- What is the primary purpose of an accelerometer in mobile devices?
- Measuring the air pressure around the handset
- Adjusting the handset backlight to room light
- Detecting the resting position of the handset
- Sensing the magnetic field around the handset
Correct answer: Detecting the resting position of the handset
An accelerometer measures linear acceleration on three axes, and because gravity is a constant acceleration it reports how the handset is tilted and which way up it is resting, which is what the display and the games engine need. Air pressure is the barometer's job and feeds altitude estimates. Backlight level is set from the ambient light sensor. Magnetic field strength is read by the magnetometer for compass headings.
- In mobile device security, what does a 'sandbox' environment refer to?
- An archive folder that holds deleted owner files
- An indexed cache that holds recently closed apps
- An idle partition that holds the pending upgrade
- An isolated compartment that holds one app alone
Correct answer: An isolated compartment that holds one app alone
A sandbox is an isolated execution compartment: an app runs with its own memory space and its own storage area and cannot reach another app's data or the system files unless the user grants a permission. It is not a holding area for deleted files, which is what the trash does. It is not a cache of recently closed apps, and it is not the spare partition that stores a pending system upgrade.
- Which technology is primarily used for short-range wireless communication between mobile devices and peripheral accessories?
- Bluetooth, a short range personal radio
- Wireless fidelity, a local area network
- Near field tapping, a contactless touch
- Long term evolution, a licensed carrier
Correct answer: Bluetooth, a short range personal radio
Bluetooth is the short-range personal-area radio used to link a phone to headsets, keyboards, speakers, watches and car kits at roughly ten metres, and it is what accessory pairing runs on. Wi-Fi is a local-area network technology for reaching a router or an access point, not for attaching peripherals. Near-field tapping reaches only a few centimetres and is aimed at payments and handshakes. Long Term Evolution is licensed cellular carrier service covering whole districts.
- What is the primary function of an IMEI number in mobile devices?
- A code that names the account billed by carriers
- A number that names the handset within a network
- A label that names the adapter joined to cabling
- A token that names the person owning the profile
Correct answer: A number that names the handset within a network
The IMEI is a unique serial burned into the handset that identifies the hardware itself to the mobile network, which is how a stolen phone is blocklisted by the carrier even after a new SIM is fitted. The subscriber's billing account is identified by the numbers held on the SIM, not by the IMEI. A MAC address identifies a network adapter on the local link. A store or cloud account identifies the person, not the radio hardware.
- Which of the following best describes the term 'tethering' in the context of mobile devices?
- Sharing the phone's cellular link with a desktop
- Mirroring the phone's display onto a wall screen
- Syncing the phone's contacts into a cloud folder
- Locking the phone's bootloader with a vendor key
Correct answer: Sharing the phone's cellular link with a desktop
Tethering shares the phone's cellular data connection with another computer, over a USB cable, over Bluetooth, or over a Wi-Fi hotspot, so the attached machine reaches the internet through the handset. Casting or mirroring sends the picture to a screen and shares no data link. Syncing copies contacts to a cloud service. Bootloader locking is a firmware security state and carries no traffic at all.
- What is the primary purpose of a VPN on a mobile device?
- Blocking adverts while the browser paints pages
- Caching webpages for reading without any signal
- Encrypting the traffic through a private tunnel
- Shrinking photos before they leave this handset
Correct answer: Encrypting the traffic through a private tunnel
A VPN builds an encrypted tunnel from the handset to a private gateway, so traffic crossing an untrusted hotspot cannot be read or altered in transit and the device is reachable as though it sat on the far network. Ad blockers only filter page content once it has arrived. Offline caching stores pages for later reading. Image compression saves data volume. None of those three protect traffic on the wire.
- In mobile devices, what does the term 'jailbreaking' refer to?
- Wiping the phone back to its shipped software
- Loading a signed update from the carrier site
- Enrolling the tablet in a managed device list
- Lifting the vendor limits placed on a handset
Correct answer: Lifting the vendor limits placed on a handset
Jailbreaking removes the restrictions the manufacturer and the carrier impose on a device, so the owner can install unsigned software and change parts of the system that are normally sealed. A factory reset only returns the phone to the software it shipped with. Installing a signed update leaves every restriction in place. Enrolling a device in a managed inventory adds restrictions rather than removing them.
- Which mobile device component is responsible for converting digital data into analog sound signals?
Correct answer: DAC
A DAC turns the digital audio samples held in storage into the varying analog voltage that drives a speaker or a headset, which is why it sits on every audio output path. The GPU renders images for the display. The NIC frames and transmits network traffic. The TPM stores cryptographic keys and measures boot integrity. None of those three touch the audio waveform.
- What is the main function of Gorilla Glass in mobile devices?
- Repelling fingerprint oils from the outer glass face
- Cutting reflected glare from the bright sky outdoors
- Resisting scratches during drops onto a marble floor
- Reading finger taps through the thin capacitive grid
Correct answer: Resisting scratches during drops onto a marble floor
Gorilla Glass is a chemically strengthened cover glass; an ion exchange bath puts the surface under compression so it resists scratching from keys and coins and survives drops that would crack ordinary glass. Repelling skin oils is the job of the oleophobic coating applied over the top. Glare control comes from anti-reflective layers. Sensing a finger is the digitizer's job, and the digitizer sits underneath the cover glass.
- Which of the following components is essential for enabling facial recognition technology in mobile devices?
- Barometer chip reporting the local air pressure
- Motion sensor tracking the handset tilt changes
- Display panel emitting light from single pixels
- Infrared camera mapping the facial depth points
Correct answer: Infrared camera mapping the facial depth points
Facial recognition on modern handsets uses an infrared camera, usually paired with a dot projector, to build a depth map of the face that still works in darkness and is far harder to fool with a printed photograph. A barometer reports air pressure for altitude. An accelerometer reports tilt and movement. A display panel only emits light. None of those three can capture facial geometry.
- Which feature in mobile devices adjusts the screen's brightness based on ambient light conditions?
- Night shift reddens the screen light after dusk
- Auto brightness tracks whether the room is dark
- Battery saver pauses the sync jobs left running
- Display timeout blanks the panel while it idles
Correct answer: Auto brightness tracks whether the room is dark
Automatic or adaptive brightness reads the ambient light sensor and raises the backlight in sunlight and lowers it in a dark room, which keeps the display readable and saves battery. A night shift setting only warms the colour temperature towards amber and never measures the room. A battery saver limits background work. A display timeout blanks the panel after an idle period instead of setting its level.
- In the context of mobile devices, what is the primary function of an OLED display?
- Showing true black by cutting single pixels off
- Keeping hues steady across the wide view angles
- Redrawing the picture at a quicker refresh rate
- Spreading even light under the whole flat panel
Correct answer: Showing true black by cutting single pixels off
In an OLED panel every subpixel makes its own light, so a black pixel is simply switched off. That is what produces the very high contrast ratio and the true blacks that distinguish OLED from a backlit LCD. Steady colour at wide angles is the selling point of an IPS LCD. Refresh rate is a timing figure that any panel technology can offer. An even backlight is something an LCD needs precisely because its pixels emit nothing.
- What does the term 'rooting' refer to in Android mobile devices?
- Flashing a custom system image onto the handset
- Turning on the hidden menu of developer options
- Sideloading an app package from a foreign store
- Gaining the superuser rights over a live device
Correct answer: Gaining the superuser rights over a live device
Rooting an Android device means obtaining superuser rights, the administrative account that can write to system partitions, remove preinstalled software and change protected settings. Flashing a custom ROM replaces the operating system and is a separate operation. Turning on developer options only exposes a settings menu that ships with the device. Sideloading installs a package from outside the official store and needs no elevated rights at all.
- Which component is crucial for a mobile device's GPS functionality?
- The modem that reads the closest tower beacons
- The gyroscope that reads the amount of turning
- The receiver that reads the orbit timing marks
- The compass that reads the magnetic north pole
Correct answer: The receiver that reads the orbit timing marks
Satellite positioning depends on a dedicated GPS receiver, a radio that listens for the timing signals broadcast by the satellite constellation and solves for position from the tiny differences between them. A cellular modem talks to towers and can only assist a fix. A gyroscope reports angular rate. A magnetometer reports heading. None of those three can decode a satellite transmission.
- What is the main purpose of a mobile device's gyroscope sensor?
- Measuring the straight line push on the case
- Measuring the spin rate about each main axis
- Measuring the gap between the ear and screen
- Measuring the light falling on the flat face
Correct answer: Measuring the spin rate about each main axis
A gyroscope measures angular velocity, the rate at which the device is turning about each axis, which is what image stabilisation, panorama capture and motion controls rely on. A push along a straight line is what the accelerometer senses. The gap between the ear and the screen is read by the proximity sensor. Light falling on the front face is read by the ambient light sensor.
- In mobile devices, what technology is primarily used for contactless payment systems?
- Near field communication, used at the checkout
- Bluetooth pairing, used with the desk keyboard
- Wireless fidelity, used inside the same office
- Long term evolution, used across several towns
Correct answer: Near field communication, used at the checkout
Near field communication is the technology behind tap-to-pay. It works over a couple of centimetres, which is short enough that presenting the phone at a terminal is itself the authorising gesture, and it carries the tokenised card credential. Bluetooth reaches roughly ten metres and is used for accessories. Wi-Fi covers a building and carries general network traffic. Long Term Evolution is the carrier's wide-area data service.
- Which technology in mobile devices enables wireless charging?
- Inductive transfer across two round coils
- Photovoltaic panels inside a glass window
- Thermoelectric cells beside a heated chip
- Piezoelectric strips inside a shaken case
Correct answer: Inductive transfer across two round coils
Wireless charging pads work by inductive transfer: alternating current in a transmitter coil creates a changing magnetic field, and that field induces a current in a receiver coil inside the phone. Photovoltaic conversion turns light into current and is not how a charging pad works. Thermoelectric conversion needs a temperature difference across a junction. Piezoelectric strips generate a small charge from mechanical stress.
- What is the primary function of a mobile device's proximity sensor?
- Reading the blood pulse beneath the wrist strap
- Reading the heat inside the sealed battery pack
- Reading the object held close against the glass
- Reading the magnet hidden inside the folio case
Correct answer: Reading the object held close against the glass
The proximity sensor emits infrared light and measures what reflects back, so it can tell that something is close without any physical contact. That is how the screen and the touch layer switch off when the phone is raised to the ear during a call. A pulse is read by an optical heart-rate sensor. Battery temperature is read by a thermistor. A magnet in a folio cover is detected by a Hall effect sensor.
- In mobile devices, what is the purpose of a pico projector?
- Firing an infrared beam at a television remote
- Firing a bright flash towards a darkened stage
- Firing a narrow laser toward the focus subject
- Firing a magnified picture onto a distant wall
Correct answer: Firing a magnified picture onto a distant wall
A pico projector is a miniature projector built into or clipped onto a device; it throws an enlarged copy of the screen image onto a wall or a screen so several people can view it at once. An infrared blaster sends remote-control codes to a television. The camera flash lights a dark scene. A laser is used for time-of-flight autofocus. None of those three produce a viewable picture.
- What does the term 'hotspot' refer to in the context of mobile devices?
- A tower sector that carries the heaviest traffic
- A handset that provides its own wireless network
- A silicon region that runs warmer than predicted
- A stored bookmark that records a frequent street
Correct answer: A handset that provides its own wireless network
A mobile hotspot turns the handset itself into a wireless access point: it broadcasts an SSID of its own, and the laptops and tablets that join it reach the internet over the phone's cellular data plan. A heavily loaded tower sector is a carrier capacity problem. A silicon region running warm is a thermal design issue. A saved location is a records feature, not a network.
- Which feature in mobile devices automatically rotates the screen content based on the device's orientation?
- Auto rotate, which flips the layout when tilted
- Ambient screen, which shows the time while idle
- Light sensors, which drop the backlight at dusk
- Motion sense, which wakes the panel when lifted
Correct answer: Auto rotate, which flips the layout when tilted
Auto-rotate reads the accelerometer to work out which edge is currently uppermost and redraws the interface in portrait or landscape to match. An ambient display only shows a clock and notifications on an otherwise idle screen. Automatic brightness changes the backlight level rather than the layout. Motion sensing wakes the panel when the device is picked up and does not reflow anything.
- In an IPv6 address, what is the typical format of a link-local address?
- FC00::/7 ranges
- FF00::/8 blocks
- 2002::/16 range
- FE80::/10 block
Correct answer: FE80::/10 block
Every IPv6 interface builds a link-local address out of the FE80::/10 block. Those addresses are valid only on the attached link and are what neighbour discovery, DHCPv6 and routing adjacencies use. FC00::/7 holds the unique local addresses that play the part private ranges play in IPv4. FF00::/8 is reserved for multicast. 2002::/16 was assigned to 6to4 tunnelling, not to link-local addressing.
- What is the function of the ARP (Address Resolution Protocol) in a network?
- It hands out addresses from a managed pool
- It seals the data inside an encoded tunnel
- It binds an address onto a hardware number
- It picks the shortest path across the core
Correct answer: It binds an address onto a hardware number
ARP resolves a known IPv4 address into the MAC address of the interface that holds it, which is what lets a host build a frame that the local switch can deliver. Handing out addresses from a pool is DHCP. Sealing data inside an encrypted tunnel is the work of TLS or IPsec. Choosing the shortest path between routers is what a routing protocol such as OSPF does.
- In network security, what does a 'DMZ' (Demilitarized Zone) refer to?
- A network zone reserved for internal test builds
- A network zone exposed to the untrusted internet
- A network zone baited to attract stray attackers
- A network zone switched onto the standby circuit
Correct answer: A network zone exposed to the untrusted internet
A DMZ is a screened network zone that sits between the internal LAN and the untrusted internet and carries the servers outsiders must reach, such as mail, web and VPN endpoints. Traffic from outside terminates there instead of on the internal network. A zone kept for internal test builds is a lab VLAN. A zone baited for attackers is a honeypot. A zone on a standby circuit is a failover path.
- What does the term '10/100/1000' refer to in the context of Ethernet networking?
- The three link speeds offered in megabits
- The three cable lengths printed in metres
- The three socket counts fitted per switch
- The three supply budgets allowed in watts
Correct answer: The three link speeds offered in megabits
A port marked 10/100/1000 can negotiate three Ethernet link speeds in megabits per second: 10 for legacy Ethernet, 100 for Fast Ethernet and 1000 for Gigabit Ethernet. It is not a cable length; twisted pair runs are capped near 100 metres whatever the speed. It is not a count of sockets on the switch, and it is not a power budget, which is quoted in watts for Power over Ethernet.
- What is the primary function of the QoS (Quality of Service) feature in a router?
- It steers inbound sessions to a chosen host
- It changes the source address on each frame
- It scrambles the payload before it is moved
- It moves urgent traffic ahead of the others
Correct answer: It moves urgent traffic ahead of the others
Quality of Service classifies traffic and lets the delay-sensitive classes, such as voice and video and interactive sessions, into the outbound queue ahead of bulk transfers, so a large download cannot starve a call. Steering inbound sessions to a chosen host is port forwarding. Changing the source address on the way out is NAT. Scrambling the payload is encryption, which does nothing for ordering.
- In networking, what is the purpose of the 'traceroute' command?
- It measures the data rate between two hosts
- It prints the sockets open on this computer
- It charts the routers crossed along a route
- It resolves a label into its stored address
Correct answer: It charts the routers crossed along a route
traceroute, or tracert on Windows, sends probes with a rising time-to-live so each router on the path is forced to answer, and it builds a hop-by-hop chart of the routers between here and the destination. Measuring the data rate between two hosts is what a tool such as iperf does. Listing open sockets is netstat. Resolving a name to an address is nslookup or dig.
- Which type of network cable is used to connect a computer to a switch in a standard Ethernet network?
- A crossed twisted copper lead
- A straight through patch lead
- A rolled console adaptor lead
- A braided coaxial aerial lead
Correct answer: A straight through patch lead
A straight-through patch lead carries pin 1 to pin 1 all the way along, which is the wiring needed between unlike devices such as a computer and a switch or a hub. A crossover lead swaps the transmit and receive pairs and was used between like devices before auto-MDIX. A rollover lead reverses the whole pinout for a serial console port. Coaxial aerial cable is not twisted pair Ethernet at all.
- What does the term 'latency' refer to in a network?
- The delay a single packet suffers while crossing
- The portion of packets dropped along the circuit
- The variation between arrivals at the remote end
- The traffic a channel carries during each second
Correct answer: The delay a single packet suffers while crossing
Latency is the delay a single packet suffers travelling from source to destination, normally quoted as a round trip in milliseconds. The portion of packets that never arrive is loss. The variation between one arrival and the next is jitter, which is what breaks up a voice call. The traffic a channel carries each second is bandwidth, and a link can offer high bandwidth and high latency at once.
- In a TCP/IP network, what is the purpose of the 'subnet mask'?
- It shows the router that carries remote traffic
- It lists the resolver that answers name queries
- It names the countdown that each lease receives
- It marks the address bits that identify subnets
Correct answer: It marks the address bits that identify subnets
The subnet mask marks how many leading bits of an IPv4 address identify the network, leaving the trailing bits to identify the host, so a station can decide whether a destination is local or must be handed to a router. The router that forwards remote traffic is the default gateway. The resolver that answers queries is the DNS server. The countdown a lease survives is the DHCP lease time.
- What is the primary function of a VLAN (Virtual Local Area Network)?
- It stretches a segment across a greater distance
- It divides one switch into two broadcast domains
- It blocks those loops that form between switches
- It bonds adjacent uplinks into a quicker channel
Correct answer: It divides one switch into two broadcast domains
A VLAN divides one physical switch into several logical switches, each with its own broadcast domain, so a broadcast sent in one VLAN is never flooded into another and traffic between them must cross a router or a Layer 3 switch. Stretching a segment further is what a repeater or fibre does. Blocking switching loops is Spanning Tree. Bonding ports into one channel is link aggregation.
- In the OSI model, at which layer does the IPv4 protocol operate?
- Layer 1
- Layer 2
- Layer 3
- Layer 4
Correct answer: Layer 3
IPv4 is the classic Layer 3 protocol. It carries the logical addresses that identify hosts across separate networks, and it is the header a router examines when it forwards a packet. Layer 1 is the physical layer of connectors, cabling and signalling. Layer 2 is the data link layer, where MAC addresses, frames and switches live. Layer 4 is the transport layer, home to TCP and UDP.
- Which protocol is used for securely transferring files over a network in a UNIX-like environment?
Correct answer: SFTP
SFTP is the SSH File Transfer Protocol: authentication, commands and file data all travel inside an SSH session on port 22, which is why it is the default file transfer tool on UNIX and Linux hosts. TFTP is a stripped-down UDP transfer with no authentication at all, used for boot images. SMTP carries outbound mail. SNMP polls and manages devices. None of those three protect a transfer.
- What is the primary purpose of the DNS (Domain Name System)?
- It shares the load across a server cluster
- It hands each client a lease plus settings
- It converts a written name into an address
- It sends the outbound mail toward a domain
Correct answer: It converts a written name into an address
DNS is the distributed directory that converts a written hostname into the IP address a host actually connects to, then caches the answer for the length of its time-to-live. Sharing load across a server cluster is what a load balancer does. Handing a client a lease along with its gateway and mask is DHCP. Sending outbound mail toward another server is SMTP.
- In networking, what does NAT (Network Address Translation) accomplish?
- It drops unwanted packets at the network edge
- It swaps a private address for public routing
- It logs the flows crossing a chosen interface
- It wraps the payload inside a stronger cipher
Correct answer: It swaps a private address for public routing
NAT rewrites the private source address on outbound packets to the router's public address, keeps a translation table, and reverses the swap on the replies, which is what lets a whole home or office share one routable address. Dropping unwanted packets at the edge is the firewall's job. Logging the flows crossing an interface is traffic accounting. Wrapping the payload in a cipher is encryption.
- What is the primary function of SNMP (Simple Network Management Protocol)?
- It polls the devices for their performance counters
- It keeps the machine clocks aligned with satellites
- It checks each password against a central directory
- It encrypts the outbound session with a certificate
Correct answer: It polls the devices for their performance counters
SNMP is the management protocol. A manager polls agents running on switches, routers, printers and servers for counters such as interface errors, uptime and processor load, and an agent can raise a trap when something changes. Keeping clocks aligned is NTP. Checking a password against a central directory is RADIUS or LDAP. Encrypting a session with a certificate is TLS.
- Which of the following is a characteristic of a fiber optic cable?
- It collects buzzing from the nearby mains lead
- It runs for kilometres without a booster stage
- It carries an analog picture toward a receiver
- It fades badly beyond about one hundred metres
Correct answer: It runs for kilometres without a booster stage
Fibre carries light down a glass core, so it neither radiates nor picks up electrical noise, and it attenuates so slowly that single-mode runs stretch for many kilometres before a repeater is needed. Collecting buzz from a nearby mains cable is a copper problem, and avoiding it is one reason fibre is chosen in noisy plant. Carrying an analog picture is coax. Fading past about a hundred metres is the twisted-pair limit.
- In a wireless network, what does MIMO (Multiple Input Multiple Output) technology improve?
- It scrambles the frames with a stronger cipher
- It steers the signal toward one distant client
- It sends several streams over the same channel
- It shifts older clients onto the narrower band
Correct answer: It sends several streams over the same channel
MIMO uses several transmit and receive antennas to carry independent spatial streams over the same channel at the same time, which multiplies throughput and gives the receiver several copies to work with when one path fades. Scrambling frames with a stronger cipher is WPA2 or WPA3. Steering energy toward one client is beamforming. Moving older clients onto another band is band steering.
- Which type of cable is typically used for a Gigabit Ethernet connection?
- Category 3, the plain telephone grade wiring
- Category 5, the earlier fast ethernet cables
- Category 4, the abandoned token ring cabling
- Category 5e, the gigabit rated twisted pairs
Correct answer: Category 5e, the gigabit rated twisted pairs
Gigabit Ethernet over copper, 1000BASE-T, is specified on Category 5e, which tightens the crosstalk and return-loss limits of plain Cat 5 and uses all four pairs at once. Category 3 was voice-grade wiring good for 10 Mbps. Category 4 was a short-lived 16 Mbps token ring grade. Category 5 was written for 100 Mbps Fast Ethernet and does not meet the 5e crosstalk requirement.
- What is the primary role of a firewall in a computer network?
- It checks each packet against a written policy
- It hands out addresses from a configured scope
- It boosts a fading signal across longer cables
- It archives the recent replies inside a buffer
Correct answer: It checks each packet against a written policy
A firewall inspects the traffic crossing a boundary and permits or drops each packet according to a written rule set, which is how inbound and outbound access is controlled. Handing out addresses from a configured scope is DHCP. Boosting a fading signal over a longer run is a repeater or an extender. Archiving recent replies in a buffer is what a caching proxy does.
- What is the purpose of the 'ping' command in network troubleshooting?
- It traces the hops toward those faraway servers
- It asks whether a distant machine still answers
- It converts a hostname into the correct address
- It reports the current settings on this adapter
Correct answer: It asks whether a distant machine still answers
ping sends ICMP echo requests and waits for the echo replies, so it answers one question: is that host reachable, and how long does a round trip take. Tracing the hops on the way to a far server is traceroute or tracert. Converting a hostname into its address is nslookup or dig. Reporting the current address settings on the local adapter is ipconfig or ifconfig.
- What type of RAM is primarily used in modern graphics cards?
- DDR4, the older desktop memory
- SRAM, the on-chip cache memory
- LPDDR5, the phone class memory
- GDDR6, the wide channel memory
Correct answer: GDDR6, the wide channel memory
Current graphics cards are built around GDDR6, a memory type that trades latency for an extremely wide bus and very high bandwidth, which is what a GPU's parallel workload needs to keep its shader cores fed. DDR4 is ordinary desktop system memory on DIMMs. SRAM is the fast on-chip memory used for processor cache. LPDDR5 is the low-power memory soldered into phones and thin laptops.
- In a computer system, what is the primary purpose of a Southbridge chipset?
- Handling the slower ports on the mainboard
- Linking the processor to the memory arrays
- Stepping the supply down to lower voltages
- Building the frames drawn onto the display
Correct answer: Handling the slower ports on the mainboard
The Southbridge, on current boards usually called the chipset or the PCH, handles the slower input and output paths: SATA ports, USB, audio, the legacy buses and the expansion slots that do not run straight to the processor. Linking the processor to memory was the Northbridge's job and now lives inside the CPU. Stepping the supply down to core voltage is the VRM. Drawing frames is the GPU.
- Which connector type is commonly used for modern internal hard drives?
Correct answer: SATA
SATA is the interface on essentially every modern internal drive: a slim seven-pin data cable and a separate fifteen-pin power connector, with each drive on its own point-to-point link rather than a shared bus. EIDE is the older parallel ribbon interface that SATA replaced. SCSI, and its SAS descendant, belong to servers and workstations. ESDI is an obsolete parallel drive interface from the 1980s.
- What does the term 'thermal throttling' refer to in the context of CPU performance?
- Dropping the clock rate once the silicon runs hot
- Lifting the boost ceiling while the load is light
- Sharing the heavy work across the four idle cores
- Trimming the core voltage to save some wall power
Correct answer: Dropping the clock rate once the silicon runs hot
Thermal throttling is the processor protecting itself: when the die reaches its temperature limit the firmware drops the clock rate, and with it the heat the package produces, until the temperature falls back into range. Lifting the boost ceiling on a light load is turbo, the opposite behaviour. Sharing work across idle cores is the scheduler. Trimming core voltage saves power but is not a heat response.
- Which type of cable is most suitable for a 10 Gbps network connection over a distance of 100 meters?
- Cat 3 phone cable
- Cat 6a data cable
- Cat 5 older cable
- Cat 5e fast cable
Correct answer: Cat 6a data cable
Only Category 6a carries 10GBASE-T over the full 100-metre channel; the tighter alien-crosstalk limits and the 500 MHz bandwidth are exactly what that link needs. Category 6 reaches 10 Gbps only to about 55 metres. Category 5e tops out at 1 Gbps over that distance. Category 3 is voice-grade wiring rated for 10 Mbps and cannot carry gigabit at all.
- In the context of laptop displays, what does the term IPS stand for and signify?
- Twisted Nematic, giving the quickest pixel response
- Vertical Alignment, giving the deepest black levels
- Passive-Matrix film, giving the cheapest flat panel
- In-Plane Switching, giving the broad viewing angles
Correct answer: In-Plane Switching, giving the broad viewing angles
IPS stands for In-Plane Switching. The liquid crystal molecules rotate within the plane of the panel instead of tilting out of it, which is what gives an IPS laptop screen its accurate colour and its wide viewing angles. Twisted Nematic panels are cheaper and switch faster but wash out off axis. Vertical Alignment panels give the deepest blacks. Passive-matrix film is the cheapest and the slowest of all.
