Jason Dion - CompTIA A+ 1002 Exam Prep #1 Flashcards

Question

What does the command "shutdown /s" do on a Windows workstation? Reboot the Workstation Log Off the Workstation Shutdown the Workstation Enter Sleep Mode

Answer 1

Shutdown the Workstation ``` Explanation: shutdown /s = shutdown shutdown /l = log off shutdown /h = hibernate or sleep mode shutdown /r = reboot ```

Answer 2

SFC (System File Checker)

Answer 3

bootrec /fixmbr Explanation: The master boot record (MBR) is the first 512-byte sector on a hard disk. It contains the partitioning information for a drive. To repair the master boot record (MBR), you should use the command "bootrec /fixmbr" and reboot the computer. If the disk cannot be detected, enter the system setup and try modifying settings (or even resetting the default settings). If the system firmware reports the disk's presence, but Windows still will not boot, use a startup repair tool to open a recovery mode command prompt and use the bootrec tool to repair the drive's boot information. The "bootrec /fixboot" command is used to attempt a repair of the boot sector of a drive. The "bootrec /rebuildbcd" command is used to add missing Windows installations to the Boot Configuration Database (BCD). The diskpart command is a command-line disk-partitioning utility available for Windows that is used to view, create, delete, and modify a computer's disk partitions.

Answer 4

Enable Network Discovery

Answer 5

MAC Filtering

Answer 6

Attempt to restore to a test server from one of the backup files to verify them.

Answer 7

Event Viewer

Answer 8

An Uninterruptible Power Supply (UPS)

Answer 9

Worm Explanation A worm is a standalone malware computer program that replicates itself to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. A worm can spread on its own, whereas a virus needs a host program or user interaction to propagate itself. A virus is malicious software designed to infect computer files or disks when it is activated. A virus may be programmed to carry out other malicious actions, such as deleting files or changing system settings. A trojan is a type of malware that looks legitimate but can take control of your computer. A Trojan is designed to damage, disrupt, steal, or in general, inflict some other harmful action on your data or network. The most common form of a trojan is a Remote Access Trojan (RAT), which allows an attacker to control a workstation or steal information remotely. To operate, a trojan will create numerous processes that run in the background of the system. Ransomware is a type of malware designed to deny access to a computer system or data until a ransom is paid. Ransomware typically spreads through phishing emails or by unknowingly visiting an infected website. Once infected, a system or its files are encrypted, and then the decryption key is withheld from the victim unless payment is received.

Answer 10

Tailgating

Answer 11

Remediate the Infected Systems Explanation: The seven steps of the malware removal procedures are (1) Investigate and verify malware symptoms, (2) Quarantine the infected systems, (3) Disable System Restore in Windows, (4) Remediate the infected systems, update anti-malware software, scan the system, and use removal techniques (e.g., safe mode, pre-installation environment), (5) Schedule scans and run updates, (6) Enable System Restore and create a restore point in Windows, and (7) Educate the end user.

Answer 12

BYOD (Bring Your Own Device) Explanation BYOD (Bring Your Own Device) refers to the policy of permitting employees to bring personally owned devices to their workplace and to use those devices to access privileged company information and applications. A memorandum of understanding (MOU) is important because it defines the responsibilities of each party in an agreement, provides the scope and authority of the agreement, clarifies terms, and outlines compliance issues. A non-disclosure agreement (NDA) is a legal contract or part of a contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share for certain purposes but wish to restrict access to. A service level agreement (SLA) is a commitment between a service provider and a client for particular aspects of the service, such as quality, availability, or responsibilities.

Answer 13

In-Place Upgrade

Answer 14

Phishing Explanation: Phishing is an email-based social engineering attack in which the attacker sends an email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim. Phishing attacks target an indiscriminate large group of random people. The email in this scenario appears to be untargeted since it was sent to both customers and non-customers of this particular bank so it is best classified as phishing. Spear phishing is the fraudulent practice of sending emails from a seemingly known or trusted sender to induce targeted individuals to reveal confidential information. Whaling is an email-based or web-based form of phishing that targets senior executives or wealthy individuals. A brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly.

Answer 15

Time Machine

Answer 16

chmod Explanation: The chmod command sets the permissions of files or directories on a Linux system. A set of flags associated with each file determines who can access that file and how they can access it. These flags are called file permissions or modes. The command name chmod stands for change mode and it restricts the way a file can be accessed. The chown command is used to change the owner of the file, directory, or link in Linux. The passwd command changes passwords for user accounts. A normal user may only change the password for their account, while the superuser may change the password for any user. The pwd command displays the present working directory (current directory) path to the terminal or display. If you are working on a Linux system and are unsure of where you are in the directory structure, type "pwd" and hit enter to display the path to the screen.

