Lesson 8: Managing Security Settings

Question 1

Rules designed to enforce best-practice password selection, such as minimum length and use of multiple character types.

Answer 1

Complexity requirements

Question 2

Rules designed to enforce best-practice password use by forcing regular selection of new passwords.

Answer 2

expiration requirement

Question 3

Passwords set in system firmware to prevent unauthorized booting of a computer (user password) or changes to system setup (supervisor password).

Answer 3

basic input/output system (BIOS)
or
unified extensible firmware interface (UEFI)

Question 4

PII

Answer 4

personally identifiable information

Question 5

Process of determining what additional software may be installed on a client or server beyond its baseline to prevent the use of unauthorized software.

Answer 5

Execution control

Question 6

Windows mechanisms for automatic actions to occur when a peripheral storage device is attached.

Answer 6

AutoPlay settings

Question 7

Security scanner installed and enabled by default in Windows that provides protection against general malware types.

Answer 7

Windows Defender Antivirus

Question 7

UDP

Answer 7

User Datagram Protocol

Question 8

Information about new viruses and other malware used to update antivirus scanners.

Answer 8

Definition / pattern updates

Question 8

TCP

Answer 8

Transmission Control Protocol

Question 8

Microsoft’s file-level encryption feature available for use on NTFS. Feature of NTFS supports file and folder encryption.

Answer 8

Encrypting File System (EFS)

Question 8

Fix problems or make improvements to the scan software itself.

Answer 8

Scan engine / component updates

Question 8

What does blocking TCP/80 prevent clients from connecting to?

Answer 8

Blocking TCP/80 prevents clients from connecting to the default port for a web server.

Question 9

FDE

Answer 9

Full Disk Encryption

Question 9

You are completing a checklist of security features for workstation deployments. Following the CompTIA A+ objectives, what additional item should you add to the following list, and what recommendation for a built-in Windows feature or features can you recommend be used to implement it?

Password best practices
End-user best practices
Account management
Change default administrator’s user account/password
Disable AutoRun/AutoPlay
Enable Windows Update, Windows Defender Antivirus, and Windows Defender Firewall

Answer 9

Data-at-rest encryption.
In Windows, this can be configured at file level via the Encrypting File System (EFS) or at disk level via BitLocker.

Question 9

What type of account management policy can protect against password-guessing attacks?

Answer 9

A lockout policy disables the account after a number of incorrect sign-in attempts.

Question 9

True or false? An organization should rely on automatic screen savers to prevent lunchtime attacks.

Answer 9

False.
A lunchtime attack is where a threat actor gains access to a signed-in user account because the desktop has not locked. While an automatic screensaver lock provides some protection, there may still be a window of opportunity for a threat actor between the user leaving the workstation unattended and the screensaver activating. Users must lock the workstation manually when leaving it unattended.

Question 10

A security consultant has recommended more frequent monitoring of the antivirus software on workstations. What sort of checks should this monitoring perform?

Answer 10

That the antivirus is enabled, is up to date with scan engine components and definitions, and has only authorized exclusions configured.

Question 11

Installer package that can be verified by a digital signature or cryptographic hash.

Answer 11

Trusted source

Question 12

Installer package whose authenticity and integrity cannot be verified.

Answer 12

Untrusted source

Question 13

Add-on that uses the browser API to implement new functionality.

Answer 13

Extensions

Question 13

API

Answer 13

application programming interface

Question 14

TLS

Answer 14

Transport Layer Security

Question 14

Software installed to a web browser to handle multimedia objects embedded in web pages. (Play or show some sort of content embedded in a web page, such as Flash, Silverlight, or another video/multimedia format.)

Answer 14

Plug-ins

Question 15

Identification and authentication information presented in the X.509 format and issued by a Certificate Authority (CA) as a guarantee that a key pair (as identified by the public key embedded in the certificate) is valid for a particular subject (user or host).

Answer 15

digital certificates

Question 16

CA

Answer 16

Certificate authority

Question 16

Browser feature or extension that prevents sites from creating new browser windows. (Prevent a website from creating dialogs or additional windows.)

Answer 16

Pop-up blockers

Question 17

Using HTTPS to browse a site where the host has presented a valid digital certificate issued by a CA that is trusted by the browser.