- What is the primary purpose of a ZIF (Zero Insertion Force) socket in computer hardware?
- It clamps the cooler down with even pressure
- It spreads heat outward into the metal cover
- It lets the processor drop in without effort
- It keeps the board rigid beneath each socket
Correct answer: It lets the processor drop in without effort
A ZIF socket carries a lever that opens the contacts, so the processor is lowered in with no downward force at all and the lever then clamps it. That is what keeps hundreds of delicate pins or pads from bending during installation. Clamping the cooler with even pressure is the retention bracket. Spreading heat outward is the integrated heat spreader. Keeping the board rigid is the backplate.
- Which type of RAM is typically used in the cache memory of a processor?
Correct answer: SRAM
Processor cache is built from SRAM. Each cell is a latch made of transistors, so it holds its value with no refresh cycle and can be read in a clock or two, which is exactly what a cache needs. DRAM stores each bit on a capacitor that must be refreshed constantly, which is why it is used for bulk main memory instead. VRAM and MRAM are specialised memories and neither is used for cache.
- What is the primary difference between an ATX and a MicroATX motherboard?
- The processor socket a package must match
- The chipset that supplies the front ports
- The physical outline with its slot number
- The memory standard those banks will take
Correct answer: The physical outline with its slot number
ATX and microATX are form factors, so what separates them is the physical outline of the board and the number of expansion slots that fit on it: a full ATX board is 305 by 244 mm and takes up to seven slots, while a microATX board is 244 mm square and takes at most four. Both accept the same processor sockets, the same chipsets and the same memory standards, so none of those separates them.
- In computer hardware, what is the function of a heatsink?
- It stores a charge to smooth the supplies
- It fills the tiny gaps beneath the cooler
- It steps the incoming mains down to volts
- It carries the heat away into flowing air
Correct answer: It carries the heat away into flowing air
A heatsink is a block of aluminium or copper with a large finned surface. It conducts heat out of the processor package and hands it to the air moving across the fins, and that is its whole function. Storing a charge to smooth a supply rail is a capacitor. Filling the tiny gaps under a cooler is thermal paste. Stepping incoming mains down to low-voltage DC is the power supply.
- Which connector type is commonly used for connecting solid state drives (SSDs) in a high-performance computing environment?
- The SATA 1 drive link
- The M.2 NVMe SSD slot
- The USB 3.2 host port
- The old IDE data plug
Correct answer: The M.2 NVMe SSD slot
A high-performance SSD sits in an M.2 slot and speaks NVMe across PCIe lanes, which removes the SATA bottleneck entirely and delivers several gigabytes per second. A SATA drive link is capped near 600 MB per second whatever drive is attached to it. A USB host port is an external interface with its own overhead. An IDE data plug is the obsolete parallel interface that SATA replaced.
- What is the purpose of ECC (Error-Correcting Code) memory in a computer system?
- It buffers the address lines so more modules fit
- It couples two channels into one wider data path
- It notices a flipped bit then repairs it quietly
- It stores a quicker timing profile for the buyer
Correct answer: It notices a flipped bit then repairs it quietly
ECC memory carries extra bits holding a code computed over each stored word, so the controller notices a corrupted bit, repairs a single-bit error on the fly and logs it, which is why servers and workstations insist on it. Buffering the address lines so more modules fit describes registered memory. Coupling two channels into a wider path is dual channel. Storing a quicker timing profile is XMP.
- In the context of computer hardware, what is a primary function of the CMOS battery?
- It holds the clock plus the saved setup values
- It smooths the ripple left on the supply rails
- It feeds the standby rail while the box sleeps
- It stores the keys needed to unlock the drives
Correct answer: It holds the clock plus the saved setup values
The CMOS battery is a small lithium cell that powers the real-time clock and the tiny CMOS store holding the firmware setup values while the machine is unplugged. When it fails the clock resets and the setup returns to its defaults. Smoothing ripple on a supply rail is a capacitor. Feeding the standby rail is the power supply. Storing keys that unlock a drive is the TPM.
- Which hardware component is responsible for converting digital signals to analog signals for a monitor?
- The memory storing each digital picture
- The converter feeding the analog output
- The regulator smoothing the supply rail
- The encoder packing the display streams
Correct answer: The converter feeding the analog output
An analog display output must be fed by a digital-to-analog converter, which turns each pixel value into the varying voltage present on the output pins; on a graphics card that converter is the RAMDAC. Storing each picture is the frame buffer. Smoothing a supply rail is the voltage regulator. Packing a stream for a digital link is the transmitter, and it never produces an analog level.
- What is the primary advantage of using a multi-core processor in a computer?
- It raises the top rate a lonely core reaches
- It widens the memory a single board can hold
- It cuts the power a package draws while idle
- It runs several tasks at the same clock tick
Correct answer: It runs several tasks at the same clock tick
Extra cores let a processor execute several independent tasks at the same instant instead of time-slicing one core between them, which is what improves multitasking and the throughput of software written to use them. Raising the top rate one core reaches is turbo boost. Widening the memory a board can hold is an addressing and chipset limit. Cutting idle power is a power-management feature.
- What type of power connector is typically used by modern graphics cards?
- The 4 pin Molex plug
- The 15 pin SATA lead
- The 8 pin PCIe cable
- The 24 pin ATX block
Correct answer: The 8 pin PCIe cable
A modern graphics card draws far more than the slot itself can supply, so it takes extra power from the PSU through PCIe power connectors, 6 pin and 8 pin, with high-end cards taking several. A Molex plug is a legacy peripheral connector. A SATA power lead feeds drives. The main ATX block plugs into the motherboard and never into a card.
- What is the function of the VRM (Voltage Regulator Module) on a motherboard?
- It keeps a charge ready for a sudden demand
- It trims the rail down to the core voltages
- It turns the mains feed into a flat current
- It reads the fan speed from a header signal
Correct answer: It trims the rail down to the core voltages
The VRM is the bank of chokes, MOSFETs and capacitors sitting beside the socket. It steps the rail arriving from the power supply down to the low core voltage the processor asks for, and it moves that voltage as load and clock change. Keeping a charge ready for a sudden demand is what the capacitors alone do. Rectifying mains into DC is the power supply. Reading fan speed is a header function.
- Which of the following is a primary characteristic of a Thunderbolt 3 connection?
- It settles around 480 Mbps of shared throughput
- It reaches near 100 metres over ordinary copper
- It supplies barely 4.5 watts across the adapter
- It transfers roughly 40 Gbps across one channel
Correct answer: It transfers roughly 40 Gbps across one channel
Thunderbolt 3 runs at up to 40 Gbps over a USB-C connector, enough headroom to carry PCIe and DisplayPort at the same time, which is why it drives external graphics enclosures and multiple high-resolution displays. It does not settle around 480 Mbps; that figure belongs to USB 2.0. It does not reach 100 metres, since passive Thunderbolt cables stay under a metre. It supplies far more than 4.5 watts.
- In computer hardware, what is the primary use of a riser card?
- It turns the slots sideways inside a small case
- It splits one drive bay into several thin trays
- It carries the narrow panel wires into a header
- It holds the cooler firmly against the chip lid
Correct answer: It turns the slots sideways inside a small case
A riser card plugs into a motherboard slot and turns the expansion slots through ninety degrees, so a full-height card can lie flat inside a slim or rack chassis that has no room for it standing upright. Splitting a drive bay into trays is a drive cage. Carrying panel wires to a header is the front panel connector. Holding the cooler against the chip is the retention bracket.
- What is the purpose of a KVM (Keyboard, Video, Mouse) switch in a computer environment?
- It gives one computer several private USB sockets
- It lets one console drive several linked machines
- It mirrors one video source onto several monitors
- It joins several computers onto one shared switch
Correct answer: It lets one console drive several linked machines
A KVM switch lets one keyboard, one monitor and one mouse drive several machines, with a button or a hotkey to choose which machine the console is attached to at that moment. Adding private USB sockets to one computer is a hub. Mirroring one video source onto several monitors is a splitter. Joining several computers onto a shared switch is ordinary networking and gives no console access.
- What is the primary purpose of a Type 1 hypervisor in a virtualized environment?
- It drives guests straight on the bare metal
- It boots after a plain desktop system loads
- It isolates each app onto one shared kernel
- It gathers the health data from these hosts
Correct answer: It drives guests straight on the bare metal
A Type 1 or bare-metal hypervisor installs directly onto the server hardware and schedules the physical processors, memory and input paths among its guests itself, with no general-purpose operating system underneath it. A Type 2 hypervisor loads only after a desktop operating system has booted. Isolating each app onto one shared kernel is a container runtime. Gathering health data from many hosts is a management console.
- In cloud computing, what is the main characteristic of the Infrastructure as a Service (IaaS) model?
- It ships finished software straight to a browser
- It provides a managed toolchain for coding teams
- It supplies virtual machines charged by the hour
- It stores backup copies inside a distant archive
Correct answer: It supplies virtual machines charged by the hour
IaaS rents the raw building blocks — virtual machines, block storage, virtual networks — and meters them by the hour, leaving the customer to install and patch everything above the hardware line. Shipping finished software straight to a browser is SaaS. Providing a managed toolchain for a development team is PaaS. Keeping backup copies in a distant archive is a storage service.
- Which technology allows different virtual machines on a single physical host to share the same physical network interface card NIC?
- Load balancing, which spreads sessions across servers
- NAT translation, which conceals the private addresses
- VPN tunnelling, which shields the travelling employee
- VLAN tagging, which carries several networks together
Correct answer: VLAN tagging, which carries several networks together
802.1Q VLAN tagging lets one physical NIC carry several separate networks at the same time: the virtual switch stamps each guest's frames with its VLAN identifier and the card trunks them all down a single wire. Load balancing spreads sessions across servers. NAT conceals a private address range behind one public address. A VPN tunnel shields a session crossing the internet. None of those three share a card.
- What does the term "elasticity" refer to in the context of cloud computing?
- Capacity that trails the load in both directions
- Copies that survive when an entire site vanishes
- Hardware that many tenants quietly share in turn
- Machines that sit spare until another host fails
Correct answer: Capacity that trails the load in both directions
Elasticity is the property that capacity trails demand in both directions: resources are added when load rises and, just as importantly, released when it falls, so the bill follows the workload instead of the peak. Copies that survive the loss of a site are redundancy. Many tenants quietly sharing the same hardware is multi-tenancy. Machines sitting spare until another host fails is failover capacity.
- In a virtualized environment, what is the role of a Virtual Machine Monitor (VMM)?
- It charts the workload that guests are placing
- It creates the guests then shares the hardware
- It thins the stored disk volumes behind guests
- It blocks the traffic flowing among the guests
Correct answer: It creates the guests then shares the hardware
A Virtual Machine Monitor is the hypervisor itself: it creates each guest, presents it with virtual processors, memory and devices, and time-shares the real hardware between all of them. Charting the workload a guest is placing is a monitoring tool. Thinning the stored disk volumes behind a guest is a storage feature. Blocking traffic flowing between guests is a virtual firewall.
- Which of the following best describes Software as a Service (SaaS) in cloud computing?
- A rented layer of raw virtual machine capacity
- A toolchain for pushing code onto hosted boxes
- A vault holding offsite copies of stored files
- A whole program reached inside a browser alone
Correct answer: A whole program reached inside a browser alone
SaaS delivers a finished application over the internet, normally through a browser, with the provider owning the code, the servers, the patching and the platform underneath. A rented layer of raw virtual machine capacity is IaaS. A toolchain for pushing code onto hosted servers is PaaS. A vault holding offsite copies of files is a backup or storage service.
- What is the main advantage of using thin provisioning in a virtualized storage environment?
- It drops the repeated blocks before each write
- It duplicates the blocks onto a second spindle
- It allocates actual blocks when the data lands
- It compresses the blocks into a smaller volume
Correct answer: It allocates actual blocks when the data lands
Thin provisioning shows the guest a large logical volume but consumes physical capacity only as data actually lands, so many machines each shown a big disk can share far less real storage. Dropping repeated blocks before a write is deduplication. Duplicating the blocks onto a second spindle is mirroring, or RAID 1. Compressing blocks into a smaller volume shrinks data that has already been written.
- In virtualization, what is the function of snapshot technology?
- It freezes the machine status at one instant
- It copies the whole machine onto backup tape
- It shifts a running machine onto other hosts
- It clones the machine into a golden template
Correct answer: It freezes the machine status at one instant
A snapshot freezes the state of a virtual machine at one instant — its disk, and usually its memory and device state as well — so the guest can be rolled back to exactly that point after a failed patch. It is not a backup, because it normally lives on the same storage as the machine. Copying the machine onto backup tape is a backup. Shifting a running machine to another host is live migration. Making a golden template is cloning.
- Which feature in cloud computing allows for automatic scaling of resources based on workload demands?
- Spreading requests across a shared server pool
- Holding a duplicate copy inside another region
- Pooling the hardware behind many quiet tenants
- Launching extra instances as the demand climbs
Correct answer: Launching extra instances as the demand climbs
Auto-scaling watches a metric such as processor use or queue depth and launches extra instances as demand climbs, then retires them when it falls, with nobody intervening. Spreading requests across a shared pool is load balancing, which divides work between whatever instances already exist. Holding a duplicate copy in another region is redundancy. Pooling hardware behind many tenants is resource pooling.
- What is the primary function of a cloud access security broker CASB in cloud computing?
- It delivers the pages stored at network edges
- It watches the traffic bound for hosted tools
- It replicates the records onto a distant site
- It issues the tokens that prove each identity
Correct answer: It watches the traffic bound for hosted tools
A cloud access security broker sits in the path between users and the cloud services they reach, and it applies the organisation's policy at that point: which services are permitted, what data may leave, and what behaviour looks anomalous. Delivering pages from edge caches is a CDN. Replicating records onto a distant site is backup. Issuing tokens that prove identity is an identity provider.
- What is the primary purpose of containerization in a cloud computing environment?
- It emulates a complete machine for each guest
- It splits a disk into several logical volumes
- It packages one app with its own dependencies
- It signs each image proving its stated source
Correct answer: It packages one app with its own dependencies
A container packages one application together with the libraries and configuration it needs into a single image that runs the same way on any host with a compatible kernel, which is what makes building, shipping and deploying software so much cheaper than moving whole machines. Emulating a complete machine for each guest is hardware virtualisation. Splitting a disk into volumes is storage management. Signing an image proves where it came from.
- What technology allows a virtual machine in a cloud environment to appear with its own IP address, independent of the host's IP address?
- Address translating, which numbers each guest privately
- VLAN labelling, which partitions the shared connections
- VPN tunnelling, which unites distant separated networks
- Virtual addressing, which fronts one clustered endpoint
Correct answer: Address translating, which numbers each guest privately
In the address translating mode a hypervisor offers, the guest is given its own address on an internal network and the hypervisor rewrites addresses on the way out, so the guest holds an address of its own instead of sharing the host's network stack directly. VLAN labelling separates networks carried on one wire. A VPN tunnel joins distant networks over the internet. A virtual address fronts a cluster.
- In cloud computing, what is the primary function of a Content Delivery Network (CDN)?
- It encrypts each session with a public keypair
- It stores archives inside a large object vault
- It serves copies from nodes nearest the viewer
- It routes each request through a policy filter
Correct answer: It serves copies from nodes nearest the viewer
A CDN keeps cached copies of static content on servers spread around the world and answers each viewer from the node nearest to them, which cuts round-trip time and takes load off the origin. Encrypting a session with a public keypair is TLS. Storing archives in a large object vault is cloud storage. Routing each request through a policy filter is a security broker.
- Which of the following best describes Platform as a Service (PaaS) in cloud computing?
- A rented pool of plain virtual server machines
- A finished bundle opened straight in a browser
- A vault keeping copies of the offsite archives
- A hosted runtime for writing then running code
Correct answer: A hosted runtime for writing then running code
PaaS hands developers a hosted runtime — the language stack, the build pipeline, the attached data services and the scaling — so they push code and never touch the operating system or the servers beneath it. A rented pool of plain virtual machines is IaaS. A finished bundle opened in a browser is SaaS. A vault keeping offsite copies of files is a storage service.
- What is a primary benefit of using virtualization in a data center?
- It shortens the cable runs between the cabinets
- It packs many workloads onto fewer server hosts
- It hides the traffic crossing between two sites
- It duplicates the site inside a distant country
Correct answer: It packs many workloads onto fewer server hosts
Virtualisation lets many workloads that each once occupied a lightly loaded physical server run as guests on far fewer hosts, so hardware spend, rack space, power and cooling all fall while utilisation rises. Shortening cable runs between cabinets is a structured cabling exercise. Hiding traffic crossing between two sites is a VPN. Duplicating the site in a distant country is disaster recovery.
- In a virtualized environment, what is "live migration" of a virtual machine?
- Relocating a running VM to a different physical host
- Duplicating a running VM into a separate stored file
- Capturing a running VM state for a rollback snapshot
- Enlarging a running VM memory ceiling while it works
Correct answer: Relocating a running VM to a different physical host
Live migration moves an executing virtual machine between physical hosts while it keeps running, so the guest never powers off and its services stay reachable. Copying a VM into a separate file is cloning, not migration. Freezing its state as a rollback point is a snapshot. Raising a memory ceiling on a live guest is hot-add resource resizing, which changes allocation without moving the guest anywhere.
- Which term describes the combination of cloud computing services from both public and private clouds to create a customized IT solution?
- Community cloud, pooling hardware among allied law firms
- Hybrid cloud, mixing internal racks with rented capacity
- Multi-cloud, buying like services from two rival vendors
- Private cloud, hosting one tenant on dedicated equipment
Correct answer: Hybrid cloud, mixing internal racks with rented capacity
A hybrid cloud deliberately combines on-premises or private capacity with public cloud capacity so one workload can span both. Pooling hardware among allied organizations describes a community cloud. Buying comparable services from two competing providers is multi-cloud, which has no private component. A single-tenant environment on dedicated equipment is purely a private cloud.
- What is the main advantage of using server virtualization in a corporate data center?
- Guaranteed separation that abolishes the need for patching
- Exclusive hardware access that raises raw processing speed
- Server consolidation that trims power plus cooling budgets
- Automatic licensing that covers each hosted guest instance
Correct answer: Server consolidation that trims power plus cooling budgets
Virtualization packs many guests onto far fewer physical hosts, so the data center draws less power and needs less cooling, which is where the operating saving comes from. Guests still need patching individually. Guests run on emulated or mediated hardware, so raw speed is slightly lower, not higher. Licensing is still counted per guest and is not waived by the hypervisor.
- In cloud computing, what is the main function of orchestration tools like Kubernetes and Docker Swarm?
- Provisioning hypervisor guests onto bare metal host hardware
- Encrypting live traffic between two isolated network regions
- Replicating stored volumes into a remote archival repository
- Scheduling containerized workloads across a cluster of nodes
Correct answer: Scheduling containerized workloads across a cluster of nodes
Kubernetes and Docker Swarm are container orchestrators: they schedule containerized workloads onto a pool of nodes, restart failed ones, and scale replicas. Placing virtual machine guests onto bare metal is the hypervisor's job. Encrypting traffic between regions is the work of a VPN or service mesh. Copying volumes to an archive is a backup or replication product.
- What is the purpose of using virtual desktop infrastructure (VDI) in an organization?
- Streaming a single published application window from a gateway
- Hosting user desktop sessions centrally on data center servers
- Imaging the physical workstations from a prepared master image
- Mirroring a technician desktop onto a user workstation display
Correct answer: Hosting user desktop sessions centrally on data center servers
Virtual desktop infrastructure runs full user desktops on centralized servers and delivers the display to thin clients or endpoints. Publishing a single application window is application virtualization, not a whole desktop. Deploying an image to physical workstations still leaves the desktop running locally. Showing a technician screen on a user machine is remote assistance.
- What is the most likely cause of intermittent connectivity issues in a wireless network, assuming the signal strength is strong?
- Outdated firmware running on the client wireless adapter
- Incorrect subnet masking applied to the attached clients
- Excessive DHCP leases lingering on assorted idle devices
- Overlapping channels reused by both nearby access points
Correct answer: Overlapping channels reused by both nearby access points
When signal strength is strong but the link keeps dropping, the usual cause is channel overlap with neighbouring access points, which produces contention and retransmission. Outdated client firmware tends to cause a consistent fault, not intermittent drops on a strong signal. A wrong subnet mask breaks routing outright rather than intermittently. Stale DHCP leases exhaust the address pool and stop new clients associating.
- In a PC, which component should be checked first when the system powers on but fails to complete the POST (Power-On Self Test)?
- The memory modules seated inside the DIMM slots
- The storage drive locked inside the SATA header
- The sound controller fitted inside a riser slot
- The optical drive anchored inside the drive bay
Correct answer: The memory modules seated inside the DIMM slots
POST is firmware code that runs before any operating system, and it cannot complete without working memory, so the memory modules are what a technician reseats or swaps first. The storage drive is not consulted until after POST hands off. A sound controller is not required to complete POST. An optical drive is likewise irrelevant to the memory and CPU checks POST performs.
- What tool is most effective for testing the physical integrity of an Ethernet cable?
- A signal generator coupled with an inductive amplifier
- A protocol analyzer intercepting frames from the trunk
- A time-domain reflectometer swept along the copper run
- A spectrum scanner sampling the ambient wireless noise
Correct answer: A time-domain reflectometer swept along the copper run
A time-domain reflectometer sends a pulse down the cable and times the reflection, so it finds opens, shorts and the distance to a physical fault in a copper run. A signal generator with an inductive amplifier only traces where a cable goes. A protocol analyzer reads frames on a working link and says nothing about copper integrity. A spectrum scanner measures radio energy, not cable condition.
- When troubleshooting a PC that suddenly shuts down, what should be checked first?
- The mechanical drive health reported by the diagnostics
- The installed memory voltages reported by the regulator
- The processor core temperature reported by the firmware
- The graphics refresh timings reported by the controller
Correct answer: The processor core temperature reported by the firmware
A machine that powers off abruptly under load is almost always shutting down on a thermal trip, so the processor core temperature reported by firmware is the first reading to take. Drive health explains data errors, not instant power loss. Memory voltages are a stability concern but do not trigger the thermal cutoff. Graphics refresh timings affect the display only.
- Which of the following is a common symptom of a failing power supply unit (PSU) in a computer?
- Random restarts under a moderate desktop load
- Colored vertical bars across the screen panel
- Repeated clicking noises inside the drive bay
- Frequent stop errors after a firmware upgrade
Correct answer: Random restarts under a moderate desktop load
A power supply that can no longer hold its rails under load causes the system to drop out and restart at random, often under moderate rather than peak demand. Coloured bars on the panel point at the graphics subsystem. Repeated clicking from the drive bay points at a failing mechanical disk. Stop errors that begin after a memory upgrade point at the new modules.
- In a scenario where a laptop connects to a Wi-Fi network but has no internet access, what is the first setting to check?
- The wireless channel width selected on the radio
- The SSID broadcast setting enabled on the router
- The MAC address exclusions applied on the switch
- The DNS resolver addresses offered to the client
Correct answer: The DNS resolver addresses offered to the client
The client has associated and holds an address, so the radio link is fine; name resolution is what breaks browsing next, which makes the DNS resolver addresses handed to the client the first thing to check. Channel width affects throughput, not reachability. A hidden SSID does not stop an already associated client. A MAC filter would have blocked association in the first place.
- What is the most likely cause of a 'No Signal' message on a monitor when a computer is powered on?
- A corrupted boot record on the primary volume
- A detached video cable at the graphics socket
- A depleted CMOS battery held in the mainboard
- A legacy display driver loaded by the machine
Correct answer: A detached video cable at the graphics socket
A 'No Signal' message means the monitor is receiving no video at all, which points at the cable or its seating at the graphics port rather than at anything the operating system does. A damaged boot record produces an on-screen error, so video is clearly present. A dead CMOS battery resets the clock and settings but still allows video output. A legacy display driver loads long after the panel has already shown POST.
- Which tool is essential for safely troubleshooting a power supply unit (PSU) in a desktop computer?
- A desktop computer POST diagnostic board
- A stand-alone memory module checker tool
- A pocket-sized tone generator probe wand
- A purpose-built power supply tester unit
Correct answer: A purpose-built power supply tester unit
A purpose-built power supply tester loads the rails and reads them through the connector shell, so the technician never opens a case that stores lethal charge in its capacitors. A POST diagnostic card decodes motherboard boot codes. A memory module checker exercises DIMMs. A tone generator probe traces cabling. None of the three touches the power supply.
- What is the most likely reason for a network printer to be accessible but unable to print?
- A duplex option enabled within the printer driver
- A flashing toner alert displayed on the faceplate
- A stalled spooler queue holding a failed document
- A landscape layout chosen inside the print dialog
Correct answer: A stalled spooler queue holding a failed document
The printer answers on the network, so the transport is healthy and the job is stuck in the queue on the spooler, which is what a technician clears and restarts. A duplex option changes how sheets are printed, not whether they print. A toner warning on the faceplate is advisory and does not halt output. A landscape layout only rotates what is already printing.
- In a laptop, repeated failure to recognize an inserted USB device most likely indicates a problem with what?
- A USB hub cascaded beyond the permitted tier maximum
- A damaged USB socket built into the notebook chassis
- A USB printer queued behind a paused spooler service
- A USB drive formatted with an unreadable file system
Correct answer: A damaged USB socket built into the notebook chassis
Repeated failure to enumerate any device inserted into one port points at that port itself, whose contacts or solder joints have failed on the notebook chassis. Tier limits apply to chained hubs, and no hub is in use here. A paused spooler stops printing but the printer still enumerates. An unreadable file system means the drive was recognised and only its contents cannot be mounted.
- What is the primary reason for a computer displaying the error message "Operating System Not Found" on boot?
- A boot volume lacking a valid bootloader entry marker
- A network adapter lacking a working PXE startup image
- A user profile lacking rights over the program folder
- A restore point lacking the newest registry hive copy
Correct answer: A boot volume lacking a valid bootloader entry marker
'Operating System Not Found' means the firmware handed off to a device that carries no usable bootloader entry, so the boot volume or its boot record is the fault. A missing PXE image produces a network boot error instead. A permissions problem on the system folder can only arise once the operating system is already running. A restore point with a stale registry hive matters only during a recovery, not at hand-off.
- In troubleshooting a network issue, which tool is used to trace the path a packet takes from the source to the destination?
- Tracert, reporting each hop along the entire pathway
- Netstat, reporting each socket opened by the machine
- Nslookup, reporting each record stored by the server
- Ipconfig, reporting each address bound to an adapter
Correct answer: Tracert, reporting each hop along the entire pathway
Tracert sends packets with rising time-to-live values and lists every router hop along the path to the target, which is exactly what path tracing means. Netstat lists sockets already open on the local machine. Nslookup queries name records held on a DNS server. Ipconfig reports the addresses bound to local adapters.
- When a computer's fan is constantly running at high speed, even under low load conditions, what should be checked first?
