A+, Core 2, Practice Test 3

Question 1

A Windows administrator would like to query the local DNS server to view the IP address for www.professormesser.com. Use a command line utility to view this information.

Answer 1

The nslookup (name server lookup) command can query a DNS server for information about IP addresses, fully qualified domain names, email server addresses, and other important name services.

Question 2

Match the Linux command to the description. Some descriptions will not have a match.

Answer 2

Question 3

A user has contacted the help desk because they are not able to browse any websites. The technician suspects a fault with the server that converts fully qualified domain names to IP addresses. What command line would confirm connectivity to this server?

Answer 3

The device that converts between fully qualified domain names and IP addresses is the DNS (Domain Name System) server. The nslookup results show the configured DNS server is located at 9.9.9.9, and the ping command is the easiest way to confirm the connectivity of the device.

Question 4

Match the Control Panel utilities to the description. Some descriptions will not have a match.

Answer 4

Question 5

. A system administrator would like to remove the TFTP Client in Windows 10. Which of the following Control Panel options would be the BEST choice for this task?

❍ A. Programs and Features
❍ B. Services
❍ C. Network and Sharing Center
❍ D. File Explorer options

Answer 5

The Answer: A. Programs and Features
The Programs and Features option of the Control Panel is used to view and manage installed applications, or to enable or disable individual Windows features.

The incorrect answers:
B. Services
The Services utility would allow the administrator to disable a TFTP service, or any other Windows service. To remove a client or Windows feature, the administrator would need to use Programs and Features.
C. Network and Sharing Center
The Network and Sharing Center manages all network adapters and sharing settings in Windows. The Network and Sharing Center does not enable or disable individual application use.
D. File Explorer options
The File Explorer options are used to customize the options available in the File Explorer, change the view in the window, and modify the Windows search options. File Explorer does not control the use of individual applications.

Question 6

An attacker has gained access to a password hash file. Which of the following will the attacker use to obtain the passwords?
❍ A. DoS
❍ B. Decryption
❍ C. Brute force
❍ D. Phishing

Answer 6

The Answer: C. Brute force
Since a hash is a one-way cryptographic method, the only way to determine the original plaintext is to try every possible combination until the hash is matched. This brute force method is the only way to determine the original source of the hash.

The incorrect answers:
A. DoS
A DoS (Denial of Service) would cause a service to be unavailable to others. A DoS attack would not determine the original passwords based on a hash.
B. Decryption
A hash is a one-way function and it’s not encrypted data, so there’s no option available for decrypting the passwords.
D. Phishing
Phishing is a social engineering method that convinces someone to willingly provide secret or private information. Performing a brute force attack on a hash file is not a method of phishing.

Question 7

A server administrator needs to create a folder on a Windows server to store weekly status report documents. Which of the following command- line tools would provide this functionality?
❍ A. md
❍ B. net use
❍ C. cd
❍ D. dir
❍ E. ls

Answer 7

The Answer: A. md
The md (Make Directory) command is used to create a subdirectory or folder on the file system.

The incorrect answers:
B. net use
The net command is used for many different Windows-related functions. The net use option will associate a drive letter with a Windows share.
C. cd
The cd (Change Directory) command is used to change the current command line context to a different working directory. The cd command is used in both Windows and Linux.
D. dir
The Windows dir (Directory) command is used to provide a list of the files and objects in the file system.
E. ls
The ls (list directory) command is used to view the files and objects in the Linux file system. This is the Linux equivalent of the Windows dir command.

Question 8

Which of the following would be the BEST choice for a system administrator to manage an Active Directory database?
❍ A. Batch file
❍ B. PowerShell
❍ C. JavaScript
❍ D. Visual Basic Scripting

Answer 8

The Answer: B. PowerShell
PowerShell is Microsoft’s command line scripting environment for the Windows operating system and provides integrations to automate almost every aspect of Windows.

The incorrect answers:
A. Batch file
A batch file provides access to the Windows file system, but it does not directly integrate with a Microsoft Active Directory database.
C. JavaScript
JavaScript is commonly used in a browser to customize aspects of the user interface or a website. JavaScript would not be the first choice to manage an Active Directory database.
D. Visual Basic Scripting
Visual Basic Scripting provides general purpose scripting in Windows, and very commonly in Microsoft Office applications. Visual Basic Scripting would not be the best choice for Active Directory automation.

Question 9

A desktop technician has received a complaint that a remotely-hosted application has stopped working. The technician believes that a network outage at the application provider is the root cause of the issue. Which of the following tools would be the BEST choice to confirm the location of the outage?
❍ A. ping
❍ B. nslookup
❍ C. netstat
❍ D. tracert

Answer 9

The Answer: D. tracert
The tracert (traceroute) utility will show the network routes between two devices. If the route is disrupted between those two devices, the last available router will be identified.

