Investigate and verify malware symptoms. 2. Quarantine infected systems. 3. Disable System Restore in Windows. 4. Remediate infected systems: a) Update anti-malware software. b) Scanning and removal techniques (e.g., safe mode, preinstallation environment). 5. Schedule scans and run updates. 6. Enable System Restore and create a restore point in Windows. 7. Educate the end user.

Question #352

Topic 1

An administrator responded to an incident where an employee copied financial data to a portable hard drive and then left the company with the data. The administrator documented the movement of the evidence. Which of the following concepts did the administrator demonstrate?

• • A. Preserving chain of custody

• • B. Implementing data protection policies

• • C. Informing law enforcement

• • D. Creating a summary of the incident

Answer explanation

A. Preserving chain of custody The administrator demonstrated the concept of preserving the chain of custody by documenting the movement of the evidence, which, in this case, involves the financial data copied to a portable hard drive. Explanation: Preserving chain of custody (Option A): Chain of custody refers to the chronological documentation or paper trail showing the collection, transfer, control, analysis, and disposition of physical or electronic evidence.

Question #353

Topic 1

A user requires a drive to be mapped through a Windows command line. Which of the following command-line tools can be utilized to map the drive?

• • A. gpupdate

• • B. net use

• • C. hostname

• • D. dir

Answer explanation

Type the following command to map the network drive: "net use [drive letter]: \[network location][shared folder name]." For example, to map the network drive to drive letter Z: and the network location \server\shared, type "net use Z: \server\shared

Question #354

Topic 1

Users access files in the department share. When a user creates a new subfolder, only that user can access the folder and its files. Which of the following will MOST likely allow all users to access the new folders?

• • A. Assigning share permissions

• • B. Enabling inheritance

• • C. Requiring multifactor authentication

• • D. Removing archive attribute

Answer explanation

B. Enabling inheritance Enabling inheritance is the action that would most likely allow all users to access the new folders. Explanation: Enabling inheritance (Option B): Enabling inheritance allows new folders and files to inherit the permissions of their parent folder. If a user creates a new subfolder within the department share, enabling inheritance would mean that the new subfolder automatically inherits the permissions of the parent department share, providing access to other users.

Question #355

Topic 1

A computer technician is investigating a computer that is not booting. The user reports that the computer was working prior to shutting it down last night. The technician notices a removable USB device is inserted, and the user explains the device is a prize the user received in the mail yesterday. Which of the following types of attacks does this describe?

• • A. Phishing

• • B. Dumpster diving

• • C. Tailgating

• • D. Evil twin

Answer explanation

This scenario describes a Phishing attack. Phishing often involves tricking the user into opening a malicious attachment or visiting a malicious site. In this case, the user received a USB device (the “prize”) in the mail, which likely contained malicious software that caused the computer to stop booting. So, the correct answer is: A. Phishing

Question #356

Topic 1

A macOS user is installing a new application. Which of the following system directories is the software most likely to install by default?

• • A. /etc/services

• • B. /Applications

• • C. /usr/bin

• • D. C:\Program Files

Answer explanation

• The default installation directory for applications on Mac OS is /Applications/

Question #357

Topic 1

A customer is requesting help with a technical issue. Which of the following techniques should the technician use to properly evaluate and correct the customer concern?

• • A. Have a videoconference using the customer’s personal phone so the customer can share the screen.

• • B. Ask yes or no questions so that the answers are clear.

• • C. Use open-ended questions to get additional information.

• • D. Ask for the customer’s password so the issue can be resolved quickly and directly by the technician.

Answer explanation

C. Use open-ended questions to get additional information. When dealing with technical issues, using open-ended questions is a good technique to gather additional information and understand the customer's concern more thoroughly. Open-ended questions encourage customers to provide detailed explanations, helping the technician to diagnose the problem accurately.

Question #358

Topic 1

A user is setting up backups on a workstation. The user wants to ensure that the restore process is as simple as possible. Which of the following backup types should the user select?

• • A. Full

• • B. Incremental

• • C. Differential

• • D. Synthetic

Answer explanation

• A. Full For a simple and straightforward restore process, the user should select a Full backup. In a Full backup, all selected files and data are backed up, providing a complete copy of the entire dataset at the point in time when the backup was created. When restoring from a Full backup, there is no need for multiple backup sets or other backups to be available. It's a standalone backup that contains all the necessary data for a complete restore.

Question #359

Topic 1

A user notices a small USB drive is attached to the user’s computer after a new vendor visited the office. The technician notices two files named grabber.exe and output.txt. Which of the following attacks is most likely occurring?

• • A. Trojan

• • B. Rootkit

• • C. Cryptominer

• • D. Keylogger

Answer explanation

The presence of "grabber.exe" and "output.txt" does indeed suggest characteristics of a keylogger rather than a typical Trojan. A keylogger is a specific type of malware designed to record keystrokes on a computer, often used to capture sensitive information like passwords. So, in this context, the most likely attack occurring is: D. Keylogger

Question #360

Topic 1

Which of the following ls command options is used to display hidden files and directories?

• • A. -a

• • B. -s

• • C. -lh

• • D. -t

Answer explanation

To show hidden files, you need to include the /a:h modifier in that command. So, dir /a:h C:your-folder will do the trick. CMD also has specific commands for showing directories and folders. /a:d shows all hidden directories, and /a shows hidden folders