- The startup program entries recorded inside Task Manager
- The virtual memory allocation reserved on that partition
- The thermal interface layer beneath the processor cooler
- The driver rollback history logged inside Device Manager
Correct answer: The thermal interface layer beneath the processor cooler
A fan spinning hard while the system is idle means the cooler is not moving heat away, so the dried thermal interface layer between the processor and its cooler is the first thing to inspect. Startup entries would raise load, and the stem states load is low. Virtual memory sizing affects paging, not temperature. Driver rollback history has no bearing on cooling.
- What tool is commonly used to test the output voltage of each connector on a power supply unit (PSU) in a computer?
- A tone generator clipped onto the conductor
- A digital multimeter probed across the pins
- A POST analyzer seated inside the mainboard
- A loopback adapter inserted into the socket
Correct answer: A digital multimeter probed across the pins
A digital multimeter set to DC volts is placed across the pins of each connector, which is how the individual rail voltages are read one by one. A tone generator identifies cable runs. A POST analyzer decodes firmware boot progress. A loopback adapter tests a network interface. None of them measures a supply rail.
- Which of the following issues is most likely indicated by a 'Double Beep' sound during a computer's boot process?
- Failure inside the primary storage controller
- Failure inside the integrated network adapter
- Failure inside the attached optical enclosure
- Failure inside the installed memory subsystem
Correct answer: Failure inside the installed memory subsystem
Two beeps at POST is the standard memory error code on mainstream firmware, so the fault lies in the installed memory. A storage controller fault is reported after POST hands off, not by the memory beep code. An integrated network adapter is not tested by the early POST memory routine. An optical enclosure is a peripheral and does not participate in POST.
- What is the primary function of a loopback plug when troubleshooting network issues?
- Measuring the overall length of an installed cable run
- Confirming a network socket sends its own traffic back
- Locating a single cable end within a cluttered cabinet
- Capturing the frames moving across a live network link
Correct answer: Confirming a network socket sends its own traffic back
A loopback plug ties transmit back to receive, so the interface receives its own traffic and the technician learns whether that port can send and receive at all. Measuring cable length is a reflectometer function. Finding one cable end in a patch field is a tone-and-probe job. Capturing frames on a live segment is a protocol analyzer function.
- In a scenario where a PC starts but the BIOS screen is not displayed, which component is most likely at fault?
- The graphics adapter driving the connected display output
- The storage controller managing the internal system drive
- The network interface bridging the cabled office backbone
- The sound subsystem supplying the chassis panel connector
Correct answer: The graphics adapter driving the connected display output
Firmware writes the POST and setup screens through the graphics adapter, so if the machine powers up and stays dark, the adapter or its output path is the first suspect. A storage controller fault appears only after firmware has already drawn a screen. A network interface plays no part in local display. A sound subsystem drives audio, never video.
- When troubleshooting a network issue, what does a "Request Timed Out" message in a ping test typically indicate?
- The hostname never resolved into a routable IP address
- The route exceeded its maximum allowed hop count limit
- The echo reply never appeared inside the wait interval
- The far end port rejected the inbound connection setup
Correct answer: The echo reply never appeared inside the wait interval
'Request Timed Out' means no ICMP echo reply arrived inside the wait interval, which is a statement about the missing reply rather than proof of any single cause. A name that will not resolve returns a resolution error before any packet is sent. A path that runs out of hops returns a TTL expired message. A refused connection is a TCP response and never appears in an ICMP echo test.
- What would be the first step in troubleshooting a PC that beeps continuously when powered on but does not display anything on the screen?
- Reflash the machine firmware from a bootable USB installer
- Replace the suspected mainboard with a known working spare
- Reload the operating system from the shipped install media
- Reseat the installed memory modules inside their own slots
Correct answer: Reseat the installed memory modules inside their own slots
Continuous beeping with no video is the firmware's memory fault signal, so reseating the installed modules in their slots is the cheap first move that clears seating and contact faults. Reflashing firmware is a later step and risks bricking a machine that will not POST. Replacing the mainboard is a last resort after cheaper parts are ruled out. Reloading the operating system cannot help a machine that never reaches the boot device.
- In a situation where a computer's hard drive is making a loud clicking noise, what is the most likely issue?
- Fragmentation spread across the drive index table
- Corruption inside the drive partition table entry
- Encryption applied across the drive volume blocks
- Mechanical breakdown of the drive head positioner
Correct answer: Mechanical breakdown of the drive head positioner
A repeating click is the head assembly failing to park and retry, which is mechanical damage inside the drive and calls for immediate imaging of the data. Fragmentation is a layout condition and is silent. Corruption in the partition table produces read errors without noise. Encryption changes how blocks are stored and adds no sound at all.
- What is the most probable cause of a BSOD (Blue Screen of Death) error in Windows immediately after installing new hardware?
- Insufficient unused storage remaining on the Windows partition
- Incompatible hardware installed without a signed device driver
- Fragmented data scattered across the entire mechanical platter
- Outdated firmware flashed onto the detachable optical recorder
Correct answer: Incompatible hardware installed without a signed device driver
A stop error that begins immediately after new hardware is fitted points at hardware that the system cannot drive, typically because no signed matching driver exists for it. Low free space slows a system and fills logs but does not fault at install time. Fragmentation degrades throughput only. Firmware on an external optical recorder has no bearing on a stop error triggered by the new device.
- Which Windows command displays and modifies the IP routing table, allowing you to add a static route to a specific network?
- Netstat, listing the current open session port table
- Nslookup, querying the remote name server zone table
- Route, managing the locally stored packet path table
- Pathping, measuring the reported packet loss per hop
Correct answer: Route, managing the locally stored packet path table
Route prints and edits the local IP routing table, and route add writes a static path for a named destination network. Netstat only reports the sockets currently open. Nslookup interrogates a name server and returns records. Pathping measures latency and loss hop by hop but never writes a route.
- A technician needs to convert a basic disk to a dynamic disk and create a new volume on a Windows workstation. Which built-in tool should be used?
- Disk Management, launched as diskmgmt.msc
- Disk Defragmenter, launched as dfrgui.exe
- Network Connections, launched as ncpa.cpl
- Registry Editor, launched as regedt32.exe
Correct answer: Disk Management, launched as diskmgmt.msc
Disk Management, opened as diskmgmt.msc, is the graphical console that converts a basic disk to dynamic and creates, formats and extends volumes. Disk Defragmenter reorders existing files and cannot create a volume. Network Connections manages adapters. Registry Editor edits configuration keys. None of the three alters disk layout.
- Which Windows edition is the minimum required to join a Windows computer to an Active Directory domain?
- Windows Home, aimed at machines in family households
- S mode Windows, aimed at locked school-owned laptops
- Windows Pro, aimed at fleets of managed workstations
- Windows IoT Core, aimed at small embedded appliances
Correct answer: Windows Pro, aimed at fleets of managed workstations
Windows Pro is the lowest edition that carries the domain join client, so it is the minimum required to attach a workstation to Active Directory. Windows Home has no domain join capability at all. A device in S mode is locked to Store-delivered software and cannot join. IoT Core targets headless embedded appliances and has no domain role.
- A user needs the Linux command to display the full path of the current working directory in a terminal. Which command should they use?
- Ls, itemizing the current directory contents
- Cd, switching the current directory location
- Ps, summarizing the current process snapshot
- Pwd, printing the current directory pathname
Correct answer: Pwd, printing the current directory pathname
Pwd prints the working directory as an absolute path, which is exactly what the user asked for. Ls lists the entries inside the directory rather than naming it. Cd changes the working directory but prints nothing. Ps reports running processes and has no connection to the file system location.
- Which Windows file system supports file-level encryption with EFS, file permissions, compression, and journaling?
- NTFS, used by the current Windows platform
- FAT32, used by older removable flash cards
- exFAT, used by larger portable disk drives
- ext4, used by common Linux root partitions
Correct answer: NTFS, used by the current Windows platform
NTFS is the Windows file system that supports the Encrypting File System, granular permissions, per-file compression and a journal. FAT32 has none of those features and caps files at four gigabytes. exFAT adds large-file support for removable media but still has no permissions or encryption. ext4 is a Linux file system that Windows does not use for these features.
- In macOS, which built-in feature provides automatic, incremental backups of the entire system to an external or network drive?
- Mission Control, organizing open windows into virtual desktops
- Time Machine, saving periodic snapshots onto external hardware
- Spotlight, indexing local records for immediate keyword lookup
- Keychain Access, holding saved secrets inside encrypted vaults
Correct answer: Time Machine, saving periodic snapshots onto external hardware
Time Machine takes scheduled incremental snapshots of the whole system to an attached or network destination and keeps a browsable history. Mission Control only arranges open windows and spaces. Spotlight builds a search index. Keychain Access stores credentials. None of the three creates a system backup.
- A technician wants to install Windows 11 but the upgrade is blocked. Which firmware/hardware requirement is most likely missing?
- A TPM 2.0 module absent from the installed motherboard
- A serial port header absent from the desktop mainboard
- An ECC memory module absent from the populated sockets
- A discrete sound card absent from the peripheral slots
Correct answer: A TPM 2.0 module absent from the installed motherboard
Windows 11 requires a TPM 2.0 module along with UEFI and Secure Boot, and a missing TPM is the requirement that most often blocks the upgrade. A serial port header, ECC memory and a discrete sound card are all real hardware, but Windows 11 has never required any of them, so their absence cannot block the installer.
- Which Windows command-line tool checks the integrity of protected system files and replaces corrupted ones with cached copies?
- Chkdsk /f, repairing corrupted volume records on disks
- Diskpart clean, wiping protected system data off disks
- Format /q, rewriting an empty allocation table quickly
- Sfc /scannow, restoring protected files from one cache
Correct answer: Sfc /scannow, restoring protected files from one cache
Sfc /scannow verifies the digital signatures of protected operating system files and replaces any that fail from the local component store cache. Chkdsk works on volume structures, not on file signatures. Diskpart clean erases the selected disk rather than repairing anything held on it. Format rewrites the allocation table and destroys the very files the question is about.
- A technician must remotely access a Windows desktop's GUI over the network using Microsoft's built-in protocol. Which protocol and default port are used?
- Interactive SSH on TCP port 22
- Insecure Telnet on TCP port 23
- Graphical RDP on TCP port 3389
- Universal VNC on TCP port 5900
Correct answer: Graphical RDP on TCP port 3389
Remote Desktop Protocol is the Microsoft-built graphical remote access protocol and it listens on TCP 3389 by default. SSH on 22 gives a command line, not a graphical desktop. Telnet on 23 is an unencrypted terminal protocol. VNC on 5900 is graphical but is a third-party protocol, not the built-in Windows one.
- Which Linux command is used to change the permissions of a file or directory?
- Chown, resetting the ownership field on objects
- Chmod, resetting the permission bits on objects
- Grep, scanning the matching text inside objects
- Umask, setting the default permission bit value
Correct answer: Chmod, resetting the permission bits on objects
Chmod sets the read, write and execute permission bits on an existing file or directory. Chown changes which user and group own the object rather than what may be done to it. Grep searches text for a pattern. Umask only supplies the default mask applied to newly created files and cannot alter an object that already exists.
- A user wants Windows to run a maintenance script automatically every night at 2 a.m. Which utility should the technician configure?
- Event Viewer, collecting logged alerts from each local service
- Task Scheduler, launching maintenance tasks on a timed trigger
- Services console, fixing how each background daemon must start
- System Configuration, naming the boot options used for testing
Correct answer: Task Scheduler, launching maintenance tasks on a timed trigger
Task Scheduler runs a program or script on a defined trigger, which is what a nightly two o'clock job needs. Event Viewer only records what has already happened. The Services console governs how background services start with the system, not a script at a fixed hour. System Configuration selects boot options for diagnostics. None of the three can start a job at a chosen time.
- Which type of partition table is required to support boot drives larger than 2 TB and more than four primary partitions?
- MBR, supported by outdated BIOS computers
- APM, supported by older Macintosh systems
- GPT, supported by newer UEFI motherboards
- LDM, supported by Windows dynamic volumes
Correct answer: GPT, supported by newer UEFI motherboards
GPT is the partition scheme that removes the two terabyte ceiling and the four primary partition limit, and it is what UEFI firmware boots from. MBR is exactly the scheme carrying those limits. Apple Partition Map is a legacy Macintosh layout. The Logical Disk Manager database describes Windows dynamic disks and is not the boot partition table.
- Which Windows tool lets an administrator enforce password policies, software restrictions, and security settings across domain computers?
- Event Viewer, gathering detailed logs from each local subsystem
- Performance Monitor, charting live resource counters over a day
- Device Manager, listing installed hardware with a driver status
- Group Policy Editor, pushing configured rules to domain members
Correct answer: Group Policy Editor, pushing configured rules to domain members
The Group Policy Editor authors the policy objects that push password rules, software restriction and security settings down to every domain-joined machine. Event Viewer only reads logs after the fact. Performance Monitor charts counters. Device Manager lists hardware and drivers. None of the three can enforce a setting.
- A technician performs an OS installation that wipes the existing partition and installs a fresh copy of Windows with no retained applications or settings. What is this called?
- Clean install, clearing the existing partition beforehand
- In-place upgrade, saving the older installed applications
- Repair installation, replacing the damaged startup loader
- Reset operation, restoring Windows while preserving files
Correct answer: Clean install, clearing the existing partition beforehand
A clean install wipes the target partition and lays down a fresh copy of Windows, so nothing from the previous system survives. The in-place upgrade path deliberately keeps installed applications and settings. Repair installation swaps out damaged system files while leaving user data alone. A reset that preserves files is likewise not a wipe.
- Which command-line utility in Windows is used to manage disks, partitions, and volumes from a text interface, including creating and formatting partitions?
- Ipconfig, reporting adapter addresses during one session
- Gpupdate, refreshing assigned policies without a restart
- Diskpart, assembling volumes through one console session
- Winver, revealing the installed build number immediately
Correct answer: Diskpart, assembling volumes through one console session
Diskpart is the text-mode utility that selects disks, creates and deletes partitions, formats them and assigns letters from a console session. Ipconfig reports network adapter addressing. Gpupdate reapplies group policy. Winver only reports the installed build number.
- Which macOS utility allows a user to manage installed fonts, disk first aid, and partitioning of drives?
- Finder, browsing user fonts installed on connected drives
- Disk Utility, applying First Aid across connected volumes
- Terminal, issuing shell commands inside a scrolled window
- Activity Monitor, charting live disk throughput over time
Correct answer: Disk Utility, applying First Aid across connected volumes
Disk Utility is the macOS tool that runs First Aid on a volume and erases, formats and partitions attached drives. Finder can browse font files sitting on a mounted drive but cannot repair or partition it. Terminal issues shell commands. Activity Monitor charts live processes and throughput. Note that installed fonts are actually managed in Font Book rather than Disk Utility, so only the first aid and partitioning halves of this question describe the tool correctly.
- A Windows user needs to map a network share to a drive letter from the command line. Which command accomplishes this?
- Net use, mapping a shared folder to a drive letter
- Net user, listing the local logins on a named host
- Netdom, joining a new host into a remote AD domain
- Netsh, tuning the LAN link from a simple text file
Correct answer: Net use, mapping a shared folder to a drive letter
Net use attaches a shared network folder to a drive letter from the command line and can persist the mapping across logons. Net user administers local accounts. Netdom joins and manages computer accounts in a domain. Netsh configures network interfaces from a script but never maps a share.
- Which Windows feature applies full-disk encryption to a drive and can leverage the TPM to protect the encryption key?
- EFS, encrypting selected files under a user certificate
- Windows Firewall, filtering inbound traffic by rule set
- User Account Control, seeking approval for system edits
- BitLocker, sealing the encryption secret inside the TPM
Correct answer: BitLocker, sealing the encryption secret inside the TPM
BitLocker encrypts a whole volume and can seal the volume master key inside the TPM so the disk unlocks only on its original machine. EFS encrypts individual files against a user certificate rather than the whole drive. The firewall filters traffic. User Account Control gates privilege elevation. Neither encrypts anything.
- In Linux, which command is used to elevate a single command to run with root (superuser) privileges?
- Su, switching the entire session to the root account
- Chmod, setting the permission flags on a single file
- Passwd, changing a saved password for a user account
- Sudo, running a chosen command with full root rights
Correct answer: Sudo, running a chosen command with full root rights
Sudo runs one nominated command with root privileges and then drops straight back to the ordinary user. Su switches the whole session to another account until the shell is exited. Chmod alters permission bits on a file. Passwd changes a stored account password. None of them elevates a single command.
- Which Windows utility consolidates fragmented data on a mechanical hard drive to improve read performance, and is generally avoided on SSDs?
- Disk Defragmenter, arranging fragments on a slow spinning disk
- Storage Sense, discarding temporary files on a fixed timetable
- Chkdsk, repairing the damaged directory entries on that volume
- Robocopy, mirroring the folder trees between two distant sites
Correct answer: Disk Defragmenter, arranging fragments on a slow spinning disk
Disk Defragmenter reorders file fragments so that mechanical heads make fewer seeks, which is why it helps spinning disks and is avoided on solid state drives that have no seek penalty and finite write endurance. Storage Sense deletes temporary files. Chkdsk repairs directory structures. Robocopy copies folder trees between locations.
- A help-desk technician suspects malware on a workstation. According to CompTIA's best-practice malware removal procedure, what should be done immediately after identifying and verifying the symptoms?
- Schedule repeat scans once the removal has finished
- Quarantine the infected host from the wider network
- Enable System Restore to capture a fresh checkpoint
- Educate the end user about safer browsing practices
Correct answer: Quarantine the infected host from the wider network
CompTIA's malware removal sequence identifies and verifies the symptoms first, then quarantines the infected system so the infection cannot spread across the network. Scheduling scans, re-enabling System Restore and educating the user are all genuine steps in the same procedure, but each of them comes later, after the machine has been isolated and cleaned.
- During malware remediation, why should System Restore be disabled before cleaning the infection?
- Restore points consume drive space required by the scanner
- Restore points reserve the registry hives during a cleanup
- Restore points hold infected files for a later reinfection
- Restore points reset the antivirus filters after a cleanup
Correct answer: Restore points hold infected files for a later reinfection
System Restore snapshots include the files the malware dropped, so leaving the feature on lets a later restore reintroduce the infection that was just removed. Restore points do consume disk space, but that is a capacity matter and not the reason to disable them here. They neither lock the registry against a scanner nor reset antivirus definitions.
- An attacker sends an email pretending to be the company's CEO, urgently requesting a wire transfer. Which social engineering technique is this?
- Whaling, a phishing attempt targeted at senior executives
- Tailgating, an entry gained behind an authorized employee
- Shoulder surfing, a peek grabbed at unlocked workstations
- Dumpster diving, a search made through unshredded cartons
Correct answer: Whaling, a phishing attempt targeted at senior executives
Whaling is spear phishing aimed at, or impersonating, senior executives, and a forged urgent wire request from the chief executive is the classic form. Tailgating is physical entry behind an authorised person. Shoulder surfing is reading an unattended screen. Dumpster diving is recovering information from discarded material. All three are social engineering, but none arrives by email.
- Which authentication approach requires two different factors, such as a password plus a code from an authenticator app?
- Single sign-on, reusing a password authentication across portals
- Multifactor authentication, pairing two different kinds of proof
- Least privilege, granting the narrowest workable permission list
- Mandatory access control, enforcing labels set by administrators
Correct answer: Multifactor authentication, pairing two different kinds of proof
Multifactor authentication requires evidence from two different categories, such as a memorised password plus a code generated on a device the user holds. Single sign-on reuses one credential across services and adds no second category. Least privilege and mandatory access control govern what an already authenticated user may reach, not how identity is proven.
- An attacker positions a rogue wireless access point with the same SSID as a legitimate network to intercept traffic. What is this attack called?
- Brute force, a tool guessing one network password each round
- SQL injection, a crafted query slipping into a database call
- Zero-day exploit, an attack using one old wireless code flaw
- Evil twin, a rogue hotspot cloning one trusted wireless name
Correct answer: Evil twin, a rogue hotspot cloning one trusted wireless name
An evil twin is a rogue access point advertising the same network name as a legitimate one so victims associate with it and their traffic can be read. Brute force is repeated credential guessing. SQL injection abuses an unsanitised query. A zero-day exploits an unpatched flaw. None of the three involves impersonating a wireless network.
- Which type of malware encrypts a victim's files and demands payment for the decryption key?
- Rootkit, burying itself deeply beneath the operating system
- Keylogger, capturing the keystrokes a careless user presses
- Ransomware, encrypting saved content until a ransom arrives
- Adware, injecting unwanted adverts into a web-based browser
Correct answer: Ransomware, encrypting saved content until a ransom arrives
Ransomware encrypts the victim's files and withholds the decryption key until a ransom is paid. A rootkit hides its own presence rather than extorting money. A keylogger records what is typed so credentials can be stolen quietly. Adware injects advertising. None of the three encrypts data for payment.
- Which security principle states that users should be granted only the minimum access rights needed to perform their job?
- Implicit deny, blocking any traffic without a matching rule record
- Defense in depth, layering several varied controls over each asset
- Least privilege, granting the narrowest access a single role needs
- Separation of duties, splitting a single task between two staffers
Correct answer: Least privilege, granting the narrowest access a single role needs
Least privilege grants each account only the rights the role actually requires, so a compromise reaches as little as possible. Implicit deny is the default-block rule at the end of an access list. Defense in depth layers independent controls. Separation of duties splits one sensitive task across two people. All are sound principles, but only one is about minimum rights.
- Which wireless encryption standard is the most secure and recommended for new networks?
- WPA2, secured by the CCMP blockwise encryption
- WPA, secured by the TKIP per-packet encryption
- WEP, secured by the RC4 unauthenticated cipher
- WPA3, secured by the SAE simultaneous exchange
Correct answer: WPA3, secured by the SAE simultaneous exchange
WPA3 is the current wireless standard and it replaces the pre-shared key exchange with Simultaneous Authentication of Equals, which resists offline dictionary attacks. WPA2 with CCMP is strong but still vulnerable to that offline attack. WPA with TKIP is deprecated. WEP with RC4 is trivially broken and should never be deployed.
- A user reports that a website's certificate produces a browser warning that it is not trusted. Which is the most likely cause?
- The connection negotiated a newer cipher than expected lately
- The certificate carries no signature from a trusted authority
- The browser preserved a compressed rendering of that document
- The server compressed each response with a standard algorithm
Correct answer: The certificate carries no signature from a trusted authority
A browser raises a trust warning when the certificate chain does not end at a certificate authority the browser already trusts, which is what happens with a self-signed certificate or one from an unknown issuer. Cipher negotiation, a cached page copy and response compression are all normal parts of an HTTPS session and none of them produces a trust warning.
- Which physical security method uses a unique fingerprint or facial scan to authenticate a user?
- Biometrics, matching a captured fingerprint against a saved model
- Smart card, carrying a certificate on an embedded microcontroller
- Key fob, broadcasting an encrypted rolling code towards receivers
- Hardware token, displaying a revolving numeric passcode on screen
Correct answer: Biometrics, matching a captured fingerprint against a saved model
Biometrics authenticates by comparing a live fingerprint or facial scan with a stored template of the same trait. A smart card holds a certificate on a chip the user carries. A key fob transmits a rolling code. A hardware token displays a rotating passcode. Those three prove possession of an object, not a body characteristic.
- Which feature in Windows prompts for administrator approval before allowing changes that affect system settings, helping prevent unauthorized software changes?
- Windows Defender Firewall, filtering packets against a port policy
- User Account Control, prompting an approval for privileged changes
- BitLocker, encrypting one complete volume with a hardware-held key
- AppLocker, restricting the applications a standard user can launch
Correct answer: User Account Control, prompting an approval for privileged changes
User Account Control intercepts an action that needs administrative rights and asks for approval before the change is applied, which is how it blocks silent software installation. Windows Defender Firewall filters network traffic. BitLocker encrypts volumes. AppLocker decides which executables may run at all. None of the three prompts for elevation.
- A technician wants to protect against unauthorized devices plugging into open network ports in a public area. Which control is most appropriate?
- Disable the unused switch ports inside a public corridor
- Shorten the DHCP lease covering the visitor address pool
- Suppress the SSID beacons on the public wireless network
- Increase the switch port bandwidth on the trunked uplink
Correct answer: Disable the unused switch ports inside a public corridor
Ports left live in a public area let anyone plug in, so disabling the unused switch ports, or binding them with port security, is the control that fits. A shorter DHCP lease only recycles addresses faster. Suppressing the SSID hides a wireless name and does nothing for a wall socket. More uplink bandwidth is a performance change.
- Which type of attack floods a system or service with traffic from many compromised hosts so legitimate users cannot access it?
- Man in the middle, relaying traffic between two unaware parties
- Spoofing, forging a false source address inside a packet header
- Cross-site scripting, placing a script onto a trusted site page
- Distributed denial of service, flooding a host from many agents
Correct answer: Distributed denial of service, flooding a host from many agents
A distributed denial of service floods a target from many compromised hosts at once so that legitimate requests cannot get through. A man-in-the-middle relays and reads traffic without flooding it. Spoofing forges a source address. Cross-site scripting injects code into a page. None of the three is a volumetric attack from many sources.
- Which mobile security method allows an administrator to erase all data on a lost or stolen device over the network?
- Screen pinning, trapping a handset into one running application
- Airplane mode, disabling the transmitters on a portable handset
- Remote wipe, clearing handset files from a management dashboard
- Developer options, revealing debug tools inside the system menu
Correct answer: Remote wipe, clearing handset files from a management dashboard
Remote wipe issues an erase command from a management console so a lost or stolen handset destroys its data before anyone can read it. Screen pinning only locks a device to one app in the owner's hands. Airplane mode disables the radios and would in fact stop the wipe command arriving. Developer options expose debugging tools.
- Which best practice helps protect against credential theft from a brute-force password attack?
- Password history, blocking reuse of those recent stored passwords
- Screen saver lock, protecting one unattended desk during idleness
- Login banner, warning each arriving guest about acceptable limits
- Account lockout, disabling each user login upon repeated failures
Correct answer: Account lockout, disabling each user login upon repeated failures
An account lockout policy disables the account after a set number of failed attempts, which stops an automated password guessing run before it succeeds. A password history rule prevents reuse but does not throttle guessing. A screen saver lock protects an unattended desk. A login banner is a legal notice. Neither slows an attacker.
- A user receives a pop-up claiming their computer is infected and urging them to call a phone number for support. What is this an example of?
- Adware, displaying paid advertisements inside a free download
- Spam, broadcasting bulk unsolicited messages into one mailbox
- Scareware, frightening a reader into telephoning one helpline
- Spyware, gathering browsing records without an owner noticing
Correct answer: Scareware, frightening a reader into telephoning one helpline
A pop-up claiming infection and pushing a phone number is scareware, a social engineering scam that harvests money or remote access from the frightened caller. Adware serves advertising for revenue without the fake alarm. Spam is bulk unsolicited mail. Spyware collects data quietly and avoids drawing attention to itself.