Answer 17

secure connection

Question 18

Browser feature or add-in that prevents third-party content from being displayed when visiting a site. (Use more sophisticated techniques to prevent the display of anything that doesn’t seem to be part of the site’s main content or functionality. )

Answer 18

Ad-blockers

Question 18

True or false? Using a browser’s incognito mode will prevent sites from recording the user’s IP address.

Answer 18

False.
Incognito mode can prevent the use of cookies but cannot conceal the user’s source IP address. You do not need to include this in your answer, but the main way to conceal the source IP address is to connect to sites via a virtual private network (VPN).

Question 19

Cookies, site files, form data, passwords, and other information stored by a browser.

Answer 19

cache

Question 19

Browser mode in which all session data and cache is discarded and tracking protection features are enabled by default.

Answer 19

Private / incognito browsing mode

Question 20

A security consultant has recommended blocking end-user access to the chrome://flags browser page. Does this prevent a user from changing any browser settings?

Answer 20

No.
The chrome://flags page is for advanced configuration settings. General user, security, and privacy settings are configured via chrome://settings.

Question 21

What primary indicator must be verified in the browser before using a web form?

Answer 21

That the browser address bar displays the lock icon to indicate that the site uses a trusted certificate. This validates the site identity and protects information submitted via the form from interception.

Question 21

A company must deploy custom browser software to employees’ workstations. What method can be used to validate the download and installation of this custom software?

Answer 21

The package can be signed using a developer certificate issued by a trusted certificate authority.
Alternatively, a cryptographic hash of the installer can be made, and this value can be given to each support technician. When installing the software, the technician can make his or her own hash of the downloaded installer and compare it to the reference hash.

Question 22

Software that records information about a PC and its users, often installed without the user’s consent. (Malware that can perform browser reconfigurations, such as allowing tracking cookies, changing default search providers, opening arbitrary pages at startup, adding bookmarks, and so on.)

Answer 22

Spyware

Question 22

Malicious code inserted into the boot sector code or partition table of a storage device that attempts to execute when the device is attached. (These infect the boot sector code or partition table on a disk drive.)

Answer 22

Boot sector viruses

Question 22

Malicious code inserted into an executable file image. The malicious code is executed when the file is run and can deliver a payload, such as attempting to infect other files.

Answer 22

Viruses

Question 22

Malicious software program hidden within an innocuous-seeming piece of software. (This is malware concealed within an installer package for software that appears to be legitimate.)

Answer 22

Trojans

Question 23

Type of malware that replicates between processes in system memory and can spread over client/server network connections. (These replicate between processes in system memory rather than infecting an executable file stored on disk.)

Answer 23

Worms

Question 23

Mechanism for gaining access to a computer that bypasses or subverts the normal method of authentication.

Answer 23

backdoor

Question 23

Infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets.

Answer 23

command and control (C2 or C&C)

Question 23

Exploit techniques that use the host’s scripting environment to create malicious processes. (This refers to malicious code that uses the host’s scripting environment, such as Windows PowerShell or PDF JavaScript, to create new malicious processes in memory.)

Answer 23

Fileless malware

Question 23

Malware that creates a backdoor remote administration channel to allow a threat actor to access and control the infected host.

Answer 23

RAT (Remote Access Trojan)

Question 24

IRC

Answer 24

Internet relay chat

Question 25

Malicious software or hardware that can record user keystrokes. (A type of spyware that actively attempts to steal confidential information by recording keystrokes.)

Answer 25

keylogger

Question 26

Class of malware that modifies system files, often at the kernel level, to conceal its presence.

Answer 26

rootkit

Question 27

Malware that hijacks computer resources to create cryptocurrency.

Answer 27

cryptominer / cryptojacking

Question 27

Malware that tries to extort money from the victim by blocking normal operation of a computer and/or encrypting the victim’s files and demanding payment. (a type of malware that tries to extort money from the victim)

Answer 27

Ransomeware

Question 27

When the computer is slow or “behaving oddly,” one of the things you should suspect is malware infection. Some specific symptoms associated with malware include: (3)

Answer 27

• The computer fails to boot or experiences lockups.
• Performance at startup or in general is very slow.
• The host cannot access the network and/or Internet access or network performance is slow.

Question 28

Software capable of detecting and removing virus infections and (in most cases) other types of malware, such as worms, Trojans, rootkits, adware, spyware, password crackers, network mappers, DoS tools, and so on.