The incorrect answers:
A. ping
The ping command will identify devices on the network, but it does not provide any location details if the device does not respond.
B. nslookup
The nslookup (Name Server Lookup) command will query a DNS (Domain Name System) server to identify IP addresses and fully qualified domain names. The nslookup command does not provide any information about network traffic or outages.
C. netstat
The netstat command will display connections, routes, and other network statistics associated with a single device. The netstat command does not provide any information about the uptime and availability of a remote network connection.

Question 10

A Linux administrator is using the grep command while monitoring a database application. Which of the following would BEST describe this activity?
❍ A. Search through a file for specific text
❍ B. View a list of running processes
❍ C. Change the permissions of a file
❍ D. View the name of the working directory

Answer 10

The Answer: A. Search through a file for specific text
The grep command is used to search through a file or set of files for specific text.

The incorrect answers:
B. View of list of running processes
The ps (Process List) command is commonly used to view all of the running processes on a Linux computer. This is similar in functionality to the Windows Task Manager.
C. Change the permissions of a file
The Linux chmod (Change Mode) command is used to change the permissions of a file for the file owner, the file group, and everyone else.
D. View the name of the working directory
The pwd (Print Working Directory) command is used to display the current working directory path. This command is the same in both Windows and Linux.

Question 11

A company requires all users to authenticate to a proxy before communicating to external websites. Which of the following should be used to integrate the proxy authentication with the existing Active Directory credentials?
❍ A. AES
❍ B.TKIP
❍ C. RADIUS
❍ D. WPA3

Answer 11

The Answer: C. RADIUS
RADIUS (Remote Authentication Dial-in User Service) is an authentication protocol used to integrate with many existing user databases. It’s common to use RADIUS to connect a service with an Active Directory database to use for centralized authentication.

The incorrect answers:
A. AES
AES (Advanced Encryption Standard) is an encryption protocol, and AES does not integrate a third-party service with an Active Directory database.
B. TKIP
TKIP (Temporal Key Integrity Protocol) was commonly used with the original WPA (Wi-Fi Protected Access) encryption method on 802.11 wireless networks. WPA and TKIP are no longer recommended as encryption and integrity mechanisms.
D. WPA3
WPA3 (Wi-Fi Protected Access version 3) is an encryption technology for 802.11 wireless networks. WPA3 does not provide authentication integration to Active Directory databases.

Question 12

A desktop administrator has been tasked with removing malware from an executive’s laptop computer. The system has been removed from the network, but the Windows startup process shows a Stop Error before rebooting into a repeating cycle. Which of the following would be the best NEXT step in the malware removal process?
❍ A. Perform a Windows Repair installation
❍ B. Boot with a pre-installation environment
❍ C. Schedule periodic scans
❍ D. Create a restore point

Answer 12

The Answer: B. Boot with a pre-installation environment
A Windows PE (Pre-installation Environment) can be used to boot into the Windows Recovery Console to resolve problems with the primary operating system. This is a common task when the primary operating system has been corrupted or will not boot properly.

The incorrect answers:
A. Perform a Windows Repair installation
A Windows Repair installation may resolve the rebooting issue, but
it may also make unintended changes to the operating system. Before making significant changes, it would be worthwhile to try fixing the issue manually.
C. Schedule periodic scans
Because the system is constantly rebooting, it’s not possible to make configuration changes to the anti-virus scanner or the Task Scheduler.
D. Create a restore point
If a restore point already existed, it may be possible to reboot to a previous configuration. However, it would be too late to create a restore point with the existing faulty configuration.

Question 13

A system administrator would like to upgrade a user’s Windows video editing application to the latest version, but the upgrade utility fails with the error “Not enough free space.” Which of the following utilities would allow the system administrator to resolve this issue?
❍ A. cleanmgr
❍ B. perfmon
❍ C. eventvwr
❍ D. taskschd
❍ E. diskmgmt

Answer 13

The Answer: A. cleanmgr
The cleanmgr.exe (Disk Cleanup) utility will find unused or unneeded files and remove them from the file system. This might include temporary Internet files, error reports, downloaded program files, and others.

The incorrect answers:
B. perfmon
The perfmon.msc (Performance Monitor) utility displays long-term graphs and collects data regarding CPU, network, memory, and other system resources.
C. eventvwr
The eventvwr.msc (Event Viewer) utility provides a log of all operating system, application, and security events in Microsoft Windows.
D. taskschd
The Windows taskschd.msc (Task Scheduler) allow the scheduling of an application or script.
E. diskmgmt
Disk operations can be managed through the diskmgmt.msc (Disk Management) utility.