- Which authentication factor category does a hardware token or smart card belong to?
- Something you have, a physical item carried by the user
- Something you know, a secret word memorized by the user
- Something you are, a bodily trait measured by a scanner
- Somewhere you are, a spot derived from a network signal
Correct answer: Something you have, a physical item carried by the user
A hardware token or smart card is a physical object the user carries, which places it in the possession category, something you have. Something you know covers memorised secrets. Something you are covers biometric traits. Somewhere you are covers location-based checks. Only possession fits an object handed to the user.
- After remediating malware and re-enabling System Restore, what is the final step in CompTIA's malware removal best practices?
- Quarantine the affected machine from the corporate network
- Educate the end user about preventing further reinfections
- Remediate the affected host with upgraded scanning engines
- Schedule the recurring scans across the remaining machines
Correct answer: Educate the end user about preventing further reinfections
Educating the end user is the last of CompTIA's malware removal steps, taken once the system is clean and System Restore has been re-enabled, so the behaviour that caused the infection is not repeated. Quarantine, remediation and scheduled scanning are all real steps in the same procedure, but every one of them happens earlier in the sequence.
- A Windows PC displays the message 'No boot device found' after the user installed a second hard drive. Which is the most likely fix?
- Correct the boot drive order inside that firmware
- Convert the second drive into a dynamic partition
- Assign one drive letter to that connected storage
- Format that second drive using a clean filesystem
Correct answer: Correct the boot drive order inside that firmware
Adding a second disk changes the firmware boot order, so the machine now tries to boot the empty new drive; correcting the boot device order in UEFI or BIOS setup resolves it. Converting the new disk to dynamic, giving it a letter or formatting it are all valid operations on a newly added drive, but none of them tells firmware which device to boot.
- A user reports that Windows boots very slowly and many unnecessary programs launch at startup. Which tool best lets a technician disable startup items?
- Device Manager, rolling back one driver through properties
- Event Viewer, filtering Windows startup events by severity
- Task Manager, disabling programs inside the Startup screen
- Resource Monitor, watching live drive activity per process
Correct answer: Task Manager, disabling programs inside the Startup screen
The Startup tab of Task Manager lists everything that launches at sign-in and lets a technician disable entries one by one along with their measured startup impact. Device Manager works on drivers and hardware. Event Viewer reads logs. Resource Monitor charts live usage. None of the three can stop a program from auto-starting.
- An application repeatedly crashes and reports a missing DLL error. Which is the most appropriate first troubleshooting step?
- Roll back the graphics driver towards an earlier revision
- Run a complete disk examination for the startup partition
- Clear the temporary folders from the roaming user profile
- Repair the affected application using its own setup media
Correct answer: Repair the affected application using its own setup media
A missing DLL usually means the application's own installation is incomplete or damaged, so repairing or reinstalling that application through its installer restores the file the cheapest way. Rolling back a graphics driver addresses display faults. A disk check addresses volume errors. Clearing temporary folders frees space. None restores a missing application library.
- A Windows system shows the 'spinning wheel' and frequent application hangs, and Task Manager shows memory usage near 100%. What is the most likely cause?
- Graphics pipeline halted by a rendering exception
- Physical memory exhausted by the running workload
- Boot volume flooded by accumulated restore points
- Ethernet adapter throttled by one duplex mismatch
Correct answer: Physical memory exhausted by the running workload
Memory pinned near capacity with heavy paging is what produces the spinning cursor and application hangs, so the running workload simply needs more RAM than the machine has. A stalled graphics pipeline shows visual artefacts. A full boot volume slows storage, not memory. A duplex mismatch degrades the network link only.
- A mobile device drains its battery unusually fast and runs hot even when idle. Which is the most likely software-related cause to investigate first?
- A cached browser profile occupying most internal space
- A misbehaving app running constantly in the background
- A disabled auto-update setting inside the apps catalog
- A restricted data saver mode limiting outgoing traffic
Correct answer: A misbehaving app running constantly in the background
A misbehaving background app keeps the processor and radios awake, which drains the battery quickly and makes the device warm while it appears idle. A bloated browser cache consumes storage rather than power. A disabled auto-update setting has no power cost. A data saver restriction reduces background traffic and would lengthen battery life.
- A Windows update fails repeatedly and rolls back. Which built-in tool is designed to diagnose and fix common Windows Update problems?
- Windows Memory Diagnostic, testing fitted modules across boots
- Reliability Monitor, charting recent failures along a timeline
- Storage Sense, discarding unnecessary data when space dwindles
- Windows Update Troubleshooter, resetting the updater job queue
Correct answer: Windows Update Troubleshooter, resetting the updater job queue
The Windows Update Troubleshooter is the built-in diagnostic that stops the update services, clears the download cache and resets the update components that cause repeated rollbacks. Windows Memory Diagnostic tests RAM. Reliability Monitor charts past failures without fixing them. Storage Sense reclaims disk space.
- A user's web browser redirects searches to unfamiliar sites and shows excessive pop-ups. What is the most likely cause?
- A bloated cache directory slowing each browser page rendering
- An outdated browser build missing the newest security patches
- A browser hijacker arriving as one unwanted toolbar extension
- A saved autofill profile filling fields with stale identities
Correct answer: A browser hijacker arriving as one unwanted toolbar extension
Search redirection combined with heavy pop-ups is the signature of a browser hijacker that arrives as an unwanted extension or toolbar and rewrites the search provider. A bloated cache slows page rendering without redirecting it. A missing security patch is a risk, not a redirect. A saved autofill profile only fills form fields.
- A smartphone cannot download or update apps and reports insufficient storage. Which is the most appropriate first step?
- Delete the unused files to reclaim onboard storage space
- Disable the automatic photo backup inside the cloud menu
- Restart the handset to release the stalled system memory
- Clear the stored passwords held by that browser keychain
Correct answer: Delete the unused files to reclaim onboard storage space
The device is out of space, so removing apps and files that are no longer used, along with cached data, is what frees enough room for the download to complete. Turning off photo backup prevents future growth but reclaims nothing already stored. Restarting frees RAM, which is not the resource that is exhausted. Clearing saved passwords recovers a trivial amount.
- A Windows computer displays a 'BOOTMGR is missing' error and will not start. Which tool can rebuild the boot configuration from the recovery environment?
- Diskpart clean, wiping the partitions from a selected drive
- Sfc /scannow, replacing damaged Windows files using a cache
- Bootrec /rebuildbcd, writing a fresh boot setup data record
- Chkdsk /r, isolating bad sectors across the whole partition
Correct answer: Bootrec /rebuildbcd, writing a fresh boot setup data record
Bootrec /rebuildbcd scans the disks for Windows installations and writes a fresh boot configuration data store, which is what a missing boot manager entry needs from the recovery environment. Diskpart clean would destroy the partitions instead of repairing the boot entry. Sfc /scannow repairs system files but cannot recreate a boot store. Chkdsk /r maps bad sectors and leaves the boot configuration untouched.
- Applications on a workstation are extremely slow and the hard drive light is constantly active even with few programs open. Which is a likely cause to check?
- A saturated storage drive serving heavy paging traffic
- A fragmented registry hive scanned during each sign-in
- An outdated chipset driver installed by Windows Update
- A duplex mismatch negotiated for the copper connection
Correct answer: A saturated storage drive serving heavy paging traffic
Constant drive activity with few programs open points at the storage subsystem, either a drive that is failing and retrying reads or a machine paging heavily to disk. A fragmented registry hive is read once at sign-in. An outdated chipset driver rarely produces sustained disk activity. A duplex mismatch slows the network, not the disk.
- An Android app keeps force-closing immediately after launch on one device but works on others. Which troubleshooting step should be tried first?
- Roll the handset back onto an earlier firmware release
- Clear the stored cache from the app information screen
- Reset the network setup across the whole mobile device
- Disable the battery saving setting for that single app
Correct answer: Clear the stored cache from the app information screen
An app that force-closes on one device but works on others usually holds corrupt local data, so clearing its cache and stored data, then reinstalling if that fails, is the first and least destructive step. A firmware rollback is drastic and affects the whole device. Resetting network settings addresses connectivity. Battery optimisation changes background scheduling, not app data.
- A user complains that their PC's clock is wrong and secure websites give certificate date errors. Which fix addresses both symptoms?
- Replace the SATA harness feeding that internal volume
- Reinstall the network driver serving that LAN adapter
- Reset the browser cache holding those stale documents
- Replace the CMOS battery retaining the realtime clock
Correct answer: Replace the CMOS battery retaining the realtime clock
A clock that keeps drifting or resetting invalidates certificate validity dates, so setting the correct time and replacing the CMOS battery that fails to hold it cures both symptoms at once. Replacing a SATA cable addresses drive detection. Reinstalling a network driver addresses connectivity. Clearing the browser cache does not correct the system clock.
- A Windows PC shows a 'Low virtual memory' warning when running several large applications. Which adjustment most directly addresses this?
- Lower the System Restore disk allocation via the Protection tab
- Flush the DNS resolver caches using a privileged command prompt
- Increase the paging file limit on the primary storage partition
- Disable the fast startup option inside the Power Options applet
Correct answer: Increase the paging file limit on the primary storage partition
Correct answer: Increase the paging file limit on the primary storage partition. Explanation: A 'low virtual memory' warning means the pagefile that backs physical RAM has run out of room for the combined working set, so enlarging that pagefile (or adding RAM) is the direct remedy. Shrinking the System Restore allocation frees disk space for restore points but never enlarges the pagefile. Flushing the resolver caches only discards cached name lookups. Turning off fast startup changes how the kernel session is saved at shutdown and leaves the pagefile size untouched.
- A laptop's Wi-Fi works but a specific application cannot reach the internet while others can. Which is the most likely cause to check?
- The host firewall policy is blocking this single program
- The wireless adapter is negotiating a reduced link speed
- The default gateway is missing from the routing database
- The DNS search suffix is pointing towards another domain
Correct answer: The host firewall policy is blocking this single program
Correct answer: The host firewall policy is blocking this single program. Explanation: Every other program reaches the internet over the same association, so the radio link, addressing and routing are all healthy and the fault has to be scoped to one process, which is exactly what a per-application firewall or proxy rule does. A reduced negotiated link speed would slow all traffic rather than block one program. A gateway missing from the routing table and a wrong search suffix both break connectivity for every application at once, not for one.
- A technician about to open a desktop power supply should follow which safety procedure?
- Bond the chassis and the outlet ground pin when loosening any fasteners
- Leave the sealed supply shut and swap the entire failing module instead
- Drain the capacitor with a screwdriver while wearing an ESD wrist strap
- Measure the output voltages with a meter before opening the metal cover
Correct answer: Leave the sealed supply shut and swap the entire failing module instead
Correct answer: Leave the sealed supply shut and swap the entire failing module instead. Explanation: A power supply stores a lethal charge in its primary capacitors long after the cord is pulled, so the accepted field procedure is never to open the case and to replace the whole assembly. Bonding the case to an outlet ground pin puts the technician in the path of mains earth rather than protecting them. Shorting a capacitor with a screwdriver is the classic way to be injured by that stored charge, and an ESD strap protects components, not people. Taking output readings under the cover still means opening the sealed case.
- Which document records the planned steps, scope, and roll-back plan for a proposed IT change and requires approval before implementation?
- An incident report filed after a major outage
- A network topology diagram for the campus LAN
- A knowledge base article for the service desk
- A change request approved by the review board
Correct answer: A change request approved by the review board
Correct answer: A change request approved by the review board. Explanation: The change request is the artifact carrying the scope, the implementation steps, the risk assessment and the back-out plan, and it is what a change advisory board signs off before any work begins. An incident report is written after an unplanned disruption, not before planned work. A topology diagram documents how the network is wired. A knowledge base article records a known fix so it can be reused. None of those three carries an approval gate.
- Which device should be used to safely dispose of a worn-out laptop lithium-ion battery?
- Discharge it completely and stow it inside a locking cabinet
- Hand it over to an approved battery recycling collection bin
- Seal it within an anti-static bag and shelve it indefinitely
- Drop it in the general mixed-metal skip beside the workbench
Correct answer: Hand it over to an approved battery recycling collection bin
Correct answer: Hand it over to an approved battery recycling collection bin. Explanation: Lithium-ion cells are regulated waste and must go to a licensed recycler or hazardous-materials collection point, because a damaged or aged cell can vent and ignite. Discharging the pack and locking it away only defers the hazard while leaving it on site. An anti-static bag protects circuits against ESD and does nothing about a chemical hazard. General mixed-metal scrap offers no protection against cell puncture and is the wrong waste stream for lithium chemistry.
- When lifting a heavy server or UPS, which technique reduces the risk of injury?
- Bending the knees and driving through the leg musculature
- Hinging the waist and pulling through the lower vertebrae
- Twisting the torso and rotating through the planted heels
- Locking the elbows and reaching through the extended arms
Correct answer: Bending the knees and driving through the leg musculature
Correct answer: Bending the knees and driving through the leg musculature. Explanation: Squatting down to the load and then straightening the legs keeps the spine neutral and puts the effort on the largest muscle group, which is the accepted safe-handling posture. Folding forward at the waist loads the lumbar discs directly. Rotating while loaded is the movement most strongly associated with disc injury. Holding the weight out on locked arms multiplies the leverage acting on the back rather than reducing it.
- Which safety equipment prevents static electricity from damaging components during hardware service?
- A basic surge suppressor rated for branch circuits
- An anti-static wrist strap fastened to the chassis
- An analogue multimeter set to the continuity range
- A canister of compressed air held strictly upright
Correct answer: An anti-static wrist strap fastened to the chassis
Correct answer: An anti-static wrist strap fastened to the chassis. Explanation: The strap holds the technician at the same electrical potential as the equipment through a current-limiting resistor, so any charge bleeds away slowly instead of arcing into a component. A surge suppressor clamps transients arriving from the mains and does nothing about charge carried on a person. A multimeter measures circuits, it does not equalise potential. Compressed air is for dust removal, and the escaping gas can itself generate a static charge.
- A technician is told a chemical spilled in the workspace. Which document provides handling, hazard, and disposal information for that chemical?
- The posted emergency evacuation escape plan
- The chemical manufacturer safety data sheet
- The annual electrical equipment service log
- The regulated waste disposal manifest forms
Correct answer: The chemical manufacturer safety data sheet
Correct answer: The chemical manufacturer safety data sheet. Explanation: This is the standardised document supplied with a substance that gives composition, hazard identification, first aid, spill and leak procedures, storage limits and disposal, and it must be available wherever that substance is used. An evacuation plan shows exit routes for people. An equipment service log records test and inspection dates for electrical gear. A waste manifest tracks a consignment after it leaves the site and tells nobody how to deal with a live spill.
- When a technician must handle evidence for a potential legal investigation, which concept ensures the integrity and tracking of that evidence?
- The signed staff acceptable use policy agreement
- The negotiated vendor service level target sheet
- The documented chain of custody transfer records
- The corporate bring your own device restrictions
Correct answer: The documented chain of custody transfer records
Correct answer: The documented chain of custody transfer records. Explanation: Chain of custody is the unbroken written trail of who held an item, when, and for what purpose, and it is what makes the material admissible by demonstrating it was never altered or substituted. An acceptable use agreement governs how staff may use company systems. A service level target sets response and uptime commitments with a supplier. A personal-device standard defines which employee-owned hardware may join the network. None of them tracks the handling of evidence.
- Which professional behavior best demonstrates good communication when supporting a frustrated customer?
- Listen without interrupting and echo the stated problems back
- Recite the escalation pathway and quote the reference numbers
- Explain the fault using dense vendor jargon and abbreviations
- Restate the service level target and postpone the discussions
Correct answer: Listen without interrupting and echo the stated problems back
Correct answer: Listen without interrupting and echo the stated problems back. Explanation: Letting the customer finish and then reflecting the issue back in plain words confirms understanding and defuses frustration, which is the professional communication behaviour A+ tests. Reading out an escalation pathway and a reference number supplies internal process detail the customer never asked for. Dense vendor jargon and abbreviations are explicitly to be avoided with end users. Quoting a service target and pushing the call to later dismisses the concern instead of acknowledging it.
- Which type of fire extinguisher is appropriate for electrical fires involving energized equipment?
- Class A, a pressure water extinguisher
- Class D, a special powder extinguisher
- Class C, a carbon dioxide extinguisher
- Class K, a moist chemical extinguisher
Correct answer: Class C, a carbon dioxide extinguisher
Correct answer: Class C, a carbon dioxide extinguisher. Explanation: Class C covers fires in energised electrical equipment, so the agent has to be non-conductive and leave no conductive residue, which is why carbon dioxide or a clean agent is specified. Water conducts and is rated only for ordinary combustibles such as paper and wood. A special dry powder unit is for reactive metals. A moist chemical unit saponifies cooking oils and fats in commercial kitchens. Both of those agents are unsafe on live circuits.
- Which document defines what a company considers acceptable use of its computers and network by employees?
- A safety data sheet listing corrosive exposures
- A disaster recovery plan for production systems
- An asset inventory of every company workstation
- A written policy covering employee computer use
Correct answer: A written policy covering employee computer use
Correct answer: A written policy covering employee computer use. Explanation: This document states what staff may and may not do with corporate systems and the network, from personal browsing to installing software, and staff normally sign it on hire. A safety data sheet describes a chemical hazard. A disaster recovery plan defines how services are restored after an outage. An asset inventory is a register of owned hardware. None of the three sets behavioural rules for the people using the equipment.
- A technician discovers prohibited content while servicing a user's computer. What is the appropriate first action?
- Wipe the drive and reimage the workstation from a template
- Attach the extracted files onto a shared folder for review
- Continue the repair and report the issue at ticket closure
- Preserve the device and report it via the internal channel
Correct answer: Preserve the device and report it via the internal channel
Correct answer: Preserve the device and report it via the internal channel. Explanation: The technician stops work, leaves the material untouched so it stays admissible, and escalates by whatever route company policy defines. Wiping and reimaging destroys the very material that has to be preserved. Copying the files to a shared location spreads the content further and breaks the custody trail. Finishing the job and mentioning it at closure delays a report policy requires immediately and gives the material time to be altered.
- Which backup approach stores copies in a geographically separate location to protect against site-wide disasters?
- Replicating the backup set to a distant regional facility
- Writing nightly incremental sets to a second local volume
- Rotating removable disks between racks in the server room
- Keeping a consolidated full image on the production array
Correct answer: Replicating the backup set to a distant regional facility
Correct answer: Replicating the backup set to a distant regional facility. Explanation: Only a copy held far enough away to sit outside the same flood, fire or grid failure survives an event that destroys the primary site, which is the whole point of geographic separation. Nightly incrementals on a second local volume die with the building. Rotating media between racks keeps every copy inside one room. A consolidated full image on the production array shares the fate of the array it lives on.
- Which ticketing best practice helps other technicians understand and resolve a recurring issue efficiently?
- Log the caller identity, the device serial numbers, and the assigned queue
- Record the exact symptom, the steps attempted, and the confirmed final fix
- Note the ticket creation date, the resolution date, and the elapsed period
- Capture the site code, the cost centre, and the internal billing reference
Correct answer: Record the exact symptom, the steps attempted, and the confirmed final fix
Correct answer: Record the exact symptom, the steps attempted, and the confirmed final fix. Explanation: A ticket helps the next technician only when it says what was observed, what was tried and ruled out, and what actually resolved it, which turns a repeat call into a lookup. Caller and serial identifiers say who and which unit, never why or how. Creation and resolution timestamps measure handling time for reporting. Cost centre and billing references serve finance. None of those three lets anyone reproduce the fix.
- Which practice protects a customer's privacy while a technician works on their device?
- Open just the folders that the assigned repair task actually needs
- Browse the recent documents list to confirm that the profile loads
- Copy the user library onto a technician machine before any imaging
- Photograph the desktop wallpaper so the icon grid can be recreated
Correct answer: Open just the folders that the assigned repair task actually needs
Correct answer: Open just the folders that the assigned repair task actually needs. Explanation: Least-privilege access to customer data is the privacy rule: a technician touches what the job requires and nothing more. Opening the recent documents list to prove a profile loads exposes the titles of personal files when a plain logon test would answer the same question. Copying a user's library onto a technician's own machine moves customer data outside the customer's control. Photographing the desktop captures whatever personal content happens to be on screen.
- A technician needs to scale up to handle a high-priority outage affecting many users. According to incident response best practices, which action is appropriate?
- Notify the vendor account manager and postpone the internal callout
- Alert the affected users and close the incident tickets immediately
- Escalate to the responsible team and publish regular status updates
- Contact the on-call supervisor and defer the rebuild until tomorrow
Correct answer: Escalate to the responsible team and publish regular status updates
Correct answer: Escalate to the responsible team and publish regular status updates. Explanation: A widespread high-priority event exceeds one technician's scope, so incident handling calls for handing it to the team that owns the failing service while keeping everyone informed of progress. Calling the vendor's commercial contact and standing down the internal effort delays the technical fix. Closing tickets while the outage continues hides the impact from reporting. Reaching an on-call supervisor only to postpone the work leaves the users down overnight.
- A company wants to ensure all corporate mobile devices enforce encryption, passcodes, and remote wipe. Which solution centrally manages these policies?
- A physical network access control gateway appliance
- An endpoint antivirus agent per managed workstation
- A hosted mobile device management platform instance
- A directory group policy object applied domain-wide
Correct answer: A hosted mobile device management platform instance
Correct answer: A hosted mobile device management platform instance. Explanation: An MDM enrols phones and tablets and pushes a single profile that enforces encryption, passcode complexity and remote wipe, then reports compliance centrally. A network access control appliance decides what may join the LAN, not what a phone enforces once off the network. An endpoint antivirus agent scans desktops and has no phone enrolment. A group policy object applies to domain-joined Windows machines, which corporate handsets are not.
- Which power protection device keeps servers running long enough to shut down gracefully during a power outage?
- An uninterruptible power supply with sealed lead batteries
- A surge protection unit built around metal-oxide varistors
- A cabinet mounted distribution panel with switched outlets
- An isolation transformer with a grounded secondary winding
Correct answer: An uninterruptible power supply with sealed lead batteries
Correct answer: An uninterruptible power supply with sealed lead batteries. Explanation: The battery carries the load through the loss of mains so the operating system can flush its buffers and shut down cleanly, which is the whole purpose of the device. A surge unit clamps a voltage spike and passes nothing at all once the mains disappears. A distribution panel only splits and switches feeds already supplied to it. An isolation transformer separates circuits for safety and stores no energy of its own.
- Which best practice should a technician follow before making a significant configuration change to a production system?
- Raise the incident priority and assign it to the standby engineers
- Capture a complete backup and write a reviewed back-out plan first
- Increase the polling interval and silence the alerts for two hours
- Update the asset register and photograph the rack before you begin
Correct answer: Capture a complete backup and write a reviewed back-out plan first
Correct answer: Capture a complete backup and write a reviewed back-out plan first. Explanation: A restorable copy plus an agreed route back to the previous state is what makes a production change reversible, and change management asks for both before approval. Raising a priority and staffing the work says nothing about how to undo it. Widening polling and muting alerts removes the very signal that would show the change had broken something. Updating the register and photographing the rack are useful records but restore nothing.
- Which attack tricks users into entering credentials on a fraudulent website that mimics a legitimate one, often reached via a deceptive link?
- A distributed denial of service flooding attack
- A local privilege escalation exploit tool chain
- A phishing campaign hosting an imitation portal
- A zero-day remote code execution corruption bug
Correct answer: A phishing campaign hosting an imitation portal
Correct answer: A phishing campaign hosting an imitation portal. Explanation: Phishing works by social engineering: a deceptive message leads the victim to a look-alike sign-in page, and the victim types real credentials into an attacker-controlled form. A flooding attack exhausts bandwidth or connections to deny service and harvests nothing. Privilege escalation raises rights an attacker already holds on a machine. An unpatched remote execution bug is exploited against software directly and does not depend on tricking a user into typing anything.
- A company requires that hard drives be made unrecoverable before disposal. Which method physically guarantees data cannot be read?
- Running a single-pass zero overwrite across every logical sector
- Shredding the platters to fragments inside an industrial crusher
- Deleting the partition table and rebuilding a replacement volume
- Encrypting the container and discarding the stored recovery keys
Correct answer: Shredding the platters to fragments inside an industrial crusher
Correct answer: Shredding the platters to fragments inside an industrial crusher. Explanation: Destroying the media physically is the only method that leaves nothing to read back, which is what the requirement asks for; degaussing is its magnetic-media equivalent. A single overwrite pass is a logical sanitisation and leaves an intact, reusable drive. Deleting a partition table removes only the map to the data. Cryptographic erase depends on the key management and on the encryption itself never being broken, so none of the three physically guarantees anything.
- A Windows PC randomly displays a blue screen of death (BSOD) and reboots after a recent driver update. Which is the best first troubleshooting step?
- Run the offline system file checker and repair the damaged protected folders
- Rebuild the boot loader entries from the Windows recovery console right away
- Roll the recently updated device driver back to its previously known version
- Clear the crash dump directory and then increase the application log ceiling
Correct answer: Roll the recently updated device driver back to its previously known version
Correct answer: Roll the recently updated device driver back to its previously known version. Explanation: The crashes began immediately after one change, so undoing that change is the fastest way to confirm or eliminate it, and Windows keeps the prior driver package for exactly that purpose. Repairing protected system files addresses corruption that the symptom timeline does not point to. Rebuilding boot entries fixes a machine that will not start at all, and this one starts. Clearing dumps and enlarging a log collects evidence without removing the suspected cause.
- A user cannot open files because an application reports them as 'corrupted,' and the issue started after an abrupt power loss. Which tool best checks the file system for errors?
- Chkdsk, which validates the NTFS volume metadata
- Regedit, which edits the stored registry entries
- Msinfo32, which lists the local hardware summary
- Ping, which measures the network round-trip time
Correct answer: Chkdsk, which validates the NTFS volume metadata
Correct answer: Chkdsk, which validates the NTFS volume metadata. Explanation: An abrupt power loss can leave the file system's own structures half-written, and chkdsk walks those structures, repairs the index and recovers or reallocates bad clusters. Regedit only opens the configuration database and cannot see file system structures. Msinfo32 reports an inventory of installed hardware and drivers. Ping measures reachability and latency across a network. None of those three inspects or repairs a volume.
- A workstation's antivirus is disabled and will not turn back on, and the user cannot access security websites. What does this most likely indicate?