Answer 28

Antivirus (scan)

Question 28

Browser indication that a site connection is not secure because the certificate is invalid or the issuing CA is not trusted.

Answer 28

Certificate warnings

Question 28

Spoofed desktop notifications and browser ads designed to alarm users and promote installation of Trojan malware.

Answer 28

Rogue antivirus

Question 28

Early in the day, a user called the help desk saying that his computer is running slowly and freezing up. Shortly after this user called, other help desk technicians who overheard your call also received calls from users who report similar symptoms. Is this likely to be a malware infection?

Answer 28

It is certainly possible.
Software updates are often applied when a computer is started in the morning, so that is another potential cause, but you should investigate and log a warning so that all support staff are alerted. It is very difficult to categorize malware when the only symptom is performance issues. However, performance issues could be a result of a badly written Trojan, or a Trojan/backdoor application might be using resources maliciously (for DDoS, Bitcoin mining, spam, and so on).

Question 28

A developer is reading their email and comes across a new memorandum from the security department about a clean desk policy. Why does security need to publish this?

A.Personal identifiable information (PII) protection
B.Secure critical hardware
C.Prevent lunchtime attack
D.Protect UEFI

Answer 28

A. Personal Identifiable Information (PII) protection

Paper copies of personal and confidential data must not be left where they could be read or stolen. A clean desk policy ensures that all such information is not left in plain sight.

A clean desk policy does not help with securing critical assets. Portable computers can be secured though to a desk using a cable lock. When in public, users must keep laptop cases insight.

A lunchtime attack is where a threat actor is able to access a computer that has been left unlocked.

A system user password is one that is required before any operating system can boot. The system password can be configured by the basic input/output system (BIOS) or unified extensible firmware interface (UEFI) setup program.

Question 28

The process of isolating a file, computer system, or computer network to prevent the spread of a virus or another cybersecurity incident.

Answer 28

Quarantine

Question 28

Computing environment that is isolated from a host system to guarantee that the environment runs in a controlled, secure fashion.

Answer 28

sandbox

Question 28

CompTIA has identified a seven-step best practice procedure for malware removal: (7)

Answer 28

1. Investigate and verify malware symptoms.
2. Quarantine infected systems.
3. Disable System Restore in Windows.
4. Remediate infected systems:
   Update anti-malware software.
   Scanning and removal techniques (e.g., safe mode, preinstallation environment).
5. Schedule scans and run updates.
6. Enable System Restore and create a restore point in Windows.
7. Educate the end user.

Question 28

Consequence of malware infection where DNS and/or search results are corrupted to redirect requests from legitimate site hosts to spoofed sites or ads. (where the user tries to open one page but gets sent to another.)

Answer 28

Redirection

Question 29

You receive a support call from a user who is “stuck” on a web page. She is trying to use the Back button to return to her search results, but the page just displays again with a pop-up message. Is her computer infected with malware?

Answer 29

If it only occurs on certain sites, it is probably part of the site design.
A script running on the site can prevent use of the Back button. It could also be a sign of adware or spyware though, so it would be safest to scan the computer using up-to-date anti-malware software.

Question 29

A manager is responsible for client laptops, and is concerned about exposing data on the disks to a different OS and the permissions becoming overridden. What will help prevent this possible attack?

A.Windows Defender Firewall
B.Windows Defender Antivirus
C.Encrypting File System
D.Execution control

Answer 29

C. Encrypting File System (EFS)

The Encrypting File System (EFS) feature of the New Technology File System (NTFS) supports file and folder encryption. EFS is not available in the Home edition of Windows.

The Windows Defender Firewall with Advanced Security console allows the configuration of a custom inbound and outbound filtering rule.

Antivirus is software that can detect malware and prevent it from executing. The primary means of detection is to use a database of known virus patterns called definitions, signatures, or patterns.

Execution control refers to logical security technologies designed to prevent malicious software from running on a host regardless of what the user account privileges allow.

Question 29

Why is DNS configuration a step in the malware remediation process?

Answer 29

Compromising domain-name resolution is a very effective means of redirecting users to malicious websites. Following malware infection, it is important to ensure that DNS is being performed by valid servers.

