Jason Dion - CompTIA A+ 1002 Exam Prep #2 Flashcards
- Your coworker is creating a script to run on a Windows Server using PowerShell. Which of the following file formats should the Script use?
.py
.sh
.bat
.ps1
.ps1
Explanation:
.ps1 = If you want to save a series of PowerShell commands in a file to rerun them later, you effectively create a PowerShell script by creating a text file with a .ps1 extension. The file can contain a series of PowerShell commands, with each command appearing on a separate line.
.py = Python scripts are saved using the .py extension.
.bat = Batch scripts run on the Windows operating system and, in their simplest form, contain a list of several commands that are executed in a sequence. A .bat file is used for a batch script. You can run the file by calling its name from the command line or double-clicking the file in File Explorer. Generally, batch file scripts run from end to end and are limited in branching and user input.
.sh = A shell script is a file that contains a list of commands to be read and executed by the shell in Linux and macOS. A .sh file is used for a shell script and its first line always begins with #!/bin/bash that designates the interpreter. This line instructs the operating system to execute the script. Shell scripts allow you to perform various functions. These functions include automation of commands and tasks of system administration and troubleshooting, creating simple applications, and manipulating text or files.
- Which of the following is used to communicate data and preferences to child processes within a script or batch file?
Constants
Comments
Variables
Environmental Variables
Environmental Variables
Explanation:
Shell scripts and batch files use environment variables to communicate data and preferences to child processes. They can also be used to store temporary values for reference later in a shell script.
A variable is a placeholder in a script containing a number, character, or string of characters. Variables in scripts do not have to be declared (unlike in programming languages) but can be assigned a value. Then, the variable name is referenced throughout the script instead of the value itself.
A comment is written into the code to help a human understand the initial programmer’s logic. In Python, for example, you can use the # symbol to comment on a line of code. Anything on the line after the # is ignored by the computer when the script is being executed.
A constant is a specific identifier that contains a value that cannot be changed within the program. For example, the value to convert a number from F to C is always 5/9 because the formula is C = (F -32) * 5/9.
- You are a member of a project team contracted to install twenty new wireless access points (WAPs) for a college campus. Your team has already determined the locations for the new WAPs and notated them in the physical and logical network diagrams. Your team is still finalizing the change request documents for the installation. The project cannot move forward with the installation until the change request is finalized and approved. Which of the following is the MOST important thing to add to the scope of work and change request before its approval?
End-User Acceptance
Risk Analysis
Plan for Change
Rollback Plan
Plan for Change
Explanation:
This is a difficult question because all of these items should be included in a Request for Change (RFC), but the most important is a proper backout plan. A rollback plan is an IT governance integration approach that specifies the processes required to restore a system to its original or earlier state in the event of failed or aborted implementation. Every change should be accompanied by a rollback plan so that the change can be reversed if it has harmful or unforeseen consequences. Changes should also be scheduled sensitively if they are likely to cause system downtime or other negative impacts on the workflow of the business units that depend on the IT system being modified. Most organizations have a scheduled maintenance window period for authorized downtime. By following this guidance, the team can back out and restore service on the legacy/previous system if something goes wrong with the installation.
End-user acceptance is the process of verifying a change was successfully implemented and turned over to the end-user for future operation.
A plan for change is the documented method for installing or modifying the asset as documented in the change request. While this is important, the most important thing is still a backout plan since many changes are routine changes that do not require a detailed plan of change.
A risk analysis determines the severity level of a change and is used to help the change approval board (CAB) make an informed approval decision.
- An employee was recently moved from the Human Resources department into the Sales department. Which of the following should you check to ensure they no longer have access to the employee data stored in the Human Resource department share drives?
Credential Manager
Home Folder
Security Groups
Group Policy
Security Groups
Explanation:
A security group is a collection of user accounts that can be assigned permissions in the same way as a single user object. Security groups are used when assigning permissions and rights, as it is more efficient to assign permissions to a group than to assign them individually to each user. You can assign permissions to a user simply by adding the user to the appropriate group. In most corporate environments, security groups control access to share drives, mailing lists, and other network resources.
- You have been asked to install a computer in a public workspace. Only an authorized user should use the computer. Which of the following security requirements should you implement to prevent unauthorized users from accessing the network with this computer?