- An active malware infection is blocking the local defender tools
- A corrupted logon profile is loading a temporary network session
- An expired licence is keeping the suite in reduced functionality
- A misconfigured proxy is dropping outbound traffic over port 443
Correct answer: An active malware infection is blocking the local defender tools
Correct answer: An active malware infection is blocking the local defender tools. Explanation: Disabling protection and preventing it from restarting, combined with blocked access to vendor sites, is the classic self-defence behaviour of a live infection trying to stop its own removal. A corrupted profile changes the user's desktop, not the protection service. An expired licence stops updates but leaves the product running and the vendor's site reachable. A bad proxy would block far more than security sites and would not switch protection off.
- A mobile device cannot install OS updates and shows random reboots and app crashes after the user installed apps from an unofficial source. What is the most likely cause?
- A depleted battery calibration cycle affecting the charging controller
- A completely exhausted storage partition blocking the firmware upgrade
- A weakened cellular signal interrupting the background restore service
- A malicious payload arriving inside the sideloaded application package
Correct answer: A malicious payload arriving inside the sideloaded application package
Correct answer: A malicious payload arriving inside the sideloaded application package. Explanation: Installing from outside the vetted store bypasses the platform's code signing and review, and hostile code then interferes with the update path while destabilising the system, which matches every symptom and the timeline. A battery calibration problem shortens runtime rather than crashing applications. A full partition blocks an upgrade but does not cause random reboots. A weak signal slows transfers and leaves the operating system stable.
- When diagnosing a printer that produces poor quality prints, what should be checked first?
- The remaining toner or ink cartridge reading
- The current printer driver version and build
- The stalled spooler service or waiting queue
- The negotiated link speed and duplex setting
Correct answer: The remaining toner or ink cartridge reading
Correct answer: The remaining toner or ink cartridge reading. Explanation: Faded, streaked or patchy output is most often simply a consumable running out, so the cheapest and fastest first check is how much toner or ink is left. A driver version affects how a page is rendered, not how densely it is marked. A stalled spooler stops pages appearing at all rather than degrading them. Link speed and duplex settings govern how the job reaches the printer and never change print density.
- In a scenario where a laptop's battery is not charging, what is the first component you should check?
- The internal lithium battery cell pack
- The detachable AC power adapter module
- The system board charging circuit path
- The lower chassis cooling fan assembly
Correct answer: The detachable AC power adapter module
Correct answer: The detachable AC power adapter module. Explanation: The charger is the cheapest, most exposed and most easily swapped part of the charging chain, so a known-good adapter of the correct wattage is checked before anything is condemned inside the laptop. Replacing the cell pack first risks fitting a good battery to a machine that still cannot charge. The board's charging path is a board-level repair reached only after the adapter is cleared. A cooling fan plays no part in charging.
- What is typically the cause of 'ghost' prints, where faint images of previous prints appear on newly printed pages?
- A degraded imaging drum or a failing fusing subassembly
- A moisture swollen stack or a sticking separation guide
- A stale printer driver or an outdated firmware revision
- A dried toner cartridge or an obstructed feeding roller
Correct answer: A degraded imaging drum or a failing fusing subassembly
Correct answer: A degraded imaging drum or a failing fusing subassembly. Explanation: A faint repeat of an earlier image means toner from the previous rotation was not removed or not properly bonded, which points at the photosensitive drum and its cleaning stage or at a fuser no longer reaching temperature. Damp or binding paper handling produces skew and jams, not repeated images. A stale driver or firmware changes rendering and page setup. A dry cartridge or worn pickup roller starves or misfeeds the page instead of duplicating it.
- What is the most likely cause of a system that starts up but displays nothing on the monitor and the monitor is known to be good?
- The operating system has failed to start its own graphical desktop shell
- The stored CMOS configuration has been cleared by a dying backup battery
- The graphics adapter is sitting loose within its own expansion card slot
- The processor has thrown a machine check exception during the early POST
Correct answer: The graphics adapter is sitting loose within its own expansion card slot
Correct answer: The graphics adapter is sitting loose within its own expansion card slot. Explanation: The machine powers up and runs, the display is proven good elsewhere, so the break lies in the video output path, and an unseated or failed adapter is by far the commonest cause. A shell that will not start still shows POST output and a background. A cleared configuration changes boot order and the clock but still produces video. A processor exception at POST stops the system rather than letting it start up normally.
- A technician powers on a desktop and hears a continuous, regular grinding noise coming from inside the case while the system POSTs normally and boots to Windows. The noise rises and falls with system load. Which component is the most likely source of the grinding noise?
- The NVMe drive is running its own wear-levelling cycle right now
- The motherboard coin battery is approaching the end of its power
- The chassis fan bearing has worn into a constant rubbing contact
- The DDR5 module is failing an internal on-die parity check today
Correct answer: The chassis fan bearing has worn into a constant rubbing contact
Correct answer: The chassis fan bearing has worn into a constant rubbing contact. Explanation: Only a spinning part can make a continuous mechanical noise, and only a fan changes speed with thermal load, which is exactly why the sound rises and falls as the system works harder. An NVMe drive has no moving parts and makes no sound at all. A coin cell is a battery with no mechanism to make noise. A memory fault produces crashes or refused POST, never a bearing sound that tracks system load.
- A user reports a sharp, rhythmic clicking sound from their desktop, followed by the system failing to find a bootable operating system on the next restart. Which device is the clicking most consistent with, and what does it signal?
- The optical drive is struggling to spin an unbalanced disc
- The power supply fan is striking a loosened internal cable
- The NVMe module is approaching its own endurance write cap
- The mechanical hard disk is suffering a serious head crash
Correct answer: The mechanical hard disk is suffering a serious head crash
Correct answer: The mechanical hard disk is suffering a serious head crash. Explanation: A regular click is the actuator repeatedly parking and retrying because the heads cannot read the servo data, and the machine then finds no bootable volume because that same platter holds the operating system. An optical drive spins only when a disc is loaded and the boot device is elsewhere. A fan hitting a cable makes a rattle that continues regardless of boot state. Solid-state media has no moving parts, so it fails silently rather than clicking.
- A technician runs the manufacturer's drive diagnostic and sees S.M.A.R.T. reporting rising Reallocated Sectors Count and Pending Sector Count values on a hard drive that still boots. What is the correct interpretation and action?
- The counters demand a manufacturer firmware update to clear
- The counters point toward a loosened SATA interface cabling
- The counters confirm a failure and merit prompt replacement
- The counters are typical and require a scheduled defragment
Correct answer: The counters confirm a failure and merit prompt replacement
Correct answer: The counters confirm a failure and merit prompt replacement. Explanation: Reallocated and pending sector counts rise only when the drive has found unreadable sectors and is spending its spare-sector pool, and a rising trend predicts complete failure, so the data is copied off and the unit swapped while it still reads. Clearing the counters with firmware would hide the evidence rather than repair the platters. Cable faults cause CRC and interface errors, not sector reallocation. Non-zero and climbing values are never normal, so defragmenting only adds wear.
- A technician presses the power button on a desktop and gets no fans, no lights, and no POST beeps at all. The wall outlet is confirmed good with another device. Which step best isolates whether the power supply unit is at fault?
- Reseat the memory modules and then try restarting the whole unit again
- Replace the coin cell and clear the stored firmware settings as normal
- Run the drive vendor tool and read the listed reallocation figures now
- Bench test the power supply separately using a tester or 24-pin jumper
Correct answer: Bench test the power supply separately using a tester or 24-pin jumper
Correct answer: Bench test the power supply separately using a tester or 24-pin jumper. Explanation: With no fans, no lights and no beeps, nothing downstream has been energised, so the question is whether the supply produces rails at all, and testing it out of circuit answers that without changing anything else. Reseating memory addresses a machine that powers up but will not post. Swapping the coin cell affects stored settings on a board that is already receiving power. A drive diagnostic needs a running system to run on.
- A user reports a brief burning or acrid plastic smell from their desktop just before it shut off and would no longer power on. What is the safest and most appropriate first action for the technician?
- Unplug the unit at once and inspect for any scorched components
- Rerun the restart cycle and see whether the smell returns again
- Update the firmware to the newest release and retry the startup
- Load a longer stress test and try reproducing the reported heat
Correct answer: Unplug the unit at once and inspect for any scorched components
Correct answer: Unplug the unit at once and inspect for any scorched components. Explanation: The smell of burnt insulation means something has already failed electrically, so removing power removes the fire and shock risk and lets the failed part be found before any further damage is done. Powering the machine again to see whether the smell returns deliberately re-energises a known fault. A firmware update cannot be applied to hardware that will not start. Stress testing a suspected electrical failure invites the very heat that caused it.
- A desktop powers on with fans spinning and lights on, but the monitor stays black with no signal and the system never produces video or POST output. The technician has confirmed the monitor and cable on another PC. Which troubleshooting step is most appropriate next?
- Reinstall the display driver from within a safe mode session
- Reseat the memory and card then check the diagnostic signals
- Reset the adapter settings and request a fresh address lease
- Replace the boot disk because the system cannot load Windows
Correct answer: Reseat the memory and card then check the diagnostic signals
Correct answer: Reseat the memory and card then check the diagnostic signals. Explanation: No video and no POST output means firmware never completed its self-test, and memory or a graphics card that is not properly seated is the commonest reason, with the beep pattern or board LEDs naming the subsystem that stopped it. A driver cannot be reinstalled on a machine that never reaches an operating system. Network settings play no part in POST. A failed boot disk still allows POST and video to appear before anything is loaded.
- A workstation repeatedly restarts a few seconds into Windows boot, never reaching the desktop, and cycles indefinitely. The technician suspects a failed update or driver. Which action most directly breaks the loop to diagnose it?
- Swap the modules and fit higher capacity matched sticks
- Replace the supply and fit a substantially larger model
- Reflash the main firmware and boot from removable media
- Enter recovery mode and switch off the automatic reboot
Correct answer: Enter recovery mode and switch off the automatic reboot
Correct answer: Enter recovery mode and switch off the automatic reboot. Explanation: Windows restarts by default after a stop error, which erases the evidence before anyone can read it, so turning that behaviour off inside the recovery environment holds the stop code on screen and breaks the cycle for diagnosis. Fitting larger memory changes the hardware without revealing why the machine fails. A bigger power supply addresses a symptom that has not been observed. Reflashing firmware is a heavier change that can leave the machine worse off.
- A Windows 11 workstation crashes to a blue screen of death (BSOD) with a stop code, and the crashes began immediately after the user installed a new third-party device driver. What is the most likely root cause?
- A badly fragmented internal system startup volume
- An expired retail product licence activation code
- A steadily degraded wireless network signal today
- An unsigned faulty third-party kernel mode driver
Correct answer: An unsigned faulty third-party kernel mode driver
Correct answer: An unsigned faulty third-party kernel mode driver. Explanation: Code loaded into kernel space runs with no protection between it and the rest of the system, so a defective or mismatched module is the classic source of stop errors, and the timing straight after installation points directly at it. Fragmentation slows access and does not halt the kernel. An unactivated product limits personalisation features rather than crashing. A poor radio link degrades throughput, which is a networking symptom and never a bug check.
- A technician is asked how to fix a recurring blue screen of death on a Windows 11 PC where the stop code references a memory management error. After the obvious driver checks, which hardware test most directly targets this stop code?
- Run an extended pattern test against each of the memory chips
- Run a full surface test over every mounted storage volume now
- Run a coin cell voltage test with a bench multimeter attached
- Run a loopback test on the onboard network adapter and cables
Correct answer: Run an extended pattern test against each of the memory chips
Correct answer: Run an extended pattern test against each of the memory chips. Explanation: A memory management stop code says the kernel found an inconsistency in the memory it manages, so once drivers are cleared the next step is to exercise the physical modules with a long pattern run that catches an unstable cell. A surface scan checks stored blocks on disk, which is a different subsystem. A voltage reading on the coin cell says only whether settings will survive a power cut. A loopback confirms a network path and has no bearing on RAM.
- A user's laptop screen shows the image stretched and bowed so that straight lines appear curved and the picture geometry looks warped, while an external monitor connected to the same laptop displays a perfect image. Where does the fault most likely reside?
- The discrete graphics chip mounted deep inside the laptop casing
- The installed display driver package shipped by the vendor today
- The operating system resolution and scaling choice for that user
- The integrated screen panel or the flexible ribbon carrier cable
Correct answer: The integrated screen panel or the flexible ribbon carrier cable
Correct answer: The integrated screen panel or the flexible ribbon carrier cable. Explanation: The same adapter, driver and settings drive both outputs, and only one of them is distorted, so the fault has to lie in the part of the chain the external output does not use, namely the built-in panel and the ribbon that feeds it. A failing graphics chip would corrupt the external image as well. A bad driver package would affect both displays equally. Resolution and scaling change size and sharpness, never the geometry of straight lines.
- A technician examines pages from a laser printer that are uniformly faded and light across the entire sheet, though text is still legible. Which corrective action should be attempted first?
- Purge the print heads with the maintenance utility routines
- Swap the fusing assembly and fit a manufacturer replacement
- Shake the toner cartridge horizontally and reseat it firmly
- Push the newest firmware bundle into the printer controller
Correct answer: Shake the toner cartridge horizontally and reseat it firmly
Correct answer: Shake the toner cartridge horizontally and reseat it firmly. Explanation: Uniformly light output across the whole sheet points at toner running low or settling to one side, and redistributing what is left restores density immediately and confirms the diagnosis before any part is bought. Purging print heads belongs to inkjet hardware and does not exist on a laser engine. A failing fuser leaves marks that smear rather than a page that is evenly faint. Firmware governs formatting and features, not how much toner reaches the page.
- A laser printer produces output where a faint duplicate of an image or text reappears farther down the page, repeating at regular intervals. What is the most common cause of this ghosting?
- A low toner level inside the cartridge that supplies the developing drum
- A misaligned paper guide inside the paper cassette that skews each sheet
- A stale printer driver inside the client that mangles the page rendering
- A worn cleaning blade inside the unit that leaves residual powder behind
Correct answer: A worn cleaning blade inside the unit that leaves residual powder behind
Correct answer: A worn cleaning blade inside the unit that leaves residual powder behind. Explanation: The image repeats at the circumference of a rotating part, which means charge or leftover powder from the previous revolution was never wiped away before the next image was written. A low consumable makes the whole page faint rather than printing a second faint copy of it. A guide that is out of position skews or jams the sheet. Driver problems change layout, fonts and margins and cannot reproduce an earlier image.
- Sheets coming out of a laser printer have visible folds and creases pressed into the paper. The technician has confirmed the paper is the correct weight and is loaded flat. Which area should be inspected as the most likely cause?
- The configured network address and the open ports inside the server
- The remaining toner level and the drum surface inside the cartridge
- The queued spooler jobs and the stalled documents inside the client
- The worn transport rollers and the fusing exit inside the mechanism
Correct answer: The worn transport rollers and the fusing exit inside the mechanism
Correct answer: The worn transport rollers and the fusing exit inside the mechanism. Explanation: A crease is pressed into the sheet as it is dragged through, so with the media itself ruled out the fault lies in the parts that grip and bend the paper, especially rollers that have worn flat or a blocked exit that lets the page buckle. Addressing and ports govern how a job arrives at the device. Toner and drum condition affect image quality, not paper shape. Queued jobs on the client explain nothing that happens after the sheet is picked up.
- A user reports that a shared network laser printer is not printing at all, the printer display shows 'Ready,' and no error is displayed on the device. A test page printed directly from the printer's own panel comes out correctly. Where should the technician focus next?
- The imaging drum surface and the toner cartridge seat slot
- The spooler service and the queued jobs on the workstation
- The paper tray sensors and the media size detection switch
- The fuser lamp heat and the thermistor feedback loop limit
Correct answer: The spooler service and the queued jobs on the workstation
Correct answer: The spooler service and the queued jobs on the workstation. Explanation: A test page produced from the device's own panel proves the engine, the consumables and the paper path are all healthy, which moves the fault upstream to whatever hands jobs to the printer, and a stuck spooler or blocked queue is the usual culprit. Drum and cartridge faults would spoil the self-generated page too. Tray sensors would raise an error on the display. A fuser problem would mark or jam the test page rather than leaving it perfect.
- A technician is troubleshooting a Windows 11 laptop that shows a yellow warning triangle over the network icon and the status 'Limited' or no internet, yet the adapter is connected to the access point. Running ipconfig shows an address of 169.254.x.x. What does this APIPA address indicate?
- The client failed to finish its address lease negotiations
- The configured DNS server record points at something wrong
- The default gateway sits behind a blocking firewall policy
- The wireless card driver has become badly corrupted lately
Correct answer: The client failed to finish its address lease negotiations
Correct answer: The client failed to finish its address lease negotiations. Explanation: A 169.254 address is self-assigned by the host only after it broadcasts for configuration and receives no answer, so the link layer is up and the automatic configuration service never replied. A wrong name server would still leave a properly leased address in place. A blocked gateway would give a routed address that simply cannot reach anything beyond the subnet. A corrupt adapter driver would usually stop the association with the access point altogether.
- A technician needs to troubleshoot a desktop that has no network connectivity. Which sequence of steps follows a logical bottom-up approach for an Ethernet client?
- Send a public name lookup, then replace the switch, then reinstall the whole client system
- Verify the cable link light, then confirm the address, then ping outside the local gateway
- Flush the resolver caches twice, then disable the firewall, then fit a spare Ethernet card
- Swap the wall jack early, then rebuild the profile, then update the missing firmware image
Correct answer: Verify the cable link light, then confirm the address, then ping outside the local gateway
Correct answer: Verify the cable link light, then confirm the address, then ping outside the local gateway. Explanation: A bottom-up approach starts at the physical layer and climbs, so the link indicator is checked first, then addressing, then reachability to the nearest router, then a name-based test that exercises resolution as well. Starting with a public name lookup is top-down and jumps past everything below it. Flushing caches and disabling protection changes several things at once and hides the layer that failed. Swapping hardware before any test replaces working parts on a guess.
- Users on one floor report that their Wi-Fi 6E connections drop and reconnect intermittently several times an hour, while wired clients on the same network are stable. Which cause is most consistent with intermittent wireless-only drops?
- A failed lease server that stops distributing any additional IP addresses
- A mistaken resolver record that stalls nearly all name lookups everywhere
- A faulty patch panel that interrupts the copper backbone quite frequently
- A crowded channel plan that keeps breaking the wireless client attachment
Correct answer: A crowded channel plan that keeps breaking the wireless client attachment
Correct answer: A crowded channel plan that keeps breaking the wireless client attachment. Explanation: Only the radio path is affected, and overlapping channels or competing transmitters raise the noise floor until stations lose their association and rejoin, which is exactly a repeated drop-and-recover pattern confined to one floor. A configuration server failure would strand wired hosts as well. A bad name record breaks lookups for every client equally. A faulty patch panel sits in the copper plant, which is the part reported as stable.
- A technician is dispatched for a laptop that 'will not charge.' The battery sits at a fixed percentage with the AC adapter plugged in. Which check best isolates whether the AC adapter is the problem before ordering a battery?
- Fit a replacement system board and retest the whole machine
- Load the firmware defaults and reboot into the setup screen
- Substitute a known good charger and check the rated wattage
- Launch the memory checker and review all the listed results
Correct answer: Substitute a known good charger and check the rated wattage
Correct answer: Substitute a known good charger and check the rated wattage. Explanation: Swapping in a proven unit of the correct rating separates a dead charger from a dead battery in one step, and an underrated supply can power the machine while never delivering enough current to charge it. Replacing the board first is the most expensive possible guess. Loading firmware defaults changes settings that were not implicated. A memory test exercises a subsystem that has nothing to do with the charging circuit.
- A technician notices a desktop CPU is thermal-throttling under light load, the cooling fan runs at maximum, and the system occasionally shuts down. Which condition is most consistent with these overheating symptoms?
- A failing supply rail drooping under sustained peak demands
- A dried compound layer blocking transfer under the heatsink
- A shortage of installed memory forcing steady page swapping
- A corrupted firmware table reporting the wrong sensor value
Correct answer: A dried compound layer blocking transfer under the heatsink
Correct answer: A dried compound layer blocking transfer under the heatsink. Explanation: Throttling at light load with the fan already at full speed means heat is being produced but not carried away, and a dried or badly spread interface layer, often with a dust-choked fin stack, is the classic break in that path. A sagging rail causes resets and instability rather than a rising core temperature. Too little memory drives disk activity, not silicon heat. A wrong sensor reading would not make the fan work harder while the machine shuts down.
- During POST a desktop emits a repeating beep pattern and never displays video. The technician consults the motherboard manufacturer's documentation. What is the primary purpose of these POST beep codes?
- To confirm that the running system has finished loading without any errors
- To report how much charge remains inside the replaceable onboard coin cell
- To signal which subsystem failed to initialise while the screen stays dark
- To announce that a pending firmware patch is waiting for the administrator
Correct answer: To signal which subsystem failed to initialise while the screen stays dark
Correct answer: To signal which subsystem failed to initialise while the screen stays dark. Explanation: Beep codes exist precisely because firmware may need to report a fault before any video output is available, and the pattern maps to a component in the board maker's own table. They are emitted during the self-test, long before an operating system could load, so they say nothing about it. They carry no measurement of the coin cell's remaining charge. They are not a notification channel for pending software updates.
- A technician must connect an external NVMe SSD enclosure to a laptop and wants the maximum sustained transfer rate available through a single reversible port. Which interface should be used?
- USB4 or Thunderbolt running over a USB-C connection
- eSATA or SATA running over an external interconnect
- USB 2.0 running over the obsolete Type-A receptacle
- DisplayPort running over a plain video signal cable
Correct answer: USB4 or Thunderbolt running over a USB-C connection
Correct answer: USB4 or Thunderbolt running over a USB-C connection. Explanation: These carry the highest sustained throughput available on the reversible connector the question specifies, and they tunnel PCIe so an NVMe enclosure runs near its native speed. External SATA is limited to the SATA bus ceiling and uses its own non-reversible plug. USB 2.0 is far slower and its Type-A plug only inserts one way. DisplayPort is a display transport and does not present storage to the operating system.
- A user's dual-monitor setup shows one display flickering and dropping out intermittently while the other is rock-solid. Both run from the same GPU. Which component should the technician inspect first on the affected display?
- The monitor brightness and contrast dial
- The current Windows power saving profile
- The screen cable and connector integrity
- The installed graphics driver build code
Correct answer: The screen cable and connector integrity
Correct answer: The screen cable and connector integrity. Explanation: One output misbehaves while the other, driven by the same adapter and the same software, is perfect, so the fault lies in the part of the chain unique to that output, and a marginal cable or a partly seated plug is the classic cause of intermittent dropout. A brightness control changes how bright the picture is, not whether it survives. A power plan applies to the whole machine. A driver serves both outputs, so a driver fault would disturb both.
- A technician suspects a recently added DDR5 module is unstable, causing random application crashes without a consistent stop code. Which approach best confirms whether a specific module is at fault?
- Order a considerably larger power supply and repeat afterwards
- Reinstall the operating system onto a freshly formatted volume
- Substitute each module individually into a known reliable slot
- Update the graphics firmware and rerun the failing application
Correct answer: Substitute each module individually into a known reliable slot
Correct answer: Substitute each module individually into a known reliable slot. Explanation: Isolating one variable at a time is the only way to attribute an intermittent crash to a specific stick rather than to a slot or to the pair, and an extended pattern run on each candidate confirms it. A bigger supply changes the power envelope without testing the suspect part. Reinstalling the system rebuilds software while leaving faulty hardware in place. A graphics firmware update touches a subsystem the symptoms never implicated.
- A technician is troubleshooting why a freshly built PC posts but reports only half of its installed DDR5 capacity in BIOS. Both modules are identical and seated. What is the most likely cause?
- The second module or its socket is defective rather than incorrectly seated
- The chosen processor cannot address that much memory inside a desktop tower
- The fitted power supply will not deliver quite sufficient current for those
- The installed operating system still needs a proper licence or product code
Correct answer: The second module or its socket is defective rather than incorrectly seated
Correct answer: The second module or its socket is defective rather than incorrectly seated. Explanation: Firmware counts what it can actually train, so exactly half the fitted capacity showing means one of the two identical modules, or the channel it sits in, is not responding, and swapping the pair between slots proves which. A modern desktop processor addresses far more than two consumer modules provide. A supply that could not feed the modules would prevent the machine posting at all. Licensing affects features in the operating system and never what firmware counts.
- A technician needs to confirm whether a network port on a switch is functioning without a second device, by looping the transmit pins back to the receive pins. Which tool accomplishes this?
- A handheld digital multimeter test probe
- A tone generator and inductive amplifier
- A motherboard POST code diagnostic board
- A dedicated switch loopback plug adapter
Correct answer: A dedicated switch loopback plug adapter
Correct answer: A dedicated switch loopback plug adapter. Explanation: The plug wires the transmit pins straight back to the receive pins, so the port sees its own signal returned and reports a link entirely on its own, which is exactly the single-ended test described. A multimeter measures voltage, resistance and continuity but cannot present a link partner. A tone generator and amplifier trace which cable is which through a wall. A POST card reads firmware progress codes from a board that will not start.
- A user reports that a mobile phone overheats and the touchscreen becomes unresponsive while running a GPS navigation app in direct sunlight, then returns to normal after cooling. What is the most likely explanation?
- A failing cell that now needs an immediate warranty exchange
- A poor carrier signal that adds noticeable delays to screens
- A corrupted platform image that demands a full factory reset
- A protective thermal cap that throttles the badly hot device
Correct answer: A protective thermal cap that throttles the badly hot device
Correct answer: A protective thermal cap that throttles the badly hot device. Explanation: Satellite navigation drives the radios, the display and the processor hard at once, and in direct sun the case cannot shed that heat, so firmware reduces clock speed and disables the touch layer until the temperature falls, which is why everything returns to normal on cooling. A cell at the end of its life shortens runtime rather than freezing input. Radio strength governs data rates and not touch response. Platform corruption would not repair itself once the device cooled.
- A technician finds that a Wi-Fi 7 capable laptop connects with a strong signal but achieves only a fraction of expected throughput, while a phone on the same access point reaches full speed. Which setting on the laptop should be checked first?
- The assigned default printer and its local spooler queue
- The adapter band and its channel width property settings
- The system clock and its currently configured time zones
- The screen resolution and its chosen refresh rate option
Correct answer: The adapter band and its channel width property settings
Correct answer: The adapter band and its channel width property settings. Explanation: A phone reaching full speed on the same access point proves the radio environment is healthy, so the limit must be on the client, and an adapter locked to the crowded lower band or to a narrow channel gives a strong signal at a fraction of the possible throughput. A default printer assignment has no bearing on radio negotiation. Clock and time zone affect certificates and logs. Resolution and refresh govern the display pipeline only.
- A desktop intermittently loses its Ethernet link for a few seconds at a time, and wiggling the cable near the wall jack reproduces the drop. Which is the most likely cause and the correct fix?