Question 14

A user in the shipping department is using a tracking app on a tablet. The app normally takes 10 seconds to load, but is now taking over a minute before it can be used. Tracking searches that normally take seconds are taking almost a minute to show the tracking details. Other tablets are not experiencing this slowdown. Which of the following would be the best NEXT troubleshooting step?

❍ A. Reinstall the tracking app
❍ B. Check the app battery usage
❍ C. Roll back to the previous tablet OS version
❍ D. Perform a reboot

Answer 14

The Answer: D. Perform a reboot
Before making any significant changes, a reboot can be used to clear memory space and reset any potential conflicts.

The incorrect answers:
A. Reinstall the tracking app
Reinstalling the tracking app would make a change to the system. It would be much more efficient to reset the system and test before making any changes to the existing software.
B. Check the app battery usage
The performance of the app appeared to be related to performance on the network, and it did not appear that the battery usage was related to the issue.
C. Roll back to the previous tablet OS version
It would be useful to gather more troubleshooting information before making any significant system changes.

Question 15

A help desk is receiving reports that a group of devices is not able to communicate outside of their local IP subnet. A technician can ping devices on the same network, but does not receive a response when pinging the IP address of external devices. Which of the following would be the MOST likely cause of this issue?
❍ A. Default gateway
❍ B. DNS server
❍ C. Proxy server
❍ D. Metered connection

Answer 15

The Answer: A. Default gateway
The default gateway is the router providing the communication between the local IP subnet and the rest of the world. If the default gateway isn’t working, users will not be able to access services that are outside of the local subnet.

The incorrect answers:
B. DNS server
The DNS server converts between a fully qualified domain name and an IP address. In this example, the technician was attempting to ping external devices by IP address, so the DNS server would not be part of this issue.
C. Proxy server
A proxy server is commonly used to provide security for incoming or outgoing web services. A technician pinging an external IP address would not commonly be communicating through a proxy server.
D. Metered connection
A metered connection will limit the type and amount of traffic sent over a network connection. Since the pings are working for one device, it’s safe to assume the network connections are not metered or restricted.

Question 16

A user’s workstation has been identified as participating in a DDoS to a large Internet service provider. The computer has been powered down and stored in a locked area until investigators arrive. Which of these procedures would be the MOST important to follow in the meantime?

❍ A. Create documentation of the storage area
❍ B. Retrieve logs from the workstation Event Viewer
❍ C. Obtain the purchase records of the workstation
❍ D. Maintain integrity of the workstation data

Answer 16

The Answer: D. Maintain integrity of the workstation data
When a security event occurs, it’s important to maintain the integrity of the evidence and create a chain of custody. The data currently stored on the workstation should not be modified in any way.

The incorrect answers:
A. Create documentation of the storage area
Documenting the storage area would not be the most important part of the incident response process. If documentation is needed later, it can be created at that time.
B. Retrieve logs from the workstation Event Viewer
The workstation has been powered off and locked away to avoid changing any data on the storage drives. Starting the system to retrieve the logs would modify information on the storage drives.
C. Obtain the purchase records of the workstation
The purchase records of the workstation are not the most important piece of information for this security event. If the records are required later, they can be retrieved at that time.

Question 17

A user has noticed his computer begins to slow down during daily use and eventually locks up completely. During the lock up, the keyboard and mouse do not respond and the screen does not show any error messages. Which of the following tasks should a technician follow to BEST troubleshoot this issue? (Choose TWO)

❍ A. Start the computer in Safe Mode
❍ B. Perform a hardware diagnostic
❍ C. Connect the computer to a different VLAN
❍ D. Update the OS to the latest patches
❍ E. Roll back to a previous configuration
❍ F. Scan for viruses and malware

Answer 17

The Answer: B. Perform a hardware diagnostic, and F. Scan for viruses and malware

Without knowing the root cause of the issue, it will be important to gather as much information about the issue without making any changes to the operating system or applications. A diagnostic would provide information about the health of the hardware, and scanning for viruses would check for any malicious software. Neither of those options would make any changes to the configuration of the system.

The incorrect answers:
A. Start the computer in Safe Mode
Since this issue occurs over time, simply staring the computer in Safe Mode would not provide much information about the issue.
C. Connect the computer to a different VLAN
The issue does not appear to be related to network connectivity, so choosing a different VLAN for this computer would most likely not result in any change. VLAN assignments don’t tend to slow computers down over time, so this would also not be a common solution to the issue.
D. Update the OS to the latest patches
Before making any changes to the operating system, it would be more important to gather information and test components without changing application or operating system files.
E. Roll back to a previous configuration
There’s no evidence that the current issue is related to a specific changes, so rolling back to a previous configuration would not be the best of the available options. This option would also make changes to the existing configuration before understanding what the root cause might be.