Require authentication on wake-up
Disable Single Sign-On
Issue the same strong and complex passwords for all users
Remove the guest account from the Administrator Group
Require authentication on wake-up
Explanation:
To prevent the computer from being used inadvertently to access the network, the system should be configured to require authentication whenever the computer is woken up. Therefore, if an authorized user walks away from the computer and goes to sleep when another person tries to use the computer, it will ask for a username and password before granting them access to the network. A screen lock can secure the desktop with a password while leaving programs running if a user walks away, as well.
Single sign-on (SSO) is a type of mutual authentication for multiple services that can accept the credential from one domain or service as authentication for other services.
A guest account is a Microsoft Windows user account with limited capabilities, no privacy, and is disabled by default.
Using the same password for all users is considered extremely poor security and should not be done.
- Which of the following file types are commonly used by scripts in a Linux command line environment?
.ps1
.vbs
.sh
.js
.sh
Explanation:
A shell script is a file that contains a list of commands to be read and executed by the shell in Linux and macOS. A .sh file is used for a shell script and its first line always begins with #!/bin/bash that designates the interpreter. This line instructs the operating system to execute the script. Shell scripts allow you to perform various functions. These functions include automation of commands and tasks of system administration and troubleshooting, creating simple applications, and manipulating text or files.
VBScript is a scripting language based on Microsoft’s Visual Basic programming language. Network administrators often use VBScript to perform repetitive administrative tasks. With VBScript, you can run your scripts from either the command-line or the Windows graphical interface. Scripts that you write must be run within a host environment. Windows 10 provides Internet Explorer, IIS, and Windows Script Host (WSH) for this purpose.
Windows PowerShell enables you to perform management and administrative tasks in Windows 7 and later. It is fully integrated with the operating system and supports both remote execution and scripting. Microsoft provides the Windows PowerShell Integrated Scripting Environment (ISE) to help create and manage your Windows PowerShell scripts. If you want to save a series of PowerShell commands in a file to rerun them later, you effectively create a PowerShell script by creating a text file with a .ps1 extension. The file can contain a series of PowerShell commands, with each command appearing on a separate line.
JavaScript is a scripting language that is designed to create interactive web-based content and web apps. The scripts are executed automatically by placing the script in the HTML code for a web page so that when the HTML code for the page loads, the script is run. JavaScript is stored in a .js file or as part of an HTML file.
- One of your Windows services is failing to start when you boot up your laptop. You have checked the service in the Windows Services tool and verified it is set to Automatic. What should you attempt to do NEXT to get the service to startup?
Restore from backup
Reboot into Safe Mode and see if the service starts
Update the OS
Run chkdsk on the System
Reboot into Safe mode and see if the service starts
Explanation:
Windows Services typically start when the computer is booted and run quietly in the background until it is shut down. For the Windows operating system to run smoothly, Windows Services must start when required. Many times, non-Microsoft services or Drivers can interfere with the proper functioning of System Services. If you boot into Safe Mode, this will load the operating system with the most basic set of drivers, and this could identify if there is a conflict causing the service start failure.
- A user contacts the service desk after they just finished attempting to upgrade their laptop to Windows 10. The upgrade failed, and the user asks you to explain why. Which of the following log files should you review to determine the cause of the upgrade failure?
Setup
Application Log
Security Log
System Log
Setup
Explanation:
The event viewer shows a log of application and system messages, including errors, information messages, and warnings. It’s a useful tool for troubleshooting all kinds of different Windows problems. The setup log contains a record of the events generated during the Windows installation or upgrade process. The file (setup.evtx) is stored in the %System Root%\System32\Winevt\Logs\ folder and can be opened using the Event Viewer.
The application log contains information regarding application errors. The file (application.evtx) is stored in the %System Root%\System32\Winevt\Logs\ folder and can be opened using the Event Viewer.
The system log contains information about service load failures, hardware conflicts, driver load failures, and more. The file (system.evtx) is stored in the %System Root%\System32\Winevt\Logs\ folder and can be opened using the Event Viewer.
The security log contains information regarding audit data and security on a system. For example, the security log contains a list of every successful and failed login attempt. The file (security.evtx) is stored in the %System Root%\System32\Winevt\Logs\ folder and can be opened using the Event Viewer.
- A printing company uses an isolated Windows XP workstation to print out large format banners for its customers on a custom printer. Unfortunately, the printer does not support newer versions of Windows and would cost $50,000 to replace it. To mitigate this risk, the workstation is not connected to the internet or a local area network. When a customer needs a banner printer, the technician takes a copy of their PDF file and moves it to the Windows XP workstation using a USB thumb drive. The workstation recently became infected with malware when printing a customer’s file. The technician remediated the issue, but the workstation became infected again three weeks later. Which of the following actions did the technician forget to perform?