- An exhausted address pool at the server; restart the client and renew everything twice
- A stale resolver cache on the local workstation; flush the entries and reconnect again
- A failing processor under extreme thermal stress; fit a replacement chip and retest it
- A degraded patch lead or a loosened RJ45 termination; reterminate the cable and verify
Correct answer: A degraded patch lead or a loosened RJ45 termination; reterminate the cable and verify
Correct answer: A degraded patch lead or a loosened RJ45 termination; reterminate the cable and verify. Explanation: The drop follows physical movement of the cable, which places the fault at the physical layer in the conductor or the crimp, so the repair is to redo the termination or fit a replacement lead and prove the link stays up. An exhausted address pool would not respond to someone touching a cable. A stale resolver cache breaks name lookups without dropping the link. A processor fault would destabilise the whole machine rather than one interface.
- A technician is comparing DDR4 and DDR5 memory before specifying RAM for a new Windows 11 workstation build. Which statement accurately describes a difference introduced with DDR5?
- DDR5 operates at a much higher supply level than DDR4 and therefore draws considerably more current
- DDR5 restricts peak transfer rates below what DDR4 could reach in order to improve signal stability
- DDR5 keeps the same notch position that DDR4 uses so both memory types remain quite interchangeable
- DDR5 adds on-die error correction that DDR4 lacks and puts voltage regulation onto the module alone
Correct answer: DDR5 adds on-die error correction that DDR4 lacks and puts voltage regulation onto the module alone
Correct answer: DDR5 adds on-die error correction that DDR4 lacks and puts voltage regulation onto the module alone. Explanation: The generation moved two things that used to live elsewhere: single-bit correction now happens inside the DRAM die, and a power management chip on the stick itself supplies the rails instead of the mainboard. Supply voltage went down with the new generation rather than up. Peak data rates rose sharply instead of being capped. The notch sits in a different place precisely so the two generations cannot be fitted into the wrong board.
- A user asks why their server-grade RAM is labeled ECC while the memory in their gaming PC is non-ECC. What is the practical difference between ECC and non-ECC RAM?
- ECC parts operate at precisely double the frequency while non-ECC parts operate slower
- ECC parts fix single-bit faults automatically while non-ECC parts merely pass these on
- ECC parts hold data without refresh while non-ECC parts refresh their cells constantly
- ECC parts really suit portable machines while non-ECC parts suit desktop boxes instead
Correct answer: ECC parts fix single-bit faults automatically while non-ECC parts merely pass these on
Correct answer: ECC parts fix single-bit faults automatically while non-ECC parts merely pass these on. Explanation: The extra chip stores check bits that let the controller detect and repair a flipped bit in flight and flag a multi-bit event, which is why servers and workstations that must not corrupt data quietly use it. Clock rates are set by the speed grade, not by the presence of check bits. All dynamic memory needs periodic refresh regardless of correction. Both kinds exist in portable and desktop form factors alike.
- A technician is selecting memory for a laptop and must choose the correct physical form factor. Which type of RAM module is designed for laptops?
- A full-height RDIMM for server sockets
- A compact SO-DIMM for portable systems
- An obsolete RIMM with paired spreaders
- A vintage SIPP with staggered contacts
Correct answer: A compact SO-DIMM for portable systems
Correct answer: A compact SO-DIMM for portable systems. Explanation: The small outline module is physically shorter so it fits the restricted height of a notebook mainboard, and it is the form factor laptop and small form factor machines are built around. A full-height registered module is a desktop and server part that will not fit the space. RIMM was a Rambus-era desktop format. SIPP is a much older module with pins rather than an edge connector. None of the three is a laptop part.
- A technician needs to install an NVMe SSD that connects through the PCIe bus rather than the SATA bus. Which interface and slot does this drive use?
- An M.2 socket keyed for PCIe channels rather than for magnetic storage
- A 15-pin SATA power header wired straight from the main supply harness
- An old 40-pin IDE ribbon strip carried over from many earlier machines
- A Molex peripheral plug riding on the older internal wiring loom today
Correct answer: An M.2 socket keyed for PCIe channels rather than for magnetic storage
Correct answer: An M.2 socket keyed for PCIe channels rather than for magnetic storage. Explanation: The drive presents itself directly on the host's PCIe channels, and the M.2 socket with the matching key carries those channels to the mainboard, which is why the notch position must be correct for the card. A SATA power header only feeds power to a drive and carries no data at all. A ribbon header for the legacy parallel interface predates the bus entirely. A Molex plug is another power connector with no data path.
- A technician is told two SSDs both use the M.2 form factor, yet one runs far faster than the other. What most directly explains the speed difference between an M.2 SATA SSD and an M.2 NVMe SSD?
- The NVMe unit talks over PCIe lanes while the SATA unit stays capped lower
- The SATA unit uses faster flash chips while the NVMe unit uses slower ones
- The SATA unit draws a rather higher voltage while the NVMe unit draws less
- The NVMe unit holds far more internal cache while the SATA unit is smaller
Correct answer: The NVMe unit talks over PCIe lanes while the SATA unit stays capped lower
Correct answer: The NVMe unit talks over PCIe lanes while the SATA unit stays capped lower. Explanation: The form factor says only how the card is shaped; the protocol and the bus behind it decide throughput, and multiple PCIe lanes with a deep command queue leave the older serial bus far behind. Flash chips do not differ by interface in the way described. Operating voltage is not what limits either device. Cache size affects burst behaviour and cannot account for a difference of several times in sustained rate.
- A user wants to know whether to buy an SSD or an HDD for a new system. Which statement correctly contrasts the two storage technologies?
- The HDD contains fewer moving parts than the SSD, which spins a whole stack of platters
- The HDD reliably gives lower latency than the SSD, which rotates its discs at top speed
- The SSD stores data in flash cells, which read faster than the platter-based HDD can do
- The SSD must be defragmented far more often than the HDD, which rarely needs such tasks
Correct answer: The SSD stores data in flash cells, which read faster than the platter-based HDD can do
Correct answer: The SSD stores data in flash cells, which read faster than the platter-based HDD can do. Explanation: Solid-state storage has no head to move and no platter to bring under it, so access is electronic and latency is orders of magnitude lower than a mechanical drive can manage. The mechanical drive is the one with moving parts, not the other way round. Spinning media has higher latency, not lower, however fast it turns. Defragmentation is a mechanical-drive maintenance task and is avoided on flash because it only consumes write endurance.
- A technician is configuring storage for a server and wants striping with no redundancy to maximize performance and capacity. Which RAID level should be used, and what is the trade-off versus mirroring?
- RAID 0 requires three identical member drives while RAID 1 requires merely one
- RAID 0 stripes for pure throughput while RAID 1 duplicates for fault tolerance
- RAID 0 rebuilds instantly while RAID 1 rebuilds solely from an offsite archive
- RAID 0 protects against one failure while RAID 1 protects against two failures
Correct answer: RAID 0 stripes for pure throughput while RAID 1 duplicates for fault tolerance
Correct answer: RAID 0 stripes for pure throughput while RAID 1 duplicates for fault tolerance. Explanation: Striping spreads a file across members so reads and writes happen in parallel and every byte of capacity is usable, but nothing is held in reserve, so losing any member loses the set; mirroring keeps a complete copy and trades half the capacity for survival. Both levels start at two members, so the stated minimums are wrong. A striped set cannot rebuild at all because no redundant copy exists. A striped set survives no member loss.
- A technician needs a RAID array that tolerates a single drive failure using distributed parity while still using disk space efficiently. Which configuration fits, and what is its minimum drive count?
- RAID 5, which scatters its parity across at least three member drives
- RAID 1, which duplicates each single write and starts with two drives
- RAID 6, which stores double checksums yet builds from just two drives
- RAID 0, which offers scant protection beyond a pair of striped drives
Correct answer: RAID 5, which scatters its parity across at least three member drives
Correct answer: RAID 5, which scatters its parity across at least three member drives. Explanation: Distributed parity spreads the recovery information over every member instead of dedicating a whole disk to it, so one member can be lost and rebuilt while only a single drive's worth of capacity is given up, and three members is the smallest set that allows it. Mirroring survives a loss but spends half the capacity. Double parity is a real level but needs four members, not two. Striping alone gives no redundancy whatsoever.
- A technician must choose between RAID 5 and RAID 6 for an array where a second drive could fail during a long rebuild. How do these two levels differ?
- RAID 5 mirrors each entire sector onto a partner disk while RAID 6 stripes and drops parity
- RAID 5 keeps double parity blocks while RAID 6 keeps a lone parity block per written stripe
- RAID 5 tolerates two lost members at once while RAID 6 tolerates just a single parity fault
- RAID 5 holds one parity set and survives one complete failure while RAID 6 holds two others
Correct answer: RAID 5 holds one parity set and survives one complete failure while RAID 6 holds two others
Correct answer: RAID 5 holds one parity set and survives one complete failure while RAID 6 holds two others. Explanation: The second parity calculation is exactly what buys the extra tolerance, which is why the six-level is chosen when a large array faces a long rebuild during which another member might die. Neither level mirrors sectors onto a partner. The single and double parity assignments are the other way round in the second option. The tolerance figures are reversed in the third: one loss for single parity, two for double.
- A technician is asked to summarize the common nested and standard RAID levels for a study sheet. Which description of RAID 10 is accurate?
- RAID 10 provides no fault tolerance and exists purely for raising overall raw capacity
- RAID 10 writes double distributed parity over a minimum of four separate member drives
- RAID 10 stripes across mirrored sets and so combines striping speed with mirror safety
- RAID 10 produces just one duplicated volume with no gain in sequential disk throughput
Correct answer: RAID 10 stripes across mirrored sets and so combines striping speed with mirror safety
Correct answer: RAID 10 stripes across mirrored sets and so combines striping speed with mirror safety. Explanation: The nested level builds mirrored pairs first and then stripes across them, so reads and writes are spread for speed while each pair still holds a complete copy, at the cost of half the raw capacity. It is not a capacity play and it does tolerate loss within each pair. It uses no parity calculation at all. It is more than a single mirror, because the striping across pairs is exactly what raises throughput.
- A technician building a study reference wants the standard RAID levels ranked by what they provide. Which mapping of level to behavior is correct?
- RAID 0 gives simple parity, RAID 1 gives double parity, RAID 5 stripes, RAID 6 mirrors
- RAID 0 stripes alone, RAID 1 mirrors wholly, RAID 5 adds single parity, RAID 6 doubles
- RAID 0 mirrors firstly, RAID 1 stripes later, RAID 5 drops parity, RAID 6 keeps parity
- RAID 0 inverts parity, RAID 1 halves parity, RAID 5 mirrors sets, RAID 6 stripes disks
Correct answer: RAID 0 stripes alone, RAID 1 mirrors wholly, RAID 5 adds single parity, RAID 6 doubles
Correct answer: RAID 0 stripes alone, RAID 1 mirrors wholly, RAID 5 adds single parity, RAID 6 doubles. Explanation: The standard ladder runs speed, then redundancy by copy, then redundancy by calculation, then redundancy by calculation twice over, and that mapping is what the level numbers mean. The first option hands parity to the two levels that have none and behaviour to the two that compute it. The third has the lower two swapped and denies the five-level its parity. The fourth attaches parity to the striped and mirrored levels and behaviour to the parity levels.
- A technician is documenting the seven steps of the laser printer imaging process in the correct order. Which sequence is correct per the standard laser printing model?
- Cleaning, processing, charging, developing, exposing, fusing and transferring, as the published guidebooks list
- Processing, charging, exposing, developing, transferring, fusing and cleaning, in this clearly documented order
- Exposing, charging, processing, transferring, developing, cleaning and fusing, per the accepted standard models
- Charging, processing, developing, exposing, fusing, transferring and cleaning, under the usual printed sequence
Correct answer: Processing, charging, exposing, developing, transferring, fusing and cleaning, in this clearly documented order
Correct answer: Processing, charging, exposing, developing, transferring, fusing and cleaning, in this clearly documented order. Explanation: The page is first rasterised in memory, the drum is then given a uniform charge, the laser discharges the areas that will carry powder, powder is attracted to those areas, the sheet takes the powder from the drum, heat and pressure bond it, and the drum is wiped ready for the next revolution. Every other sequence puts wiping or bonding before the image has been written, or writes the image before the drum has been charged, which cannot work.
- A technician is reviewing the laser printing process and needs to identify the step where the toner image is permanently bonded to the paper. Which step performs this, and what does it use?
- The charging step, which uses a corona wire and lays down a uniform static charge
- The developing step, which uses a laser beam to write out the hidden latent image
- The fusing step, which uses heat and pressure to melt the toner onto coated paper
- The cleaning step, which uses an erase lamp to strip leftover powder off the drum
Correct answer: The fusing step, which uses heat and pressure to melt the toner onto coated paper
Correct answer: The fusing step, which uses heat and pressure to melt the toner onto coated paper. Explanation: Until this point the powder is held to the sheet only by static attraction and would brush straight off, so a heated roller and a pressure roller melt the plastic in it and press it into the fibres permanently. Charging prepares the drum surface before any image exists. Developing attracts powder to the discharged areas, and the laser belongs to the exposing step rather than this one. Cleaning removes what was left behind after the sheet has separated.
- A technician finds faint vertical lines and inconsistent print darkness on a laser printer and reviews how the drum receives its uniform negative charge. Which component is responsible for applying that charge to the photosensitive drum?
- The heated fuser lamp and its pressure assembly
- The rubber pickup pad inside the paper cassette
- The primary corona wire or its charging rollers
- The wide transfer belt beneath the imaging unit
Correct answer: The primary corona wire or its charging rollers
Correct answer: The primary corona wire or its charging rollers. Explanation: This component lays an even negative charge across the whole photosensitive surface before the laser writes, and when it degrades the charge becomes patchy, which shows up as bands and uneven density. The fuser bonds powder to the sheet after the image exists. The pickup pad drags a sheet out of the tray. The transfer stage pulls powder from the drum onto the paper. None of the three establishes the uniform surface charge.
- A user is deciding between an inkjet and a laser printer for a small office that prints high volumes of black text. Which statement accurately compares the two technologies?
- Laser fuses powdered toner through heat while inkjet sprays wet ink onto plain paper
- Laser warms a liquid reservoir while inkjet bakes fine dust across the printed pages
- Laser costs considerably more per sheet than inkjet while both print at equal speeds
- Laser loads wet cartridges while inkjet loads dry pigment sticks for every large job
Correct answer: Laser fuses powdered toner through heat while inkjet sprays wet ink onto plain paper
Correct answer: Laser fuses powdered toner through heat while inkjet sprays wet ink onto plain paper. Explanation: The two technologies differ in what they put on the page and how they fix it, and the powder process is fast and cheap per page in volume, which is what a text-heavy office wants, while the liquid process resolves photographs well at low duty. The second option swaps the materials between the technologies. The third reverses the running costs, since powder is the cheaper of the two per page at volume. The fourth swaps the consumables outright.
- A technician is servicing a receipt printer at a retail register that uses heat-sensitive paper and has no ink or toner. What type of printer is this, and how does it form an image?
- A laser unit, which fuses dried toner onto the sheet using a firm fusing press roller
- A thermal unit, which burns an image onto the treated sheet using a heated print head
- An inkjet unit, which sprays warm ink droplets onto the sheet using a fast nozzle bar
- An impact unit, which strikes an inked ribbon onto the sheet using a wired pin matrix
Correct answer: A thermal unit, which burns an image onto the treated sheet using a heated print head
Correct answer: A thermal unit, which burns an image onto the treated sheet using a heated print head. Explanation: Receipt printers carry no consumable other than the roll itself, because the paper is coated with a compound that darkens where a heating element touches it, which is why old receipts fade. A powder process needs a cartridge and a fuser. A liquid process needs cartridges of ink. An impact mechanism needs a ribbon and would work on ordinary paper. All three require a consumable the description rules out.
- A technician is choosing between HDMI and DisplayPort for connecting a high-refresh-rate gaming monitor. Which statement is accurate about these two display interfaces?
- HDMI transmits little accompanying audio, so DisplayPort demands a separate audio cable too
- DisplayPort and HDMI share one connector shell, so the leads are completely interchangeable
- HDMI carries just analogue video, while DisplayPort carries a wholly digital signal instead
- Both carry pictures and sound, though DisplayPort suits monitors and HDMI suits televisions
Correct answer: Both carry pictures and sound, though DisplayPort suits monitors and HDMI suits televisions
Correct answer: Both carry pictures and sound, though DisplayPort suits monitors and HDMI suits televisions. Explanation: The two interfaces are technically close, each carrying digital picture and sound over one lead, and the practical difference is where they are fitted: computer displays and graphics cards favour one, while sets and consumer equipment favour the other. Sound travels over both, so neither needs a separate cable. The plugs and their pinouts differ, so the leads are not interchangeable. Neither interface carries an analogue picture.
- A technician is comparing the reversible USB-C connector to legacy USB 3.0 Type-A ports. Which statement correctly distinguishes them?
- USB-C means a fixed signalling rating whereas USB 3.0 means a purely mechanical shape today
- USB-C and USB 3.0 both describe just one identical thing under two separate marketing terms
- USB 3.0 sockets accept either orientation but USB-C sockets accept just one rigid way round
- USB-C names a reversible plug geometry while USB 3.0 names a layered data transfer standard
Correct answer: USB-C names a reversible plug geometry while USB 3.0 names a layered data transfer standard
Correct answer: USB-C names a reversible plug geometry while USB 3.0 names a layered data transfer standard. Explanation: One term describes the physical plug and socket, which can be inserted either way up, and the other describes a signalling generation that is usually presented on the older rectangular plug, so the two terms answer different questions and can be combined freely. The first option swaps those roles. The second treats them as synonyms when a connector and a signalling generation are not the same kind of thing. The third reverses which plug is reversible.
- A technician needs to connect an external SSD enclosure to a new laptop at 40 Gbps over a single USB-C port. Which interface standard supports this throughput on a USB-C connector?
- USB 2.0, a serial bus that removable memory sticks require
- FireWire 800, a serial bus that old audio recorders needed
- eSATA 6Gb/s, a serial bus that 3.5-inch backup drives take
- Thunderbolt 4, a serial bus that modern laptop docks carry
Correct answer: Thunderbolt 4, a serial bus that modern laptop docks carry
Thunderbolt 4 is the standard that reaches 40 Gbps over a USB-C connector, so a single port can drive a fast external SSD; USB4 shares that same 40 Gbps ceiling and the same connector, and Thunderbolt 5 doubles it to 80 Gbps. USB 2.0 is a genuine bus but stops at 480 Mbps. FireWire 800 was an 800 Mbps bus retired years ago. eSATA does reach 6 Gbps, yet that is a small fraction of 40 Gbps and it needs a dedicated eSATA port rather than USB-C.
- A technician is sizing a power supply for a desktop with a 170W CPU, a 320W graphics card, and roughly 100W for the motherboard, drives, and fans. Approximately what continuous wattage do the components draw, and how should the PSU be rated?
- About 250W total, so a 400W unit gives plenty of room
- About 590W total, so a 500W unit keeps idle draw down
- About 590W total, so a 750W unit soaks up peak spikes
- About 990W total, so a 1100W unit will meet that load
Correct answer: About 590W total, so a 750W unit soaks up peak spikes
Adding 170W for the processor, 320W for the graphics card and roughly 100W for the board, drives and fans gives about 590W of continuous draw, and a supply should sit comfortably above that figure, so a 750W unit is the sensible pick. Headroom keeps the supply inside its efficient load band and covers transient spikes. A 500W unit sits below the measured draw and would shut down or age quickly. The 250W and 990W totals do not match the parts the technician listed.
- A technician is replacing a graphics card and must verify the power supply can feed it. Which connector on a modern ATX power supply is intended to deliver supplemental power to a discrete GPU?
- The 8-pin PCIe lead, which powers a modern display card
- The 24-pin ATX lead, which powers the 3.3V system rails
- The 15-pin SATA lead, which powers a mounted disk drive
- The 4-pin Molex lead, which powers an older cooling fan
Correct answer: The 8-pin PCIe lead, which powers a modern display card
Supplemental graphics power comes from the 6-pin or 8-pin PCIe lead, because the slot alone cannot supply what a discrete card draws; the newest cards take a 16-pin 12VHPWR or 12V-2x6 lead for the same job. The 24-pin lead is the main board feed. The 15-pin lead carries drive power. The 4-pin peripheral lead dates from the legacy era, still runs pumps and fans, and carries far too little current for a graphics card.
- A technician is selecting a CPU socket type for a new build and must match the processor to the board. Which statement about CPU socket architectures is accurate?
- PGA chips clamp under a socket plate that a lever secures
- BGA chips drop into a socket slot that a spring unlatches
- LGA chips and PGA chips share one socket that serves both
- LGA chips press flat pads onto pins that the socket holds
Correct answer: LGA chips press flat pads onto pins that the socket holds
In a Land Grid Array design the motherboard socket carries the fragile pins and the processor presents flat contact pads that press down onto them, while a Pin Grid Array processor carries the pins itself and drops into a socket full of holes. Intel desktop parts use the land arrangement and older AMD parts used the pin arrangement. The hinged retention plate belongs to the land design rather than the pin design, ball grid parts are soldered down and never socketed, and the two arrangements are mechanically incompatible.
- A technician must install expansion cards into a desktop and needs the slot that provides the most bandwidth for a graphics card. Which slot is used, and how is its bandwidth scaled?
- The PCIe x16 slot, where the lane total sets the bandwidth
- The M.2 socket, where the notch keying sets the lane width
- The DIMM slot, where the memory channels set the data rate
- The SATA port, where the drive revision sets the link rate
Correct answer: The PCIe x16 slot, where the lane total sets the bandwidth
A graphics card goes in the PCI Express x16 slot, and PCI Express bandwidth scales with how many serial lanes a slot wires up, which is why slots are described as x1, x4, x8 or x16. The M.2 socket is a storage form factor whose notch keying selects which interface a card may use, memory bandwidth is a function of how many memory channels are populated rather than of a card slot, and SATA is a drive interface whose revision fixes its link rate.
- A technician is installing a CPU cooler and must apply thermal paste between the processor and heat sink. What is the purpose of the thermal paste?
- It blocks the stray currents so the socket pins stay clean
- It cements the cooler down so the bracket needs no washers
- It cushions the die edge so the mounting load spreads wide
- It fills the microscopic pits so heat passes to the cooler
Correct answer: It fills the microscopic pits so heat passes to the cooler
Thermal interface material fills the microscopic pits and hollows between the processor lid and the cooler base, replacing trapped air with a medium that conducts heat far better, so the cooler can actually pull heat out of the chip. It is not an electrical insulator, and keeping current off the socket pins is the socket's own job. It is not an adhesive either; a bracket, clip or screws hold the cooler down. It also spreads no clamping load, because the retention hardware does that.
- A technician is choosing between air and liquid cooling for a high-performance CPU. Which statement about a closed-loop (AIO) liquid cooler is accurate?
- A sealed pipe carries fluid back to a wick that stays warm
- A pump pushes the coolant out to a radiator that fans cool
- A Peltier plate shifts heat to a cold face that fans chill
- A blower forces air past a fin stack that a shroud directs
Correct answer: A pump pushes the coolant out to a radiator that fans cool
A closed-loop or all-in-one liquid cooler runs a small pump that circulates coolant from a block on the processor lid out to a radiator, where mounted fans push the heat into the room, and that loop often beats an air tower under sustained load. The unit is sealed, so nobody refills it, and it still depends on fans. A wicking heat pipe, a thermoelectric plate and a blower with a shroud are all genuine cooling parts, but none of them describes the pump and radiator loop.
- A technician is documenting motherboard form factors for a build guide. Which ordering correctly reflects relative physical size from largest to smallest among common consumer boards?
- Mini-ITX leads the group, ATX follows, and microATX ends
- MicroATX leads the group, Mini-ITX follows, and ATX ends
- MicroATX leads the group, ATX follows, and Mini-ITX ends
- ATX leads the group, microATX follows, and Mini-ITX ends
Correct answer: ATX leads the group, microATX follows, and Mini-ITX ends
Standard ATX is the physically largest of the three consumer board formats and carries the most expansion slots, microATX is the shorter middle format with fewer slots, and Mini-ITX is the compact square board used in small-form-factor cases, so the ranking from largest to smallest runs ATX, then microATX, then Mini-ITX. Every other ranking offered puts a smaller board ahead of a larger one, which no board specification supports.
- A technician is replacing the firmware interface battery on a desktop and the system keeps losing its date and boot order when unplugged. Which small battery and chip are involved, and what do they retain?
- A CR2032 cell powers the CMOS chip holding the system time
- A lithium cell powers the RAM banks holding the boot order
- A nickel cell powers the disk cache holding the write list
- A backup cell powers the flash ROM holding the vendor code
Correct answer: A CR2032 cell powers the CMOS chip holding the system time
A CR2032 lithium coin cell keeps the CMOS and the real-time clock alive while the machine is unplugged, so the date and the firmware configuration survive a power loss; when that cell dies, the clock resets and saved firmware choices such as boot order are lost. System memory is volatile and holds nothing once power is removed. A drive cache is flushed by the drive itself. Firmware code sits in flash, which keeps its contents with no battery at all.
- A technician is connecting four SATA hard drives and needs to know the maximum throughput of the SATA III interface each drive uses. What is the SATA III (SATA 6Gb/s) bus speed, and what is its practical data rate?
- 1.5 Gbps of signaling, roughly 150 MB/s of real payload
- 3.0 Gbps of signaling, roughly 300 MB/s of real payload
- 8.5 Gbps of signaling, roughly 800 MB/s of real payload
- 6.0 Gbps of signaling, roughly 600 MB/s of real payload
Correct answer: 6.0 Gbps of signaling, roughly 600 MB/s of real payload
SATA III signals at 6.0 Gbps, and after encoding overhead that works out to roughly 600 MB/s of usable payload, which is the ceiling every drive on that bus shares and the reason a SATA SSD trails an NVMe drive. The 1.5 Gbps and 150 MB/s pair describes the first SATA revision, 3.0 Gbps with 300 MB/s describes the second revision, and 8.5 Gbps with 800 MB/s describes 8-gigabit Fibre Channel rather than any SATA revision.
- A technician needs to identify the connector that supplies the main power to an ATX motherboard. Which connector is it?
- The 8-pin EPS plug, which the processor rail alone takes
- The 15-pin SATA plug, which one spinning hard disk takes
- The 24-pin ATX plug, which the entire system board takes
- The 4-pin Molex plug, which an older chassis light takes
Correct answer: The 24-pin ATX plug, which the entire system board takes
Main board power arrives on the 24-pin ATX plug, commonly built as a 20+4 pair so it fits older boards, and it is the connector every desktop board needs before anything else will start. The 8-pin EPS plug feeds the processor rail beside it. The 15-pin plug powers drives. The 4-pin peripheral plug is a legacy connector for fans, lights and pumps. None of those three can start a board on its own.
- A technician is selecting display panel technology for users who need accurate color and wide viewing angles for photo editing. Among common LCD panel types, which best meets that need?