Answer 17

Configure the ability to perform a remote wipe Enable full device encryption Explanation: The BEST protections for the data would involve enabling full disk encryption and configuring the ability to perform a remote wipe. Even if the device is lost or stolen, its data would be unreadable if it was using full disk encryption. Additionally, by configuring the ability to wipe the device's storage remotely, the data would be erased before a thief can access it. The other options are all valid options to increase security, but they do not directly address the issues presented in the scenario.

Answer 18

Sleep Explanation: (My Take) Sleep - Think of someone that can easily be woken up from Sleep. Hibernate - Think of animals that "Hibernate" for the Winter, they generally aren't bothered and won't come out of it till the Winter is over. Exam Explanation: Sleep or standby mode is used to save the current session to memory and put the computer into a minimal power state to save battery life when the system is not being used. The computer takes less time to start up again from the sleep or standby mode than it does from the hibernate mode. Hibernate mode is used to save the current session to disk before powering off the computer to save battery life when the system is not being used. The computer takes longer to start up again from hibernate mode than it does from the sleep or standby mode. Shutdown mode completely powers off the computer and does not save the current user session to disk. Instead, the shutdown will close all open files and log out the user during the shutdown process. A lock will secure the desktop with a password while leaving programs running.

Answer 19

Door Locks

Answer 20

Shoulder Surfing

Answer 21

The Workstation couldn't reach the DHCP Server.

Answer 22

Rollback any System Updates or changes since yesterday

Answer 23

Installing an image to the computer over the network

Answer 24

Multifactor WPA2 Explanation Since everything is being stored within a cloud-based SaaS application, the doctor's office needs to ensure their network connection uses the highest encryption level (WPA2), and their desktop authentication should use a multifactor authentication system. Multifactor authentication relies on using at least 2 of the following factors: something you know (password or pin), something you have (smart card or key fob), something you are (fingerprint or retinal scan), or something you do (draw a pattern or how you sign your name). Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard. WPA2 features an improved method of key distribution and authentication for enterprise networks, though the pre-shared key method is still available for home and small office networks. WPA2 uses the improved AES cipher with counter mode with cipher-block chaining message authentication protocol (CCMP) for encryption. Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption. WEP relies on the use of a 24-bit initialization vector to secure its preshared key. The Wi-Fi Protected Setup (WPS) is a mechanism for auto-configuring a WLAN securely for home users. On compatible equipment, users push a button on the access point and connect adapters to associate them securely. WPS is subject to brute force attacks against the PIN used to secure them, making them vulnerable to attack. The Remote Authentication Dial-in User Service (RADIUS) is used to manage remote and wireless authentication infrastructure. Users supply authentication information to RADIUS client devices, such as wireless access points. The client device then passes the authentication data to an AAA (Authentication, Authorization, and Accounting) server that processes the request. Single sign-on (SSO) is a type of mutual authentication for multiple services that can accept the credential from one domain or service as authentication for other services.

Answer 25

FaceID | TouchID

Answer 26

A notice of a legal hold Explanation A legal hold is a process that an organization uses to preserve all forms of relevant information when litigation is reasonably anticipated. If a legal hold notice has been given to the backup service, they will not destroy the old backup tapes until the hold is lifted. The process of discovery is the formal process of exchanging information between the parties about the witnesses and evidence they will present at trial. The chain of custody is the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of materials, including physical or electronic evidence. A data transport request is a formalized request to initiate a data transfer by establishing a circuit or connection between two networks.

Answer 27

BYOD (Bring Your Own Device) ``` Explanation The BYOD (bring your own device) strategy opens a network to many vulnerabilities. People can bring their personal devices to the corporate network, and their devices may contain vulnerabilities that could be allowed to roam free on a corporate network. ``` COPE (company-owned/personally enabled) means that the company provides the users with a smartphone primarily for work use, but basic functions such as voice calls, messaging, and personal applications are allowed, with some controls on usage and flexibility. With CYOD, the user can choose which device they wish to use from a small selection of devices approved by the company. The company then buys, procures, and secures the device for the user. The MDM is a mobile device management system that gives centralized control over COPE company-owned personally enabled devices.