Question 18

A system administrator is installing a file server into the corporate data center. Which of the following would be the BEST way to improve security of the file sharing service? (Select TWO)

❍ A. Enable a BIOS user password
❍ B. Connect the server to a wireless network
❍ C. Limit the number of concurrent connections
❍ D. Disable guest account
❍ E. Enable file storage quotas
❍ F. Enable password complexity

Answer 18

The Answers: D. Disable guest account, and F. Enable password complexity
The only available options associated with server security are those to disable guest accounts and increase the complexity of the passwords. Guest accounts can be exploited, and passwords that are easy to guess or set to defaults can be discovered by an attacker.

The incorrect answers:
A. Enable a BIOS user password
Enabling a password during the startup process does not protect the server once it has started.
B. Connect the server to a wireless network
Wireless networks do not provide any additional application security. Connecting to a wireless network would not improve the security posture of the server.
C. Limit the number of concurrent connections
Limiting concurrent connections would restrict the throughput of the service and would not provide any security enhancements.
E. Enable file storage quotas
Storage quotas would conserve storage space on the server, but they would not provide any additional security enhancements.

Question 19

Which of the following should a company use to reduce their legal liability if an employee is dismissed?

❍ A. End user licensing agreement
❍ B. Acceptable use policy
❍ C. Standard operating procedures
❍ D. Regulatory compliance documentation

Answer 19

The Answer: B. Acceptable use policy
An Acceptable Use Policy (AUP) provides detailed documentation on the correct and expected use of company assets. If someone is dismissed, this document will provide a well-documented set of reasons to legally justify the dismissal.

The incorrect answers:
A. End user licensing agreement
An end user licensing agreement (EULA) is a document with the terms of use for software. Most software installations include an EULA that must be accepted before the software will install.
C. Standard operating procedures
Standard operating procedures are used by an organization to standardize the process used during the normal course of business. Situations involving downtime or facilities issues are handled using the company’s documented set of standard operating procedures.
D. Regulatory compliance documentation
Many companies must comply with local, state, or federal regulations. This compliance is specific to an industry or situation, and may not apply to all companies or individuals.

Question 20

A company is donating ten laptop computers to a local community center. Which of the following processes should be followed before making
this donation?
❍ A. Inventory management
❍ B. Acceptable use policy
❍ C. Password policy
❍ D. Knowledge base article

Answer 20

The Answer: A. Inventory management
The donated systems must be removed from the inventory system and documentation needs to detail the donation process.

The incorrect answers:
B. Acceptable use policy
An acceptable use policy is documentation used to understand how company assets should be used by employees and representatives of the company.
C. Password policy
A password policy is created by the organization’s security team to document the complexities required for passwords, the aging of passwords, and the password change and reset process. The password policy would not be associated with a donation of equipment.
D. Knowledge base article
Many organizations maintain a knowledge base of information about their internal systems and technical changes. A knowledge base is not commonly referenced when making an equipment donation.

Question 21

A technician is troubleshooting a problem on a Linux server and needs to view the real-time CPU and memory utilization for each operating system process. Which of the following would provide this functionality?

❍ A. dig ❍ B. df ❍ C.cat ❍ D. top

Answer 21

The Answer: D. top
The linux top command is a common methods of viewing real-time information about CPU, RAM, and resource utilizations. This information is updated every second by default and can quickly identify highly utilized processes.

The incorrect answers:
A. dig
The dig command is used to query DNS (Domain Name System) servers and view the configuration of the DNS database.
B. df
The df (Disk Free) command displays filesystem information and the free space available for each volume.
C. cat
The cat (Concatenate) command is used to combine files together on the screen or as part of a file.

Question 22

Which of the following would allow someone else in the room to maliciously obtain a username and password?
❍ A. Spoofing
❍ B.Tailgating
❍ C. DoS
❍ D. Shoulder surfing

Answer 22

The Answer: D. Shoulder surfing
Shoulder surfing is a low-tech method of obtaining login credentials and other sensitive information. With shoulder surfing, the attacker simply watches over the shoulder of someone else to obtain the information they need.

The incorrect answers:
A. Spoofing
Spoofing is the process of impersonating another device. This is commonly accomplished by configuring a MAC (Media Access Control) address or IP (Internet Protocol) address to match an existing system on the network.
B. Tailgating
Tailgating is an unauthorized user gaining access to an area by using the credentials of an authorized user. Tailgating is not used to obtain usernames and passwords.
C. DoS
A DoS (Denial of Service) describes the process of forcing a service to fail or become unavailable. A DoS is not commonly used to obtain user credentials.