- TN panels, favoring the quickest pixels that gamers admire
- VA panels, favoring the deepest blacks that cinemas demand
- IPS panels, favoring the truest tones that editors require
- CCFL panels, favoring the cheap backlight that offices buy
Correct answer: IPS panels, favoring the truest tones that editors require
IPS, or In-Plane Switching, is the LCD panel type built for accurate color and a picture that holds its tone when viewed from the side, which is what photo and design work needs. TN panels trade color fidelity for very fast pixel response and shift badly off axis. VA panels give deep blacks and strong contrast but wash color out at wide angles. CCFL names a backlight technology used in older panels, not a panel type that improves color accuracy.
- A technician is asked which storage interface a 2.5-inch SATA SSD uses for both data and power. Which pair of connectors is correct?
- A 40-wire ribbon for data and a Molex cable for power
- A 34-pin header for data and a Berg pigtail for power
- An 80-wire cable for data and a barrel jack for power
- A 7-pin socket for data and a 15-pin socket for power
Correct answer: A 7-pin socket for data and a 15-pin socket for power
A 2.5-inch SATA drive uses two separate connectors: a 7-pin plug for the data link and a 15-pin plug for power, both on the same edge of the drive. The 40-pin ribbon with a peripheral power tail is the older parallel ATA arrangement, the 34-pin header with a small Berg lead is a floppy drive, and an 80-wire cable with an external barrel jack describes older drive cabling and a self-powered enclosure rather than an internal SATA drive.
- A technician notices a laser printer is leaving faint ghost images of a previous page on subsequent prints. Reviewing the imaging process, which step normally prevents this by removing residual toner and charge from the drum?
- Charging, the step where a roller floods the drum equally
- Exposing, the step where a laser writes the image stripes
- Transferring, the step where a sheet takes the toner away
- Cleaning, the step where a blade lifts the leftover toner
Correct answer: Cleaning, the step where a blade lifts the leftover toner
Ghosting of an earlier page means residue is surviving a full rotation, and the cleaning phase is what should prevent that: a soft blade scrapes leftover toner off the photosensitive drum and an erase lamp neutralizes the charge that remains, so the next page starts from a blank surface. A worn blade or a failing lamp produces exactly this fault. Charging applies the uniform charge, exposing writes the latent image, and transferring moves toner to the page; none of them clears residue.
- A technician is building a study sheet on the laser imaging process and needs the name of the step where negatively charged toner is attracted to the areas of the drum that the laser discharged. Which step is this?
- Charging, when a primary wire spreads an even charge over the drum
- Exposing, when the bright laser beam paints an image onto the drum
- Developing, when a roller dusts the loose toner on the imaged drum
- Transferring, when a moving sheet lifts the dry toner off the drum
Correct answer: Developing, when a roller dusts the loose toner on the imaged drum
Developing is the phase where charged toner on the developer roller is drawn to the parts of the photosensitive drum the laser has discharged, so the latent image becomes a visible toner image before it ever reaches paper. Charging is the earlier phase that applies a uniform charge across the drum. Exposing is where the laser writes that latent image. Transferring moves the finished toner image from the drum onto the sheet, after developing has already built it.
- A technician needs to memorize the seven layers of the OSI model from bottom to top for a networking class. Which sequence correctly lists the OSI layers starting at Layer 1?
- Physical, Data Link, Network, Transport, Session, Presentation, Application
- Physical, Data Link, Transport, Network, Session, Presentation, Application
- Physical, Network, Data Link, Transport, Presentation, Session, Application
- Data Link, Physical, Network, Session, Transport, Application, Presentation
Correct answer: Physical, Data Link, Network, Transport, Session, Presentation, Application
Counting up from Layer 1, the OSI stack runs Physical, Data Link, Network, Transport, Session, Presentation, Application. Layer 1 moves raw bits on the medium, Layer 2 frames them for the local link, Layer 3 addresses and routes them between networks, and Layer 4 handles end-to-end delivery before the upper three layers serve the application. The mnemonic Please Do Not Throw Sausage Pizza Away follows that order; the other sequences swap layers that sit in fixed positions.
- A user reports that a workstation cannot reach any network resource. Ipconfig shows the address 169.254.18.7 with a 255.255.0.0 mask. What does this address indicate?
- A loopback address that the local stack answers quickly
- A link-local address that a failed DHCP lease generates
- A carrier-grade NAT address that one provider hands out
- A multicast group address that routers flood to members
Correct answer: A link-local address that a failed DHCP lease generates
Anything in 169.254.0.0/16 with a 255.255.0.0 mask is an automatic private address a Windows client assigns itself after it fails to get a DHCP lease, which is why the machine can talk on its own link segment but reaches nothing beyond it. The loopback range is 127.0.0.0/8 and never leaves the host. Shared carrier space is 100.64.0.0/10 and is handed out by a provider. Multicast group addresses live in 224.0.0.0/4 and identify subscriber groups, not interfaces.
- A technician is choosing twisted-pair cabling for a new gigabit office run and must explain the practical difference between Cat 5e and Cat 6 to a manager. Which statement is accurate?
- Cat 5e delivers 10 Gbps and Cat 6 lingers somewhere behind
- Cat 6 carries 10 Gbps over glass strands instead of copper
- Cat 6 needs metal shields before it carries 10 Gbps safely
- Cat 6 twists tighter and carries 10 Gbps across short runs
Correct answer: Cat 6 twists tighter and carries 10 Gbps across short runs
Cat 6 uses a tighter twist rate and often a spline to cut crosstalk, which lets it carry 10 Gbps on runs up to roughly 55 meters, while Cat 5e is specified to 1 Gbps; Cat 6a extends 10 Gbps across the full 100 meters. The speeds are not reversed, both grades are copper twisted pair rather than glass, and unshielded Cat 6 carries 10 Gbps over short runs with no foil screen required.
- A help desk technician is explaining how a hub, a switch, and a router differ. Which description is correct?
- A hub blocks broadcasts, a switch leases addresses, a router maps hosts
- A hub repeats frames, a switch inspects MACs, a router connects subnets
- A hub splits collisions, a switch caches pages, a router encrypts links
- A hub labels VLANs, a switch translates ports, a router mirrors traffic
Correct answer: A hub repeats frames, a switch inspects MACs, a router connects subnets
A hub is a Layer 1 repeater that copies every frame out of every port, a switch is a Layer 2 device that learns MAC addresses and forwards a frame only to the port that owns it, and a router is a Layer 3 device that joins separate networks and forwards packets between them by IP address. The other groupings borrow real functions from firewalls, DHCP servers, DNS, bridges, proxies, VPN gateways, VLAN tagging, NAT and port mirroring, then attach them to the wrong device.
- A technician is configuring email for a user who wants messages to stay synchronized across a phone, laptop, and tablet. Why is IMAP a better choice than POP3 here?
- IMAP squeezes mail into the server, so a phone syncs faster
- IMAP holds mail inside the server, so clients see one state
- IMAP cloaks mail leaving the server, so POP3 sends in clear
- IMAP drains mail from the server, so a device stores copies
Correct answer: IMAP holds mail inside the server, so clients see one state
IMAP is built for multi-device use because the server keeps the authoritative mailbox and every client mirrors its folders, flags and read state, so an action on the phone shows up on the laptop and the tablet. POP3 was designed to pull messages down to one machine and, by default, remove them from the server, which is why folders and read state do not follow the user. Neither protocol compresses mail, and neither encrypts by default; TLS on 993 or 995 does that.
- A technician is comparing TCP and UDP for a voice-over-IP deployment. Which statement correctly distinguishes the two transport protocols?
- TCP numbers packets while UDP reorders the delayed arrivals
- TCP encrypts each payload while UDP forwards them unwrapped
- TCP crosses subnets while UDP remains inside adjacent links
- TCP resends lost segments while UDP forgets these instantly
Correct answer: TCP resends lost segments while UDP forgets these instantly
TCP is connection-oriented: it opens a three-way handshake, acknowledges what arrives and retransmits whatever is lost, so delivery is ordered and reliable at the cost of overhead. UDP is connectionless and sends datagrams with no acknowledgment, no retransmission and no ordering, which is why voice and video prefer it. Ordering belongs to TCP rather than UDP, neither protocol encrypts anything on its own, and both are transport protocols that ride over IP rather than routing between subnets.
- An administrator is migrating a network from IPv4 to IPv6 and needs to explain the addressing difference. Which statement accurately compares the two?
- IPv4 counts 128 bits shown as hex pairs, IPv6 holds 32
- IPv4 and IPv6 both reserve 64 bits behind a fixed mask
- IPv6 folds 48 bits into six groups of eight hex digits
- IPv4 writes 32 bits as decimal, IPv6 writes 128 as hex
Correct answer: IPv4 writes 32 bits as decimal, IPv6 writes 128 as hex
An IPv4 address is 32 bits written as four decimal octets, while an IPv6 address is 128 bits written as eight groups of four hexadecimal digits separated by colons. That jump from 32 to 128 bits is what replaces the roughly 4.3 billion IPv4 addresses with a pool large enough that exhaustion stops being a concern. The sizes are not reversed, neither version is a 64-bit format, and 48 bits in six groups describes a MAC address.
- A cable installer must run network cable through the open-air space above a drop ceiling that is used to circulate building air. Which cable type is required by fire code for this space?
- A direct-burial cable, whose jacket blocks soil and floods
- A riser cable, whose jacket suits vertical building shafts
- A plenum-rated cable, whose jacket resists flame and smoke
- A PVC cable, whose jacketing serves everyday office wiring
Correct answer: A plenum-rated cable, whose jacket resists flame and smoke
Air-handling space above a drop ceiling is a plenum, so fire code requires plenum-rated cable whose jacket, usually FEP, resists flame and gives off little toxic smoke when it burns. Riser cable is rated for vertical shafts between floors and is not sufficient in a plenum. Direct-burial cable is built for moisture and soil outdoors. Ordinary PVC patch cable is the type explicitly prohibited there, because its jacket produces dense smoke that the ventilation system would circulate.
- A technician is assigning addresses for an internal-only network and must choose from the private IPv4 ranges. Which of the following is a valid private address block?
- The 172.32.0.0 block, which a commercial ISP hands over
- The 169.254.0.0 block, which a failed DHCP client picks
- The 192.168.0.0 block, which a small LAN uses privately
- The 100.64.0.0 block, which one carrier NAT pool shares
Correct answer: The 192.168.0.0 block, which a small LAN uses privately
RFC 1918 sets aside three private ranges: 10.0.0.0/8, 172.16.0.0 through 172.31.255.255, and 192.168.0.0 through 192.168.255.255, so the 192.168 block is the valid choice for an internal-only network. The 172.32 block sits just outside the private span and is public space. The 169.254 range is link-local and only appears when DHCP fails. The 100.64 range is shared carrier-grade NAT space belonging to providers, not to a private site.
- A technician is terminating cables and needs to distinguish an RJ45 connector from an RJ11 connector. Which statement is correct?
- RJ45 carries two voice pairs while an RJ11 runs Ethernet data
- RJ45 and RJ11 share an identical jack outline, so either fits
- RJ11 needs a crimping tool that no RJ45 connector will accept
- RJ45 seats eight wires for data, RJ11 six for telephone lines
Correct answer: RJ45 seats eight wires for data, RJ11 six for telephone lines
An RJ45 plug terminates eight conductors and is the connector for twisted-pair Ethernet, while the narrower RJ11 carries up to six positions and is used for telephone lines, usually with only two conductors populated. The roles are not reversed. The plugs are different widths, so an RJ45 will not seat in an RJ11 jack. Both are crimped with common modular tooling, and neither connector terminates glass fibre.
- A technician is deciding between assigning a static IP address and using dynamic IP addressing for a network printer. Which statement best describes the difference?
- A static address requires a leased DHCP pool before it works
- A static address rotates at boot while a leased one persists
- A static address is assigned once while a leased one expires
- A static address suits printers while a leased one suits PCs
Correct answer: A static address is assigned once while a leased one expires
A static address is entered by hand in the adapter settings and stays put until somebody changes it, while a dynamic address is leased by a DHCP server and can change when the lease renews or the device moves. That is why printers, servers and other resources people must find by address are usually configured statically. A static address needs no DHCP server, it does not change at boot, and the two kinds are not restricted to servers or to clients.
- A technician needs to connect two computers directly with an Ethernet cable on equipment that does not support auto-MDI-X. Which cable type is traditionally required, and how does it differ from a straight-through cable?
- A rollover cable, which rearranges each pin and its neighbour
- A straight-through cable, which wires the two plug ends alike
- A crossover cable, which swaps the transmit and receive pairs
- A loopback cable, which reflects a port's own outbound signal
Correct answer: A crossover cable, which swaps the transmit and receive pairs
Joining two like devices on gear without auto-MDI-X takes a crossover cable, because it crosses the transmit pair on one end onto the receive pair at the other so each side hears the other. A straight-through cable wires both ends to the same standard and is used between unlike devices, such as a PC and a switch. A rollover cable reverses the entire pin order for console access, and a loopback returns a port's own signal for testing.
- A technician is documenting which transport protocol several applications use. Which application is most likely to rely on UDP rather than TCP?
- A live video stream where a lost frame passes unnoticed
- A bank transfer where a lost byte unbalances the ledger
- A software upgrade where a lost block corrupts the file
- A remote desktop where a lost keystroke blocks the user
Correct answer: A live video stream where a lost frame passes unnoticed
Live streaming is the classic UDP workload: the protocol sends datagrams without handshakes, acknowledgments or retransmission, so a dropped frame simply disappears and playback keeps its timing, which matters more than perfect delivery. Voice calls and DNS lookups use it for the same reason. A financial transfer, a software update and an interactive remote session all need every byte delivered in order, so they run over TCP, which acknowledges and retransmits whatever goes missing.
- A new technician asks what a subnet mask actually does. Which explanation is correct?
- It turns a written name into the address behind that name
- It divides an address into the network bits and host bits
- It trades a private address for one public address in use
- It transfers an address and a gateway into a fresh client
Correct answer: It divides an address into the network bits and host bits
A subnet mask marks the boundary inside an address: the bits covered by the mask identify the network and the remaining bits identify the host, so a station can tell whether a destination is local or has to be handed to the default gateway. With 255.255.255.0, for example, the first three octets are network and the last is host. Name resolution is DNS, address translation is NAT, and handing out settings is DHCP.
- A user plugs a new laptop into the wired network and it automatically receives an IP address, subnet mask, default gateway, and DNS server. Which service provided this configuration?
- ARP, which attaches an address to an adapter on the wires
- DNS, which resolves a name to the address a browser needs
- NAT, which swaps an address, a port and a checksum onward
- DHCP, which lends an address, a gateway and a name server
Correct answer: DHCP, which lends an address, a gateway and a name server
DHCP is the service that leases a client its address along with the subnet mask, default gateway and DNS servers, which is exactly the bundle of settings the laptop received when it was plugged in; it works over UDP with the server on port 67 and the client on port 68. ARP resolves an address to a hardware card on the local link, DNS answers name queries, and NAT rewrites headers on the way out; none of the three assigns a client its configuration.
- A user can reach a website by typing its IP address but not by typing its domain name. Which service is most likely failing?
- DHCP, since a client without a lease cannot take an address
- NAT, since a host without a mapping cannot share an address
- ARP, since a frame without an address cannot reach the card
- DNS, since a name without a record cannot locate an address
Correct answer: DNS, since a name without a record cannot locate an address
Reaching a site by its numeric address proves that routing, the gateway and the link itself are healthy, so the part that fails is name resolution: DNS, which answers on port 53, is what converts a typed domain into the address a browser can open. A DHCP failure would leave the workstation with no usable address at all, a NAT failure would break outbound traffic by address as well as by name, and ARP trouble would stop local delivery entirely.
- A home router lets many internal devices share a single public IP address provided by the ISP. Which technology performs this function?
- DHCP, which hands each host inside the local network a lease
- NAT, which maps each private host onto one public IP address
- QoS, which sorts each flow so voice outranks a bulk download
- DNS, which turns each name into the address a phone requires
Correct answer: NAT, which maps each private host onto one public IP address
Network Address Translation is what lets a whole house of private devices reach the internet through the single routable address the provider issued: the router rewrites the source address and port of each outbound packet and keeps a table so replies find their way back. DHCP only issues the private addresses inside, DNS resolves names to addresses, and QoS prioritises traffic; none of those three shares one public address among many hosts.
- A technician needs to separate the accounting department's traffic from general office traffic on the same physical switch without running new cable. Which technology accomplishes this?
- A VPN, which tunnels one laptop across the public internet
- A VLAN, which splits one switch into two broadcast domains
- A DMZ, which places one server outside the trusted network
- A proxy, which forwards one request for a whole department
Correct answer: A VLAN, which splits one switch into two broadcast domains
A VLAN answers this directly: it divides a single physical switch into separate logical networks, so accounting frames and general office frames sit in different broadcast domains and cannot see each other, with no new cable and no second switch. A VPN encrypts a remote connection, a DMZ is a semi-trusted segment for public-facing servers, and a proxy relays web requests; none of them partitions one switch into isolated segments.
- A technician is configuring firewall rules and needs to allow DNS queries through. Which port and protocol does DNS primarily use?
- UDP port 53, plus TCP port 53 for the zone transfers
- UDP port 69, plus TCP port 69 for those boot uploads
- UDP port 161, plus TCP port 162 for the trap notices
- UDP port 123, plus TCP port 123 for the clock checks
Correct answer: UDP port 53, plus TCP port 53 for the zone transfers
Name resolution runs on port 53, using UDP for ordinary queries because a single small datagram is faster, and falling back to TCP on the same port 53 for responses too large for a datagram and for zone transfers between servers. A firewall rule for DNS therefore opens 53. Port 69 is TFTP, ports 161 and 162 carry SNMP polling and traps, and port 123 is NTP time synchronisation.
- A technician is allowing legacy file transfers through a firewall and needs the control and data ports for FTP. Which ports does FTP use?
- Port 22 and port 23, one for shells and one for consoles
- Port 67 and port 68, one for offers and one for renewals
- Port 20 and port 21, one for payload and one for command
- Port 80 and port 443, one for pages and one for wrapping
Correct answer: Port 20 and port 21, one for payload and one for command
FTP uses a pair: port 21 carries the control channel where commands and replies travel, and port 20 carries the data channel in active mode, so a firewall passing legacy FTP has to allow both. Ports 22 and 23 are SSH and Telnet, ports 67 and 68 belong to DHCP, and ports 80 and 443 carry web traffic. Knowing the 20 and 21 pairing is also what separates plain FTP from SFTP, which rides on SSH.
- A technician is verifying that secure web traffic is permitted through a corporate firewall. Which port carries HTTPS?
- Port 80 and port 8080, where a plain website responds
- Port 110 and port 995, where a mailbox empties itself
- Port 443 and port 8443, where TLS guards each session
- Port 389 and port 636, where a directory answers back
Correct answer: Port 443 and port 8443, where TLS guards each session
Secure web traffic runs on port 443, where TLS wraps the HTTP session, so that is the port a corporate firewall must permit for HTTPS; 8443 is the common alternate for the same service. Port 80 carries unencrypted HTTP and 8080 is a frequent proxy or test alternative to it. Ports 110 and 995 are plain and encrypted POP3 mail retrieval, and ports 389 and 636 are plain and encrypted LDAP directory lookups.
- A technician needs to open the firewall so administrators can use Remote Desktop to a Windows server. Which port must be allowed?
- Port 445, the Layer 4 door where a Windows printer listens
- Port 3389, the Layer 4 door where a remote desktop listens
- Port 23, the Layer 4 door where the Telnet console listens
- Port 22, the Layer 4 door where an encrypted shell listens
Correct answer: Port 3389, the Layer 4 door where a remote desktop listens
Remote Desktop Protocol listens on TCP port 3389 by default, so that is the port a firewall must allow before administrators can open a graphical session on the server; ports are Layer 4 endpoints, which is why the rule is written against the transport port rather than an address. Port 445 carries SMB file sharing, port 23 is the unencrypted Telnet console, and port 22 is SSH, which offers a command line rather than a Windows desktop.
- A technician is comparing the 2.4 GHz and 5 GHz Wi-Fi bands to advise a client on placement. Which statement is accurate?
- 5 GHz slips through bricks better, 2.4 GHz moves much faster
- 2.4 GHz travels farther through walls, 5 GHz moves more data
- 2.4 GHz offers more unclogged channels than 5 GHz can supply
- 5 GHz and 2.4 GHz attain equal distances at identical speeds
Correct answer: 2.4 GHz travels farther through walls, 5 GHz moves more data
The lower 2.4 GHz band has longer wavelengths that bend around obstacles and pass through walls, so it covers more distance, but it is crowded and slower. The 5 GHz band carries far more data with less interference while losing range and struggling with solid walls, which is why placement matters. Penetration does not improve with frequency, 5 GHz has many more non-overlapping channels than 2.4 GHz, and the two bands do not behave identically.
- A technician is upgrading a client to Wi-Fi 6E and explaining what is new compared to standard Wi-Fi 6. Which statement correctly describes Wi-Fi 6E?
- Wi-Fi 6E abandons the 5 GHz band and retains 2.4 GHz alone
- Wi-Fi 6E is on the licensed cell bands and on nothing else
- Wi-Fi 6E predates the Wi-Fi 5 era by about one full decade
- Wi-Fi 6E introduces the 6 GHz band alongside 2.4 and 5 GHz
Correct answer: Wi-Fi 6E introduces the 6 GHz band alongside 2.4 and 5 GHz
The E in Wi-Fi 6E stands for extended, and what it extends is spectrum: a 6E device keeps the 2.4 GHz and 5 GHz bands of Wi-Fi 6 and adds the new 6 GHz band, roughly 5.925 to 7.125 GHz, which offers wide, uncongested channels. Nothing is removed. It is newer than Wi-Fi 5 rather than older, and it stays on unlicensed Wi-Fi spectrum rather than moving to licensed cellular bands.
- A technician is documenting 802.11 standards and their maximum theoretical throughput. Which pairing is correct?
- 802.11n operates on 5 GHz alone and saturates around 11 Mbps
- 802.11g operates on 5 GHz and peaks around 1.3 Gbps outright
- 802.11ac operates on 5 GHz while 802.11ax runs on both bands
- 802.11ax runs slower than an old 802.11g link on one channel
Correct answer: 802.11ac operates on 5 GHz while 802.11ax runs on both bands
Wi-Fi 5, standardised as 802.11ac, is a 5 GHz-only standard, while Wi-Fi 6, standardised as 802.11ax, works on both 2.4 GHz and 5 GHz and adds OFDMA and other efficiency gains. Wi-Fi 4, or 802.11n, was dual band and reached about 600 Mbps rather than 11 Mbps, which belongs to 802.11b. 802.11g was a 2.4 GHz standard capped near 54 Mbps, nowhere near 1.3 Gbps, and it is far slower than 802.11ax.
- A technician must allow the IMAP-over-TLS port and the SMTP port through a firewall for a mail client. Which port pairing is correct?
- IMAP via TLS on 993 and SMTP on 25 for shipped mail
- IMAP via TLS on 143 and SMTP on 21 for pushed notes
- IMAP via TLS on 995 and SMTP on 22 for posted texts
- IMAP via TLS on 636 and SMTP on 23 for hauled files
Correct answer: IMAP via TLS on 993 and SMTP on 25 for shipped mail
Encrypted IMAP listens on 993, and the A+ objectives list 25 as the SMTP port, so a client that retrieves securely and sends normally needs 993 and 25 opened. Plain IMAP is 143 and encrypted POP3 is 995, so neither of those is IMAP over TLS. Ports 21, 22 and 23 belong to FTP control, SSH and Telnet, and 636 is secure LDAP. In production, client submission usually moves to 587, but 25 is the value the exam tests.
- A technician is helping a user add a personal email account to a new smartphone. The user wants every device they own to see the same folders and read/unread status, and they do not want messages removed from the mail server when the phone syncs. Which incoming-mail configuration should the technician use?
- POP3 via TCP port 995, which downloads mail onto that machine
- IMAP via TCP port 993, which keeps folders in step everywhere
- SMTP via TCP port 587, which pushes a written message outward
- LDAP via TCP port 636, which resolves each user group request
Correct answer: IMAP via TCP port 993, which keeps folders in step everywhere
IMAP on TCP 993 is the encrypted incoming configuration that leaves the mailbox on the server and mirrors folder structure and read state to every client, which is exactly what the user asked for. Secure POP3 on 995 pulls messages down to a single machine and by default removes them from the server, so nothing stays in sync. SMTP on 587 sends mail rather than retrieving it, and LDAP on 636 is a directory service, not a mail protocol.
- A technician needs to explain the difference between a mobile hotspot and USB tethering to a user who wants to share their phone's cellular data connection with a laptop. Which statement most accurately describes the distinction?
- A hotspot broadcasts the link over Wi-Fi, tethering over a cable
- A hotspot shares the link by Bluetooth, tethering by quick Wi-Fi
- A hotspot functions on 5G alone, tethering functions on Wi-Fi 6E
- A hotspot requires the phone SIM, tethering needs a laptop modem
Correct answer: A hotspot broadcasts the link over Wi-Fi, tethering over a cable
A mobile hotspot turns the phone into a small access point, so the cellular link is shared over Wi-Fi and several devices can associate at once, while USB tethering shares that same cellular link through a physical cable to the one machine plugged in, which also charges the phone. Bluetooth tethering exists but is not what defines a hotspot. Neither feature is tied to a particular network generation, and both use the phone's own SIM and modem rather than the laptop's.
- A technician at a company is enrolling employee-owned smartphones so the organization can enforce passcode requirements, push approved apps, and remotely wipe corporate data if a device is lost. Which solution provides this centralized control?
- VPN, which cloaks traffic, hides routes and links two remote sites
- MDM, which delivers the policy, software and a remote handset wipe
- NFC, which authenticates a tap, a badge and a contactless purchase
- SSO, which relays one login, one token and many federated services
Correct answer: MDM, which delivers the policy, software and a remote handset wipe
Mobile device management is the platform that enrolls employee-owned handsets and then enforces passcode rules, deploys or removes approved applications, and performs a remote lock or selective wipe of company data, which is what a BYOD programme needs. A VPN only protects traffic in transit and cannot set device policy. NFC is a short-range radio for taps and payments. Single sign-on federates logins across services. None of those three manages the device itself.
- A technician is asked to explain the practical limit that prevents a Windows 11 workstation from using more than about 4 GB of RAM. Which characteristic of the installed operating system causes this ceiling?
- The Windows edition is 32-bit, so 4 GB is the address maximum
- The partition formats as FAT32, so it confines writes to 4 GB
- The firmware partitions with MBR, so it limits drives to 2 TB
- The memory runs in single channel, so it halves the read rate
Correct answer: The Windows edition is 32-bit, so 4 GB is the address maximum
A 32-bit edition of Windows can address only about 4 GB of memory no matter how many modules are fitted, because 32 address bits cannot describe more, and that is the ceiling described here; a 64-bit edition removes it, which is why current Windows ships as 64-bit only. The FAT32 4 GB limit applies to a single file, not to memory. The MBR 2 TB limit applies to disk size. Single-channel memory affects bandwidth, not the addressable total.