Question 29

A security analyst baselines web activity and notices several caveats with browsers. For example, they notice that when a user types in a query, a query is actually made after every typed key. The analyst is trying to group browser activity together. Which browser is based on the same code as Chrome?

A.Edge
B.Internet Explorer
C.Safari
D.FireFox

Answer 29

A. Edge

Edge, Microsoft’s replacement browser, now uses the same underlying Chromium codebase as Google Chrome.

IE itself is no longer supported. Microsoft’s Internet Explorer (IE) used to be dominant in the browser market. As the browser is a security-critical type of software, it is particularly important to use a trusted source, such as an app store.

Apple’s Safari browser is tightly integrated with macOS and iOS. In some scenarios, it might be appropriate to choose a browser that is different from these mainstream versions.

FireFox is a free and open-source modern web browser. It is currently developed by the Mozilla Foundation.

Question 29

Why might a PC infected with malware display no obvious symptoms?

Answer 29

If the malware is used with the intent to steal information or record behavior, it will not try to make its presence obvious.
A rootkit may be very hard to detect even when a rigorous investigation is made.

Question 29

A helpdesk operator is reviewing a notification that a user clicked links in a very suspicious email. After verifying there are symptoms of malware, what is the next step the operator should take?

A.Disable System Restore.
B.Look for missing or renamed files.
C.Look for services masquerading as legitimate services.
D.Quarantine.

Answer 29

D. Quarantine

After verifying the symptoms of malware, the host should be placed in quarantine, where it is not able to communicate on the main network.

Once the infected system is isolated, the next step is to disable System Restore and other automated backup systems, such as File History.

Looking for missing or renamed files could be one of the many steps in investigating after a computer has been quarantined. Identification of these techniques could help scan the enterprise to see how far it spread.

Another good step after isolation is to look for additional executable files with names similar to those of authentic system files and utilities, such as scvhost.exe or ta5kmgr.exe.

Question 29

Another user calls to say he is trying to sign-on to his online banking service, but the browser reports that the certificate is invalid. Should the bank update its certificate, or do you suspect another cause?

Answer 29

It would be highly unlikely for a commercial bank to allow its website certificates to run out of date or otherwise be misconfigured. You should strongly suspect redirection by malware or a phishing/pharming scam.

Question 29

A Firefox user wants to open up their browser settings to configure their intranet as the home page. How can the Firefox user access the settings?

A.chrome://settings
B.edge://settings
C.firefox://settings
D.about:preferences

Answer 29

D. about:preferences

Users can open the internal URL for Firefox by going to about:preferences. Each browser maintains its own settings that are accessed via its Meatball (…) or Hamburger (☰) menu button as well.

In Chrome, the setting option is listed under chrome://settings. Browsers also have advanced settings that are accessed via a URL such as chrome://flags or about:config.

In Edge, the URL for settings is at edge://settings. Internet Explorer (IE) should not be used for general web browsing or to access modern web applications.

firefox://settings is not the correct option for Firefox. A browser sign-in allows the user to synchronize settings between instances of the browser software on different devices.

Question 29

Why might you need to use a virus encyclopedia?

Answer 29

You might need to verify symptoms of infection. Also, if a virus cannot be removed automatically, you might want to find a manual removal method. You might also want to identify the consequences of infection—whether the virus might have stolen passwords, and so on.

Question 29

A security manager is setting up a password policy for users. Which of the following is the best security practice when it comes to passwords?

A.Password expiration
B.Length
C.Character mix
D.Personal information

Answer 29

B. Length

Length is preferable to the use of highly cryptic mixing of character types. It will take an attacker significantly longer to crack a passphrase rather than a much shorter but complex password.

The latest National Institute of Standards and Technology (NIST) guidance also deprecates password expiration except when a breach is discovered.

Requiring a mix of character types forces users into selecting easily masked substitutions (zero for the letter O, for instance) or makes passwords difficult to remember and causes users to write them down.

Users should choose a memorable phrase but should not use any personal information in the password. Anything that a threat actor could discover or guess should not be used in a password.

Question 29

A user visits a news site that they go to frequently, and the news articles are not updated but are the same as the day before. The user also hears complaints about people not having internet, which is odd since they are on their normal news site. What is most likely going on?

A.User is in private mode.
B.There are pop-up blockers.
C.User is on a different switch.
D.Page is cached.