Manually update the antivirus on the workstation and set it to perform on-access scans.
Perform a data wipe operation on the USB thumb drive before its next use
Connect the workstation to the Internet and receive the latest Windows XP patches
Disable System Restore and remove the previous restore points
Manually update the antivirus on the workstation and set it to perform on-access scans
Explanation:
This is a legacy workstation since it is running Windows XP. Since Windows XP is considered end-of-life, there are no security patches or updates available for it. To mitigate this risk, the workstation should be run only as an isolated workstation. Since the workstation is not connected to a network and receives files through the connection of a USB thumb drive, this would be the only way a piece of malware could enter the system. The technician most likely neglected to update the antivirus/antimalware software on this workstation during the remediation. The technician should manually update the antivirus/antimalware definitions weekly. The workstation should also be configured to conduct on-access/on-demand scanning, as well.
- Your boss has asked you to write a script that will copy all of the files from one hard drive to another each evening. This script should mirror the directories from one drive to the other and ensure they are synchronized each evening. Which command-line tool should you use in your script?
xcopy
cp
robocopy
copy
robcopy
Explanation:
The robocopy tool is used to mirror or synchronize directories and their contents. Robocopy will check the destination directory and remove files no longer in the main tree. It also checks the files in the destination directory against the files to be copied and doesn’t waste time copying unchanged files.
The xcopy tool, on the other hand, copies all of the files from one directory to another. To meet your boss’s requirements to synchronize the two hard drive’s contents, you must use robocopy since it will also remove files from the second drive that were removed from the first drive, too.
The copy command is used to copy one or more files from one location to another. The copy command cannot copy files that are 0 bytes long or for copying all of a directory’s files and subdirectories.
The cp command is used in Linux to copy one or more files and directories from one location to another.
- You are working on a Windows 10 workstation with a 1 TB HDD and 16 GB of memory that is operating slowly when reading large files from its storage device. Which of the following commands should you use to speed up this workstation?
ipconfig
format
chkdsk
diskpart
chkdsk
Explanation:
The chkdsk command is used to check the file system and file system metadata of a volume for logical and physical errors. If used without parameters, chkdsk displays only the status of the volume and does not fix any errors. If used with the /f, /r, /x, or /b parameters, it fixes errors on the volume.
The format command creates a new root directory and file system for the disk. It can check for bad areas on the disk, and it can delete all data on the disk. To use a new disk, you must first use the format command to format the disk.
The diskpart command is a command-line disk-partitioning utility available for Windows that is used to view, create, delete, and modify a computer’s disk partitions.
The ipconfig tool displays all current TCP/IP network configuration values on a given system.
- Which of the following is required for evidence to be admissible in a court of law?
Right to Audit
Order of Volatility
Chain of Custody
Legal Hold
Chain of Custody
Explanation:
Chain of custody forms list every person who has worked with or who has touched the evidence that is a part of an investigation. These forms record every action taken by each individual in possession of the evidence. Depending on the organization’s procedures, manipulation of evidence may require an additional person to act as a witness to verify whatever action is being taken.
A legal hold is a process that an organization uses to preserve all forms of potentially relevant information when litigation is pending or reasonably anticipated.
A right to audit is a clause in a contract or service agreement that allows a company the authority to audit the systems and information processed.
Order of volatility refers to the order in which you should collect evidence.
An attacker is using a precomputed table of values to attempt to crack your Windows password. What type of password attack is this?
Brute-Force
Hybrid
Rainbow Table
Dictionary
Rainbow Table
Explanation:
A rainbow table is a tool for speeding up attacks against Windows passwords by precomputing possible hashes. A rainbow table is used to authenticate users by comparing the hash value of the entered password against the one stored in the rainbow table. Using a rainbow table makes password cracking a lot faster and easier for an attacker.
A dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary.
A brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly.
A hybrid attack combines a dictionary list with the ability to add brute-force combinations to crack a password that is slightly different than the dictionary list entry.
Which type of authentication method is commonly used with physical access control systems and relies upon RFID devices embedded into a token?
HOTP
Smart Cards
TOTP
Proximity Cards
Proximity Cards
Explanation:
A proximity card is a contactless card that usually utilizes RFID to communicate with the reader on a physical access system. These are commonly used to access secured rooms (such as server rooms) or even a building itself (such as at an access control vestibule).
Some smart cards contain proximity cards within them, but the best answer to this question is proximity cards since that is the function of the smart card would be the device used to meet this scenario’s requirements.