Answer 28

passwd Explanation: passwd command is used to change a user's account password on a Linux system. A normal user can run passwd to change their password, and a system administrator (the superuser) can use passwd to change another user's password or define how that account's password can be used or changed. chmod command sets the permissions of files or directories on a Linux system. A set of flags associated with each file determines who can access that file and how they can access it. These flags are called file permissions or modes. The command name chmod stands for change mode and it restricts the way a file can be accessed. chown command is used to change the owner of the file, directory, or link in Linux. pwd command displays the present working directory (current directory) path to the terminal or display. If you are working on a Linux system and are unsure of where you are in the directory structure, type "pwd" and hit enter to display the path to the screen.

Answer 29

traceroute Explanation: traceroute command is used on Linux, Unix, and OS X devices to show details about the path that a packet takes from a host to a target and displays information about each hop in the path. While using ping will tell you if the remote website is reachable or not, it will not tell you where the connection is broken. Traceroute performs a series of ICMP echo requests to determine which device in the connection path is not responding appropriately. This will help identify if the connectivity issue lies within your workstation and the server since the traffic must be routed between the two networks. dig command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. ifconfig tool is used on Linux, Unix, and OS X devices to display the current TCP/IP network configuration, assign an IP address, and assign configure TCP/IP settings for a given network interface.

Answer 30

chown Explanation: The chown command changes user ownership of a file, directory, or link in Linux. Every file is associated with an owning user or group. The chmod command sets the permissions of files or directories on a Linux system. A set of flags associated with each file determines who can access that file and how they can access it. These flags are called file permissions or modes. The command name chmod stands for change mode and it restricts the way a file can be accessed. The passwd command changes passwords for user accounts. A normal user may only change the password for their account, while the superuser may change the password for any user. The pwd command displays the present working directory (current directory) path to the terminal or display. If you are working on a Linux system and are unsure of where you are in the directory structure, type "pwd" and hit enter to display the path to the screen.

Answer 31

Open-Source

Answer 32

The smartphone is connected to the FreeAirportWIFI but is not authenticated yet.

Answer 33

Risk Analysis Explanation: The risk analysis portion of the change request documentation provides the risk levels of carrying out the change, or not performing the requested change at this time. Risk is the likelihood and impact (or consequence) of a given action. It is important to understand the risk involved with a change before deciding to proceed with implementing the change. The plan of the change defines how the change or installation will occur. The change request documentation should define the 5 W's (who, what, when, where, why, and how), with the plan documentation covering how the change is implemented. For example, the plan might say that the installation will be performed manually or through an automated patching process. It may also dictate that all servers will receive the update simultaneously or that five servers will receive it first, then another ten, then the remaining twenty. The purpose of the change defines why the change or installation will occur. The change request documentation should define the 5 W's (who, what, when, where, why, and how) to define the why behind the change. For example, the purpose might be "to remediate several category one vulnerabilities so that our security is improved." The change's scope defines the area, number, size, or scale of a particular change. The change request documentation should define the exact scope of the change. In this example, only some of the Windows 2019 servers will receive the patch. If 50% of them are listed by their asset tracking number will receive the patch, this would clearly define this change's scope.

Answer 34

Server Rack | UPS

Answer 35

Disconnect the workstation from the network

Answer 36

Dumpster Diving

Answer 37

WPS Enabled | Default Administrative Login Credentials

Answer 38

Social Engineering

Answer 39

Privacy Screen

Answer 40

Time Machine

Answer 41

gpresult Explanation: A Group Policy is the primary administrative tool for defining and controlling how programs, network resources, and the operating system operate for users and computers in an organization. In an active directory environment, Group Policy is applied to users or computers based on their membership in sites, domains, or organizational units. The gpresult command is used to display the Resultant Set of Policy (RSoP) information for a remote user and computer. Because you can apply overlapping policy settings to any computer or user, the Group Policy feature generates a resulting set of policy settings when the user logs on. The gpresult command displays the resulting set of policy settings that were enforced on the computer for the specified user when the user logged on. The gpupdate command-line tool is used to update the group policy settings on a Windows system. For an administrator to force a background update of all Group Policy settings regardless of whether they have changed, they need to run "gpupdate /force" from the command line. The deployment image servicing and management (DISM) is a command-line tool used to mount and service Windows images before deployment. The dism command with the /RestoreHealth option can run a scan to identify and repair any image or virtual hard drive corruption. The system file checker (SFC) command is a utility in Windows that allows users to scan for and restore corrupted Windows system files from the command line.