Answer 29

D. Page is cached

By default, the browser will maintain a history of pages visited, cache files to speed up browsing, and save text typed into form fields. The page is most likely cached from the previous visit.

Private/incognito browsing mode disables the caching features of the browser so that no cookies, browsing history, form fields, passwords, or temp files will be stored when the session is closed.

Pop-up blockers prevent a website from creating dialogs or additional windows. The pop-up technique was often used to show fake antivirus and security warnings or other malicious and nuisance advertising.

While the user may be on a different switch than those complaining about not having internet, it is more likely that the user’s page is cached.

Question 30

A security administrator wants to set up anomalistic monitoring around behavioral-based user activity. Which of the following could the administrator implement for monitoring? (Select all that apply.)

A.Failed attempts
B.Login times
C.Concurrent logins
D.Screen lock

Answer 30

A. Failed attempts and B. Login times and C. Concurrent logins

Monitoring login times are typically used to see if an account is logging in at an unusual time of the day or night or during the weekend.

Concurrent logins are another behavioral-based monitoring mechanism. Most users should only need to sign in to one computer at a time, so this sort of policy can help to prevent or detect misuse of an account.

Failed attempts can be a sign of malicious activity.

The timeout/screen lock locks the desktop if the system detects no user-input device activity. This is a sensible, additional layer of protection.

Question 31

A security analyst receives a notification of possible malware based on common indicators. After conducting several analyses, the analyst learns the malware used Windows PowerShell to create new malicious processes in the computer’s memory. What is the analyst’s computer likely infected with?

A.Fileless malware
B.Worm
C.Boot sector virus
D.Viruses

Answer 31

A. Fileless malware

Fileless malware refers to malicious code that uses the host’s scripting environment, such as Windows PowerShell or PDF JavaScript, to create new malicious processes in memory.

Worms replicate between processes in system memory rather than infecting an executable file stored on a disk.

Boot sector viruses infect the boot sector code or partition table on a disk drive. While this could be a possible option, memory-based malware running inside the code of another program is quite common.

Viruses are concealed within the code of an executable process image stored as a file on a disk. In Windows, executable code has extensions such as .EXE, .MSI, .DLL, .COM, .SCR, and .JAR.

Question 32

A security manager sets up a defense in depth mechanism and sets up monitoring to catch communications from the attacker to the malware. What is the manager monitoring for?

A.Spyware
B.C2
C.Keylogger
D.Rootkit

Answer 32

B. C2 (Command and Control)

Whether a backdoor is used as a standalone intrusion mechanism or to manage bots, the threat actor must establish a connection from the compromised host to a command and control (C2 or C&C) host or network.

Spyware is malware that can perform browser reconfigurations, such as allowing tracking cookies, changing default search providers, opening arbitrary pages at startup, adding bookmarks, and so on.

A keylogger is spyware that actively attempts to steal confidential information by recording keystrokes.

When dealing with a rootkit, administrators should be aware that there is the possibility that it can compromise system files and programming interfaces so that local shell processes no longer reveal their presence.

Question 33

A developer wants to create functionality for a web browser by making API calls on the back end. What should the developer build?

A.Plug-ins
B.Extension
C.Apps
D.Themes

Answer 33

B. Extension

Question 34

A security manager wants to set up a program where they can proactively mitigate malware infection as much as possible. Which of the following is least helpful in this endeavor?

A.User training
B.Scheduled scans
C.Update trusted root certificates
D.On-access scanning

Answer 34

C. Update trusted root certificates

Updating trusted root certificates is helpful in the overall defense-in-depth security strategy, but is least helpful in this scenario in preventing malware. It does play its part though.

An essential malware prevention follow-up action is effective user training. Untrained users represent a serious vulnerability because they are susceptible to social engineering and phishing attacks.

All security software supports scheduled scans. These scans can impact performance, however, so it is best to run them when the computer is otherwise unused.

Almost all security software is now configured to scan on-access. On-access means that the antivirus (A-V) software intercepts an operating system (OS) call to open a file and scans the file before allowing or preventing it from being opened.

Question 35

A security manager in charge of the vulnerability program for the enterprise is looking at mobile security. They are reading about a “walled garden” approach. What does this entail?

A.Autorun
B.Antivirus
C.Concurrent logins
D.Trusted source

Answer 35

D. Trusted source

Mobile OS vendors use this “walled garden” model of software distribution as well. Apps are distributed from an approved store, such as Apple’s App Store or the Windows Store.