An HMAC-based one-time password (HOTP) is a one-time password algorithm based on hash-based message authentication codes.
A Time-based one-time password (TOTP) is a computer algorithm that generates a one-time password that uses the current time as a source of uniqueness.
A user’s workstation is infected with malware. You have quarantined it from the network. When you attempt to boot it to the Windows 10 desktop, it fails. Which of the following should you do NEXT to begin remediating this system?
Restart into Safe Mode and conduct an antivirus scan
Disable System Restore and reinstall Windows 10
Restore the workstation from the last system restore point
Format the workstation and reinstall Windows 10
Restart into Safe mode and conduct an antivirus scan
A home user brought their Windows 10 laptop to the electronics store where you work. They claim their computer has become infected with malware. You begin troubleshooting the issue by first pressing the power button, and the laptop loads properly without any issues. When you open Microsoft Edge, you notice that multiple pop-ups appear almost immediately. Which of the following actions should you take NEXT?
Reinstall or reimage the operating system
Quarantine the machine and report it as infected to your company’s cybersecurity department for investigation
Clear the browser’s cookies and history, enable the pop-up blocker, and scan the system for malware
Document the pop-ups displayed and take screenshots
Clear the browser’s cookies and history, enable the pop-up blocker, and scan the system for malware
Which version of Windows supports Virtual Desktops?
Windows 7
Windows 10
Windows 8
Windows 8.1
Windows 10
Which of the following remote access protocols should you use to connect to a Windows 2019 server and control it with your mouse and keyboard from your workstation?
Telnet
SSH
VNC
RDP
RDP
Explanation: The RDP (remote desktop protocol) is a Windows feature that allows a remote user to initiate a connection at any time and sign on to the local machine using an authorized account. This connection allows a Windows administrator to see and control what is on a remote computer's screen. RDP authentication and session data are always encrypted. This means that a malicious user with access to the same network cannot intercept credentials or interfere or capture anything transmitted during the session.
Secure Shell (SSH) uses port 22 to securely create communication sessions over the Internet for remote access to a server or system.
Telnet uses port 23 to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection but sends its data in plaintext making it an insecure protocol.
Virtual Network Computing (VNC) is a cross-platform screen sharing system that was created to remotely control another computer from a distance by a remote user from a secondary device as though they were sitting right in front of it.
You are working as a military defense contractor and have been asked to dispose of 5 laptop hard drives used in systems that processed classified information. Which of the following physical data destruction and disposal methods is MOST appropriate to ensure the data cannot be recovered?
Low-level formatting of the HDDs
Standard formatting of the HDDs
Drill/Hammer the HDD Platters
Degaussing the HDDs
Degaussing the HDDs
A user is complaining that when they attempt to access Google’s homepage, it appears in a foreign language even though they are located in the United States. The user claims they are not using a VPN to access the internet. You have run a full anti-malware scan on the workstation and detected nothing unusual. Which of the following actions should you attempt NEXT?
Download the latest security updates for Windows
Verify the user’s date and timezone are correctly listed in Windows
Disable the Windows Firewall
Remove any proxy servers configured in their web browser
Remove any proxy servers configured in their web browser
You are troubleshooting a network printer when a document is printed with sensitive employee data on it. Which of the following actions should you take?
Leave the document in the output tray
Continue to troubleshoot the printer
Take the document to the Office Manager
Remove the document and shred it
Take the document to the office manager
Your company wants to provide a secure SSO solution for accessing both the corporate wireless network and its network resources. Which of the following technologies should be used?
WPA2
RADIUS
WEP
WPS
RADIUS
Explanation:
With RADIUS and SSO configured, users on the network can provide their user credentials one time when they initially connect to the wireless access point or another RADIUS client and are then automatically authenticated to all of the network’s resources. The Remote Authentication Dial-in User Service (RADIUS) is used to manage remote and wireless authentication infrastructure. Users supply authentication information to RADIUS client devices, such as wireless access points. The client device then passes the authentication data to an AAA (Authentication, Authorization, and Accounting) server that processes the request. The Terminal Access Controller Access Control System (TACACS+) is a proprietary alternative to RADIUS developed by Cisco for handling authentication.
The Wi-Fi Protected Setup (WPS) is a mechanism for auto-configuring a WLAN securely for home users. On compatible equipment, users push a button on the access point and connect adapters to associate them securely. WPS is subject to brute force attacks against the PIN used to secure them, making them vulnerable to attack.
Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption. WEP relies on the use of a 24-bit initialization vector to secure its preshared key.
Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard. WPA2 features an improved method of key distribution and authentication for enterprise networks, though the pre-shared key method is still available for home and small office networks. WPA2 uses the improved AES cipher with counter mode with cipher-block chaining message authentication protocol (CCMP) for encryption.
A customer runs frantically into your computer repair store. He says that his smartphone fell into a puddle, and now it won’t turn on. He excitedly tells you that he needs the smartphone working again “right now” and cannot wait. What should you do?
Post about the experience on Facebook after the customer leaves
Explain to the customer that the repairs may take several days
Offer the customer the option to replace his phone
Tell the customer to calm down because it is just a phone
Offer the customer the option to replace his phone
Dion Training’s offices are frequently experiencing under-voltage events, sags, and power failures. Which of the following solutions would protect their servers from these issues?
Line Conditioner
Uninterruptible Power Supply
Diesel Generator
Surge Suppressor
Uninterruptible Power Supply
Explanation: (My Take)
KEY words was “Power Failures”
A company owns four kiosks that are near a shopping center. The owner is concerned about someone accessing the Internet via the kiosk’s wireless network. What should be implemented to provide wireless access only to the employees working at the kiosk?
Firewall
MAC Filtering
Host-Based Antivirus
Web Filtering
MAC Filtering
Your company’s Security Operations Center (SOC) is currently detecting an ongoing DDoS attack against your network’s file server. A cybersecurity analyst has identified forty internal workstations on the network conducting the attack against your network’s file server. The cybersecurity analyst believes these internal workstations are infected with malware and places them into a quarantined network area. The analyst then submits a service desk ticket to have the workstations scanned and cleaned of the infection. What type of malware was the workstation likely a victim of based on the scenario provided?
Spyware
Ransomware
Botnet
Rootkit
Botnet
Explanation:
A botnet is many internet-connected devices, each of which is running one or more bots. Botnets can be used to perform distributed denial-of-service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its connection. A zombie (also known as a bot) is a computer or workstation that a remote attacker has accessed and set up to forward transmissions (including spam and viruses) to other computers on the internet.
Spyware is software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user.
Ransomware is a type of malware that threatens to publish the victim’s personal data or perpetually block access to it unless a ransom is paid.
A rootkit is a clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence.
Your smartphone just displayed a notification stating that a new pair of headphones has connected to your device. Which of the following threats is this an example of?
Unintended Bluetooth Pairing
Unauthorized Microphone Activation
Unauthorized Account Access
Unauthorized Location Tracking
Unintended Bluetooth Pairing
A company owns four kiosks that are near a shopping center. The owner is concerned about someone accessing the Internet via the kiosk’s wireless network. What should be implemented to provide wireless access only to the employees working at the kiosk?
MAC Filtering
Host-Based Antivirus
Web Filtering
Firewall
MAC Filtering
Which command-line tool is used on a Unix/Linux system to move upward on a directory in the system’s directory structure?
cd ..
ls
cd .
dir
cd ..
Which of the following ports should you block at the firewall if you want to prevent a remote login to a server from occurring?
443
23
25
110
23
Which type of installation would require an answer file to install the operating system?
Repair
Unattended
Clean
Upgrade
Unattended
A small business recently experienced a catastrophic data loss due to flooding from a recent hurricane. The customer had no backups, and flooding destroyed all of the hardware associated with the small business. As part of the rebuilding process, the small business contracts with your company to help create a disaster recovery plan to ensure this never reoccurs again. Which of the following recommendations should you include as part of the disaster recovery plan?
Backups should be conducted to a cloud-based storage solution
Local backups should be verified weekly to ensure no data loss occurs
Local backups should be conducted
Purchase waterproof devices to prevent data loss
Backups should be conducted to a cloud-based storage solution
Which of the following is categorized as an APIPA address?
- 8.8.8
- 254.12.64
- 30.15.12
- 168.1.123
169.254.12.64
You are troubleshooting a computer that plays a loud chime noise every day at 3 pm. Which of the following tools should you use to troubleshoot this workstation?
Performance Monitor
Device Manager
Task Scheduler
MSConfig
Task Scheduler
A technician is troubleshooting a newly installed WAP that is sporadically dropping connections to devices on the network. Which of the following should the technician check FIRST during troubleshooting?
WAP SSID
WAP Placement
Encryption Type
Bandwidth Saturation
WAP Placement
Which command-line tool is used on a Windows system to move upward in a directory within the system’s directory structure?
dir
cd .
cd ..
ls
cd ..