Answer 42

Thumbprint and Password

Answer 43

Identify the Issue

Answer 44

Increase the Pagefile Size

Answer 45

Restart the Print Spooler Service Explanation: Based on the issue described, it is likely that the print spooler service is not started or has become hung. To fix this issue, an administrator should restart the print spooler service. The Print Spooler is software built into the Windows operating system that temporarily stores print jobs in the computer's memory until the printer is ready to print them. In some circumstances, you may need to stop and/or restart the service. To access the Print Spooler, you must open the Local Services console. If restarting the print spooler doesn't fix the issue, the technician should check the driver and determine if it is faulty and needs to be rolled back or upgraded.

Answer 46

Trojan Explanation: A trojan is a type of malware that looks legitimate but can take control of your computer. A Trojan is designed to damage, disrupt, steal, or in general, inflict some other harmful action on your data or network. The most common form of a trojan is a Remote Access Trojan (RAT), which allows an attacker to control a workstation or steal information remotely. To operate, a trojan will create numerous processes that run in the background of the system. Ransomware is a type of malware designed to deny access to a computer system or data until a ransom is paid. Ransomware typically spreads through phishing emails or by unknowingly visiting an infected website. Once infected, a system or its files are encrypted, and then the decryption key is withheld from the victim unless payment is received. A rootkit is a clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence. A rootkit is generally a collection of tools that enabled administrator-level access to a computer or network. They can often disguise themselves from detection by the operating system and anti-malware solutions. If a rootkit is suspected on a machine, it is best to reformat and reimage the system. A keylogger actively attempts to steal confidential information by capturing the data when entered into the computer by the user. This is done by recording keystrokes entered into a web browser or other application. A software keylogger can be run in the background on a victim's computer. A hardware keylogger may be placed between the USB port and the wired keyboard.

Answer 47

Perform a Remote Wipe of the Device

Answer 48

ps Explanation: ps command is used to list the currently running processes, and their PIDs and some other information depend on different options. It reads the process information from the virtual files in the /proc file system. The /proc directory contains virtual files and is known as a virtual file system. kill command sends a signal to specified processes or process groups, causing them to act according to the signal. When the signal is not specified, it defaults to -15 (-TERM), which terminates the specified process by gracefully stopping it. If "kill -9" is used instead, it will immediately kill the process. grep is a command-line utility for searching plain-text data sets for lines that match a regular expression. The grep command works on Unix, Linux, and macOS operating systems. Grep is an acronym that stands for Global Regular Expression Print. ls command lists the files or directories in the current path of a Unix, Linux, or Mac operating system. When invoked without any arguments, ls lists the files in the current working directory.

Answer 49

Moving the desktop from the production network to a quarantined VLAN

Answer 50

Reboot the Computer Explanation: If any of the .DLL files involved with Windows Update are not correctly registered, you may also encounter this problem. To solve it, open services.msc and stop the Windows Update service. Then, open a Command Prompt as the administrator and use regsvr32 for each of the 6 Windows Update DLL files (wuapi.dll, wuaueng.dll, wups.dll, wups2.dll, wuwebv.dll, and wucltux.dll). Then, open services.msc and restart the Windows Update service. Finally, restart your computer for these changes to take effect.

Answer 51

Provide documentation of the repair to the customer and thank them for their patience

Answer 52

Uninterruptible Power Supply

Answer 53

Notify your immediate supervisor

Answer 54

Device Manager

Answer 55

UTM (Unified Threat Management) Explanation: A Unified Threat Management (UTM) appliance enforces a variety of security-related measures, combining the work of a firewall, malware scanner, and intrusion detection/prevention. A UTM centralizes the threat management service, providing simpler configuration and reporting than isolated applications spread across several servers or devices. An intrusion detection system (IDS) is a device or software application that monitors a network or system for malicious activity or policy violations. Any malicious activity or violation is typically reported to an administrator or collected centrally using a security information and event management system. Unlike an IPS, which can stop malicious activity or policy violations, an IDS can only log these issues and not stop them. An intrusion prevention system (IPS) conducts the same functions as an IDS but can also block or take actions against malicious events. A Syslog server is a server that collects diagnostic and monitoring data from the hosts and network devices across a given network.

Answer 56

RAID 10 Explanation: RAID 10 provides the system with both speed and efficiency. With RAID 10, the system has a mirror of striped disks for full redundancy and double fault tolerance. RAID 10 configuration (also known as RAID 1+0) requires a minimum of four disks and mirrors data across a striped disk pair. This is not only the best option presented in this question but also the most expensive option. A RAID 0 provides disk striping (speed/performance) but not mirroring with a minimum of two disks. A RAID 1 provides mirroring (redundancy) but not disk striping with a minimum of two disks. A RAID 5 provides block-level striping with distributed parity to provide redundancy using a minimum of three disks.

Answer 57

Resolution