One of the problems with legacy versions of Windows is that when an optical disc is inserted or a USB drive is attached, Windows would automatically run commands defined in an autorun.inf file.

Antivirus is software that can detect malware and prevent it from executing. The primary means of detection is to use a database of known virus patterns called definitions, signatures, or patterns.

Concurrent logins are another behavioral-based monitoring mechanism. Most users should only need to sign in to one computer at a time.

Question 36

A server administrator notices that a few servers in their screened subnet (demilitarized zone) went from around 5% central processing unit (CPU) utilization to 95%. They also notice the machines lack many patches. If malware infects the servers, what is the likely cause of the high CPU utilization?

A.Crypto-ransomware
B.Cryptomining software
C.Rogue antivirus
D.RAT

Answer 36

B. Cryptomining software

A cryptominer hijacks the resources of the host to perform cryptocurrency mining. This is also referred to as cryptojacking.

Ransomware is a type of malware that tries to extort money from the victim. Crypto-ransomware attempts to encrypt files on any fixed, removable, and network drive.

Rogue antivirus is a particularly popular way to disguise a Trojan. In the early versions of this attack, a website would display a pop-up disguised as a normal Windows dialog box with a fake security alert.

Modern malware is usually designed to implement some type of backdoor, also referred to as a remote access Trojan (RAT).

Question 37

A server administrator helps the human resources department build a new internal website for their new training platform that needs to remain secure. What will the administrator need to do to ensure the web page shows up as secure?

A.Adjust the firewall.
B.Configure browser sign-in.
C.Add trusted certificates.
D.Whitelist in the web application firewall.

Answer 37

C. Add trusted certificates

When using enterprise certificates for internal sites and a third-party browser, the administrator must ensure that the internal CA root certificate is added to the browser.

Unless the site is running a non-standard port, the firewall would not need to be adjusted. Normal web traffic operates off ports 80 and 443.

A browser sign-in allows the user to synchronize settings between instances of the browser software on different devices.

The site is internal so the administrator would not be able to adjust the training platform’s web application firewall. However, even if they could, this should not need to be configured.

Question 38

Lesson 8 Summary

Answer 38

Lesson 8
Summary
You should be able to configure workstation and Windows OS settings to meet best practices for security; install and configure secure browsers; and detect, remove, and prevent malware using the appropriate tools and best practice procedures.

Guidelines for Managing Security Settings

Follow these guidelines to support secure use of workstations and browsers:

Create checklists for deploying workstations in hardened configurations and monitoring continued compliance:
Password best practices (length and character complexity requirements, expiration requirements, and BIOS/UEFI passwords).
Account management policies (restrict user permissions, restrict login times, disable guest account, use failed attempts lockout, use timeout/screen lock, and disable AutoRun/AutoPlay).
Antivirus and firewall settings and updates, using built-in Windows Defender or third-party products.
File and/or disk encryption, using built-in EFS/BitLocker or third-party products.
Secure browser and extension/plug-in installation via trusted sources and configuration of security settings (pop-up blocker, clearing browsing data, clearing cache, private-browsing mode, sign-in/browser data synchronization, and ad blockers).
Develop training and awareness programs to support end-user best practices (use screensaver locks, log off when not in use, secure/protect critical hardware, and secure PII/passwords), threat awareness, and secure connection/certificates identification.
Develop a knowledge base to classify malware types (Trojans, rootkits, viruses, spyware, ransomware, keyloggers, boot sector viruses, and cryptominers).
Develop a knowledge base to document tools (recovery mode, antivirus/anti-malware, software firewalls, and OS reinstallation) and steps to resolve common security symptoms (unable to access the network, desktop alerts, false alerts regarding antivirus protection, altered system or personal files, missing/renamed files, unwanted notifications within the OS, OS update failures, random/frequent pop-ups, certificate warnings, and redirection).
Apply the CompTIA best practice model for malware removal: 1. Investigate and verify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore in Windows, 4. Remediate infected systems (a. Update anti-malware software and b. Scanning and removal techniques [safe mode/preinstallation environment]), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point Windows, and 7. Educate the end user.
Additional practice questions for the topics covered in this lesson are available on the CompTIA Learning Center.