- A technician runs the command 'chmod 777 backup.sh' on a Linux server. What level of access does this grant?
- Read and execute for the owner, the group and other accounts
- Read and write for the owner, the group and other identities
- Full read, write and execute for owner, group and any others
- Full control for the owner, with read and execute for guests
Correct answer: Full read, write and execute for owner, group and any others
Each digit of a mode covers one identity, owner then group then others, and 7 is read (4) plus write (2) plus execute (1), so 777 grants complete read, write and execute rights to the owner, the group and every other user on the system. That is why it is treated as dangerous and reserved for narrow cases. Read plus execute for everyone would be 555, read plus write for everyone would be 666, and full control for the owner with read and execute elsewhere would be 755.
- A technician must keep all existing applications, user files, and settings while moving a workstation from Windows 10 to Windows 11. Which installation method meets this requirement?
- A clean install, which reformats the volume and deletes user files
- An in-place upgrade, which keeps the apps, files and user settings
- An imaged PXE deployment, which streams a build across the network
- A factory reset, which restores the shipped image and deletes apps
Correct answer: An in-place upgrade, which keeps the apps, files and user settings
An in-place upgrade lays Windows 11 over the existing Windows 10 installation and carries the installed applications, user files and most settings across, which is the only method here that satisfies the requirement. A clean install formats the target partition, so applications and settings are gone. A network deployment writes a prepared image over whatever was there. A recovery reset returns the machine to its factory state and removes installed applications.
- A new technician asks why a script that runs in PowerShell will not run identically when pasted into the legacy Command Prompt. What is the most accurate explanation of the difference between cmd and PowerShell?
- Command Prompt passes objects while PowerShell pipes simple text
- Command Prompt shipped after PowerShell and replaced it outright
- PowerShell runs on servers while Command Prompt handles desktops
- PowerShell pipes objects through cmdlets while cmd pipes strings
Correct answer: PowerShell pipes objects through cmdlets while cmd pipes strings
PowerShell is an object-oriented automation shell: its cmdlets emit structured objects that flow down the pipeline with their properties intact, so a later command can filter on a property by name. Command Prompt is the older interpreter, and everything it passes along the pipeline is plain text that must be parsed. That is why a PowerShell script does not behave the same way when pasted into cmd. The direction is not reversed, cmd did not replace PowerShell, and both shells run on desktop and server editions.
- A technician is choosing a file system for an internal Windows system drive that must support file-level permissions and encryption. Which difference between FAT32 and NTFS makes NTFS the correct choice?
- FAT32 offers quotas, shadow copies and compression, while NTFS offers none
- NTFS suits removable media, while FAT32 suits those internal system drives
- NTFS restricts individual files to 4 GB, while FAT32 remains unconstrained
- NTFS adds permissions, encryption and journals, while FAT32 adds none here
Correct answer: NTFS adds permissions, encryption and journals, while FAT32 adds none here
NTFS is the choice for a Windows system drive because it supports file and folder permissions, EFS encryption, compression, quotas and a journal that helps a volume recover from an interrupted write, while FAT32 offers none of that security or reliability. The feature list belongs to NTFS rather than FAT32. NTFS is the standard for internal drives, and it is FAT32, not NTFS, that cannot hold a file larger than 4 GB.
- A technician changed a Group Policy setting on the domain controller and needs a workstation to apply it immediately rather than waiting for the next refresh cycle. Which command should be run on the workstation?
- gpresult /r, which reports whichever policies already apply now
- ipconfig /flushdns, which clears the cached name lookup answers
- gpupdate /force, which reprocesses each domain policy right now
- net accounts, which displays the local password lifetime limits
Correct answer: gpupdate /force, which reprocesses each domain policy right now
gpupdate /force pulls policy again immediately and reprocesses every setting rather than only the ones that changed, so a workstation picks up the domain controller's new setting without waiting for the background refresh interval. gpresult reports what is already applied but changes nothing. ipconfig /flushdns clears the resolver cache. net accounts displays local password and lockout policy. None of those three requests fresh policy from the domain.
- A technician used to working on Linux types 'ifconfig' on a Windows 11 machine and gets an error. Which Windows command provides the equivalent display of IP address and network adapter configuration?
- ipconfig, which prints the address, the mask and the gateway used
- netstat, which prints the sockets, the ports and the process PIDs
- tracert, which prints each hop between here and one remote server
- nslookup, which prints the address a given name server hands back
Correct answer: ipconfig, which prints the address, the mask and the gateway used
ipconfig is the Windows equivalent of ifconfig: it reports the IP address, subnet mask and default gateway for each adapter, and ipconfig /all adds DHCP and DNS detail. Windows does not ship ifconfig at all, which is why the command errors out. netstat enumerates connections and listening ports, tracert traces the path to a remote host, and nslookup queries a name server, so none of them prints adapter configuration.
- A technician views a Linux file listing and sees the permission string 'rwxr-x---' on a directory. Who is allowed to read the contents of that directory?
- Everyone on the system, since the last block grants read
- The owner and the group, since either block permits read
- The root account itself, since no block permits any read
- The group and everyone else, since one block grants read
Correct answer: The owner and the group, since either block permits read
A permission string is read in three blocks of three: rwx for the owner, r-x for the group and --- for everyone else. The owner block carries r and the group block carries r, so both the owner and members of the group can list the directory, while other users hold no permissions at all and cannot read it. Root can override permissions, but that is an administrative privilege rather than something the string itself grants.
- A technician needs to reset a forgotten password for a local Windows account named jsmith from an elevated Command Prompt. Which command accomplishes this?
- net localgroup Users jsmith, which designates one member account
- whoami /user, which displays the currently signed-in account SID
- net user jsmith NewPass123, which rewrites that account password
- net accounts /minpwlen:8, which sets the minimum password length
Correct answer: net user jsmith NewPass123, which rewrites that account password
net user jsmith NewPass123 resets the password on the local account, because supplying a value after the account name is how net user changes a password from an elevated prompt. net localgroup manages membership of a local group rather than credentials. whoami /user reports the security identifier of whoever is signed in. net accounts sets policy such as minimum password length, which constrains future passwords but never changes an existing one.
- A technician needs to format a large external SSD that must move files larger than 4 GB between Windows and macOS without installing extra drivers. Which difference between NTFS and exFAT makes exFAT the better choice here?
- NTFS mounts read/write on a Mac while exFAT mounts as read only
- exFAT removes the 4 GB file cap and mounts read/write both ways
- exFAT stores the file rights that an NTFS volume would not keep
- NTFS constrains individual documents to 4 GB, and exFAT to 2 GB
Correct answer: exFAT removes the 4 GB file cap and mounts read/write both ways
exFAT suits a drive that has to move large files between the two platforms: it has no practical 4 GB file limit and both Windows and macOS mount it read/write with nothing extra installed. NTFS mounts read-only on macOS unless a third-party driver is added, so writing from the Mac would fail. exFAT carries no file-level permissions, and the 4 GB ceiling belongs to FAT32 rather than to NTFS or exFAT.
- A user reports that file operations on a Windows drive are failing and the system warns of file system errors. Which built-in command-line tool scans the disk for file system and bad-sector errors and can repair them?
- format, which reconstructs the file table and deletes past data
- robocopy, which mirrors a folder tree and retries failing files
- tasklist, which lists each running image and its owning process
- chkdsk, which checks the file table and repairs damaged sectors
Correct answer: chkdsk, which checks the file table and repairs damaged sectors
chkdsk is the built-in volume checker: chkdsk /f repairs file system errors and chkdsk /r additionally locates bad sectors and recovers whatever is still readable, which is what a volume reporting file system errors needs. format prepares a volume by discarding what is on it. robocopy is a copy tool with retry and mirroring switches. tasklist enumerates running processes. None of the three examines file system structures for damage.
- After a malware cleanup, a Windows 11 machine shows missing or corrupted system files. Which command checks the integrity of protected system files and restores correct versions?
- sfc /scannow, which revalidates safeguarded files and reinstates them
- dism /online /cleanup-image, which rebuilds the whole component store
- diskpart, which lists volumes and reorganises those partition entries
- defrag /c, which consolidates fragments across one attached partition
Correct answer: sfc /scannow, which revalidates safeguarded files and reinstates them
System File Checker, run as sfc /scannow, walks the protected operating system files, compares them against known-good cached copies and replaces anything missing or altered, which is what a machine shows after malware has been removed. DISM with /RestoreHealth repairs the component store that sfc draws its replacements from, so it is a related but separate and heavier repair. diskpart manages partitions and defrag rearranges file fragments; neither touches system file integrity.
- A technician explains to a colleague where Windows stores low-level configuration data for hardware, software, and user profiles in a centralized hierarchical database. What is this component called?
- The Event Viewer store, a rolling log of recent system alerts
- The Windows registry, a hive tree of keys and assorted values
- The Task Scheduler library, a list of jobs and their triggers
- The Group Policy cache, a local copy of downloaded user rules
Correct answer: The Windows registry, a hive tree of keys and assorted values
The registry is the central hierarchical database Windows keeps for operating system, hardware, application and per-user configuration, organised into hives, keys and typed values and edited with regedit. Event Viewer holds logged events rather than configuration. The Task Scheduler library stores scheduled jobs and the conditions that start them. The policy cache holds the settings a domain has pushed down. None of those three is the general configuration database.
- A small business wants the cheapest Windows 11 edition that can still join an Active Directory domain and use BitLocker. Which edition meets both requirements?
- Windows 11 Home, which attaches to workgroups but denies domain joins
- Windows 11 S mode, which runs Store-signed apps and blocks everything
- Windows 11 Home Single Language, which locks the one display language
- Windows 11 Pro, which enters the domain and also configures BitLocker
Correct answer: Windows 11 Pro, which enters the domain and also configures BitLocker
Windows 11 Pro is the cheapest edition that can both join an Active Directory domain and use BitLocker drive encryption, and it also brings Group Policy support and Remote Desktop hosting. Home cannot join a domain and has no BitLocker management, Home Single Language is a Home variant restricted to a single display language, and S mode restricts the machine to signed Store applications, so none of the three meets both requirements.
- A user is comparing Windows 10 and Windows 11 and asks what changed in the default hardware requirements. Which requirement does Windows 11 add that Windows 10 did not mandate?
- A TPM 2.0 module beside UEFI Secure Boot on the motherboard
- A 32-bit CPU option for the many older home desktop devices
- A 1 GB memory threshold alongside a 16 GB storage partition
- A FAT32 boot drive for the tiny hidden system recovery zone
Correct answer: A TPM 2.0 module beside UEFI Secure Boot on the motherboard
Windows 11 raised the floor by requiring a TPM 2.0 module and UEFI Secure Boot, neither of which Windows 10 strictly demanded, alongside a supported 64-bit processor. Windows 11 dropped 32-bit processors entirely rather than adding them as an option. The 1 GB memory floor and small disk requirement belong to the older Windows 10 minimums, and the Windows boot volume is formatted NTFS, so a FAT32 system volume is not a new requirement.
- A technician sets up a shared family laptop and wants a user to be able to run installed apps and change their own settings but not install software system-wide or modify other users' files. Which account type fits, and what is the key limitation versus an administrator account?
- A standard account, which opens apps but cannot install these system-wide
- An administrator account, which installs any new software for other users
- A guest account, which relinquishes its complete profile at each sign-out
- A service account, which handles a background process without any desktop
Correct answer: A standard account, which opens apps but cannot install these system-wide
A standard user account is the right fit: it can launch installed applications and change personal preferences, but any change that touches the whole machine, including installing software for everyone or editing another profile, is refused until an administrator's credentials are supplied. An administrator account carries exactly the privileges being withheld here. A guest account is far more restricted and keeps nothing between sessions. A service account exists to run background services rather than to seat a person at the machine.
- A technician needs to wipe a workstation and deploy a fresh, bloat-free copy of Windows 11 with a new registry and no carried-over applications. Which approach should be used and what is the main tradeoff compared with an upgrade?
- A repair install, which rewrites system files and keeps the apps
- A clean install, which reformats the volume and drops older apps
- A feature update, which rotates the build and keeps the profiles
- An in-place upgrade, which carries a profile and the apps onward
Correct answer: A clean install, which reformats the volume and drops older apps
A clean install is what produces a fresh Windows 11 with a new registry and none of the previous software: the target partition is formatted and the operating system is written from scratch, and the tradeoff is that every application has to be reinstalled and user data restored from backup. An in-place upgrade deliberately carries applications and settings forward. A repair install replaces damaged system files while preserving data, and a feature update swaps the build without reformatting anything.
- A technician must verify a Windows machine's exact build and version before applying a compatibility fix, using a quick command. Which command opens the About Windows dialog showing the version and build?
- systeminfo, which dumps the Windows patch and version listing
- msconfig, which displays the boot and startup settings screen
- winver, which reveals the About Windows version dialog window
- ver, which returns one abbreviated build string, nothing else
Correct answer: winver, which reveals the About Windows version dialog window
winver opens the About Windows box, which states the edition, the version and the full OS build number, so it is the quickest way to confirm what a compatibility fix is being applied to. systeminfo produces a long inventory of hardware, patches and configuration, far more than this check needs. The legacy ver command prints only a brief version string with no build detail. msconfig opens System Configuration for boot and startup options rather than a version dialog.
- A technician on Linux needs to display the IP address, subnet mask, and link state of network interfaces on a modern distribution where ifconfig is deprecated. Which command is the current recommended replacement?
- ip addr, the iproute2 tool that reports interface addresses
- ifconfig, the retired tool that older Linux builds included
- netstat -r, the portable tool that prints routing summaries
- ipconfig /all, the Windows tool that dumps adapter settings
Correct answer: ip addr, the iproute2 tool that reports interface addresses
ip addr, from the iproute2 suite, is the current way to show interface addresses, masks and link state on a modern distribution, and it is the command that replaced the older tool the technician is used to typing. That older tool is deprecated and is often absent from a fresh install. netstat -r prints routing information rather than interface configuration, and ipconfig is a Windows command that does not exist on Linux at all.
- A technician must list every active TCP/IP connection and the local listening ports on a Windows workstation to investigate a suspicious process. Which command provides this?
- arp -a, which maps the cached addresses onto hardware addresses
- netstat -ano, which maps live sockets to their owning processes
- tasklist /svc, which maps running images to the hosted services
- ipconfig /all, which maps each adapter onto its leased settings
Correct answer: netstat -ano, which maps live sockets to their owning processes
netstat -ano lists every active TCP/IP connection and every listening port, and the -o switch adds the owning process identifier, which is what ties a suspicious socket to the process behind it. arp -a shows the cached mapping of IP addresses to hardware addresses on the local link. tasklist /svc maps processes to the services they host but shows no sockets. ipconfig /all reports adapter configuration and lease detail rather than connections.
- A technician needs the macOS feature that lets the user run multiple separate desktops and view all open windows at a glance for organizing work. Which feature provides this?
- Time Machine, which stores hourly copies on an external backup drive
- Spotlight, which surfaces the files and apps within any open windows
- Mission Control, which shows the open windows and the extra desktops
- Keychain Access, which stores the saved passwords and the login keys
Correct answer: Mission Control, which shows the open windows and the extra desktops
Mission Control is the macOS feature that lays out every open window at once and lets the user build and switch between multiple desktops, called Spaces, which is exactly the organising tool described. Time Machine is the backup system and keeps versioned copies on a separate disk. Spotlight is the search interface. Keychain Access holds saved credentials and certificates. None of those three arranges windows or provides additional desktops.
- A technician must copy a large directory tree across the network and have the operation resume and mirror only changed files on later runs. Which Windows command-line tool is designed for this robust copying?
- xcopy, which duplicates a folder tree and skips the protected files
- copy, which shifts the single files between two named local folders
- robocopy, which restarts a tree transfer and mirrors the later runs
- compact, which compresses files on an NTFS volume without moving it
Correct answer: robocopy, which restarts a tree transfer and mirrors the later runs
robocopy, short for Robust File Copy, is built for exactly this: it can restart an interrupted transfer, retry on failures, and with /mir it mirrors a directory tree so later runs move only what changed. xcopy is the older tree copier and lacks the resume and mirroring behaviour. copy handles individual files. compact changes NTFS compression on data that is already in place and copies nothing across the network.
- A technician wants to confirm which Group Policy settings are actually being applied to the currently logged-on user and computer. Which command produces this resultant-set-of-policy report?
- gpresult /r, which enumerates whichever policy objects currently apply
- gpupdate /force, which reapplies each machine policy without reporting
- secedit /analyze, which contrasts a template against the installations
- net config workstation, which describes the machine service parameters
Correct answer: gpresult /r, which enumerates whichever policy objects currently apply
gpresult /r produces the Resultant Set of Policy summary, naming the Group Policy objects that are actually in effect for the signed-in user and for the computer, which is the report being asked for. gpupdate /force refreshes policy but produces no listing of what applied. secedit compares the machine against a security template. net config workstation reports workstation service parameters and knows nothing about Group Policy.
- A technician installs Linux on a desktop and must choose a journaling file system commonly used as the default on many distributions. Which file system fits that description?
- ext4, the journaling default that most Linux systems maintain
- NTFS, the journaling default that modern Windows volumes hold
- APFS, the copy-on-write default that newer Apple devices keep
- exFAT, the lightweight default that Linux and Windows support
Correct answer: ext4, the journaling default that most Linux systems maintain
ext4 is the journaling file system that ships as the default on a large share of Linux distributions, keeping a journal so an interrupted write can be replayed rather than leaving the volume inconsistent, and it handles large files and volumes comfortably. NTFS is the Windows journaling default rather than a Linux one. APFS is Apple's copy-on-write file system for macOS and iOS. exFAT is a lightweight cross-platform format with no journal.
- A technician is documenting macOS data management tools and needs the feature that installs, updates, and removes applications from a curated Apple storefront. Which feature is this?
- Disk Utility, which formats volumes and repairs a damaged disk
- Finder, which browses the folders and moves files between them
- App Store, which fetches and refreshes the vetted Apple titles
- Terminal, which opens a shell for typed commands and scripting
Correct answer: App Store, which fetches and refreshes the vetted Apple titles
The App Store is the curated storefront on macOS where applications are installed, updated and removed under Apple's review, which is the data-management tool being described. Disk Utility works on volumes, partitions and disk repair. Finder is the file browser used to move and organise documents. Terminal provides command-line access to the system. None of those three distributes applications from a catalogue.
- A technician wants to verify whether a workstation's CPU and Windows are running in 64-bit mode and which drivers must be installed. Which statement about 32-bit versus 64-bit support is correct?
- A 64-bit Windows needs 64-bit drivers and happily runs 32-bit tools
- A 32-bit Windows executes 64-bit tools once the kernel patches load
- A 64-bit Windows loads 32-bit drivers for the older legacy hardware
- A 64-bit driver and a 32-bit driver exchange freely between systems
Correct answer: A 64-bit Windows needs 64-bit drivers and happily runs 32-bit tools
A 64-bit Windows installation requires 64-bit kernel-mode drivers for its hardware, yet it still runs most 32-bit applications through the WoW64 compatibility layer, so applications and drivers are treated very differently. A 32-bit Windows cannot run 64-bit applications at all, because the processor is not executing in 64-bit long mode under that kernel. Drivers are never interchangeable between the two architectures, and a 64-bit kernel refuses to load a 32-bit driver.
- A technician needs to test name resolution by querying a DNS server directly from a Windows command prompt to confirm a hostname resolves to the correct IP. Which command is appropriate?
- nslookup, which forwards a manual query to a name server immediately
- ping -t, which transmits echo requests until the operator cancels it
- arp -a, which displays the remembered hardware addresses on one link
- hostname, which prints just the local computer name and nothing more
Correct answer: nslookup, which forwards a manual query to a name server immediately
nslookup sends a query straight to a name server and shows the record that comes back, so it confirms whether a hostname resolves to the address it should and which server answered. ping with -t repeats echo requests indefinitely and reports reachability rather than the DNS answer. arp -a lists the local address-to-hardware cache. hostname simply reports the local machine's name and queries nothing.
- A technician must securely manage a large boot drive over 2 TB with more than four primary partitions and integrity-checked partition tables. Which partitioning scheme provides these capabilities, and how does it differ from MBR?
- MBR, which retains a reserve table and eliminates that size cap
- GPT, which stops at just four primary partitions like MBR would
- GPT, which exceeds 2 TB and keeps its checksummed backup tables
- MBR, which the UEFI machines need before they can start booting
Correct answer: GPT, which exceeds 2 TB and keeps its checksummed backup tables
GPT is the scheme that suits this drive: it addresses capacity well beyond 2 TB, supports far more than four partitions, and stores a duplicate partition table with CRC values so damage can be detected and repaired. MBR is the older scheme, limited to 2 TB and four primary partitions, and it keeps no redundant copy. UEFI firmware normally boots from GPT rather than requiring MBR, so the remaining statements are false.
- A technician needs the Linux command that lists files in a directory, including hidden files and detailed permission, owner, and size information. Which command and option set does this?
- pwd, which prints only the working directory path and nothing else
- ls -la, which reveals the hidden files with owners and permissions
- grep -r, which searches a hierarchy for a pattern within documents
- cat -n, which streams a document with numbered lines throughout it
Correct answer: ls -la, which reveals the hidden files with owners and permissions
ls -la combines the long listing switch, which shows permissions, owner, group, size and timestamp, with the all switch, which includes the dot files that are hidden by default, so one command answers the whole request. pwd prints only the current path. grep -r searches file contents recursively for a pattern. cat -n prints a file's contents with numbered lines. None of those three lists a directory in detail.
- A technician must add a domain user to the local Administrators group on a single Windows workstation from the command line. Which command does this?
- net user DOMAIN\user /add /domain, which establishes that fresh account
- net accounts /domain /minpwage:5, which defines one local password rule
- whoami /groups /fo table, which displays the existing membership tokens
- net localgroup Administrators DOMAIN\user /add, which adds a new member
Correct answer: net localgroup Administrators DOMAIN\user /add, which adds a new member
net localgroup Administrators DOMAIN\user /add is the command that puts a domain user into the local Administrators group on that one workstation, because net localgroup manages the membership of local groups. net user with /add creates or edits an account rather than granting it group membership. net accounts sets password policy such as a minimum age of 5 days. whoami /groups only reports the groups already in the current token.
- A technician explains to a help-desk trainee why elevating to administrator is required to install most desktop software in Windows 11. What underlying security mechanism prompts for elevation when a standard user attempts a system change?
- BitLocker, which encrypts volumes with one TPM-protected recovery key
- User Account Control, which seeks approval before system-wide changes
- Windows Defender Firewall, which filters inbound and outgoing traffic
- Storage Sense, which eliminates accumulated files when space tightens
Correct answer: User Account Control, which seeks approval before system-wide changes
User Account Control is the mechanism behind the elevation prompt: when a process asks for a change that affects the whole machine, such as installing software into Program Files, UAC stops and demands administrator consent or credentials before the token is elevated. BitLocker encrypts volumes and never gates installation. The firewall filters network traffic. Storage Sense reclaims disk space automatically. None of those three governs the elevation prompt.
- A technician must edit a specific Windows configuration value because no graphical setting exposes it. Which built-in tool directly opens the configuration database for editing keys and values?
- regedit, which unfolds the hive trees for handwritten value edits
- msconfig, which unfolds the boot tab and those startup selections
- services.msc, which opens the long list of the installed services
- cmd, which offers a plain text interpreter for typed instructions
Correct answer: regedit, which unfolds the hive trees for handwritten value edits
regedit opens the Registry Editor, which shows the hives as a tree and allows a specific key or value to be created or changed by hand, which is the only route when no graphical setting exposes it. msconfig manages boot and startup configuration. services.msc controls the state and startup type of installed services. cmd is a command interpreter. None of those three edits registry values directly.
- A technician needs the macOS command-line utility to install command-line developer tools and run shell scripts in a Unix-like environment. Which application provides this interface?
- Spotlight, the macOS search tool
- Automator, the macOS task runner
- Terminal, the macOS text console
- Finder, the macOS folder browser
Correct answer: Terminal, the macOS text console
Terminal is the macOS application that opens a Unix shell prompt, so a technician can trigger the command-line developer tools installer and run shell scripts from it. Automator chains prebuilt workflow actions on a graphical canvas rather than presenting a prompt, Spotlight only indexes and searches content, and Finder is the graphical browser for folders and volumes.
- A technician wants to know why a Windows 11 Pro for Workstations machine can address far more RAM and CPUs than Windows 11 Home. Which statement about edition differences is correct?
- Home edition packs the ReFS format and the BitLocker toolset
- Workstations lifts the memory limit and the CPU socket count
- Home edition supports the Hyper-V role and the domain logons
- Workstations drops the Group Policy tools and the RDP server
Correct answer: Workstations lifts the memory limit and the CPU socket count
Windows 11 Pro for Workstations is the edition built for high-end hardware: it raises the physical memory ceiling to 6 TB and supports up to 4 CPU sockets, against 128 GB and a single socket on Home. Home does not include BitLocker or the Hyper-V role and cannot join a domain, and ReFS is a Workstations feature rather than a Home one. Workstations also keeps the Group Policy tooling and the Remote Desktop host role instead of dropping them.
- A technician compares Windows 10 and Windows 11 interface and support differences for a fleet refresh. Which statement is accurate as of 2026?
- Windows 11 dropped support for the 64-bit processor lines
- Windows 10 exclusively needed the TPM firmware since 2015
- Windows 11 confines the taskbar to the bottom-left corner
- Windows 10 reached its maintenance cutoff in October 2025
Correct answer: Windows 10 reached its maintenance cutoff in October 2025
Windows 10 reached the end of its support lifecycle on October 14, 2025, which is the practical reason fleets are being moved to Windows 11. A TPM 2.0 module is a Windows 11 requirement rather than a Windows 10 one, Windows 11 centers the Start menu and taskbar by default instead of anchoring them in a corner, and Windows 11 ships only as a 64-bit operating system, so it never dropped 64-bit support.
- A security analyst defines a DDoS attack for new help-desk staff. Which statement best describes a distributed denial-of-service attack?
- Many hijacked hosts flood one target until the service stops
- A hidden relay alters the traffic sent between two endpoints
- A single program copies itself onto other hosts without help
- An attacker tries each character string against a user login
Correct answer: Many hijacked hosts flood one target until the service stops
A distributed denial-of-service attack uses a large number of compromised machines, usually a botnet, to send more traffic than the target can absorb, so legitimate users can no longer reach the service. Silently relaying and altering traffic between two parties is an on-path attack, copying itself to other hosts with no user involvement describes a worm, and working through character strings against a login is brute-force credential guessing.
- A technician is comparing two password-cracking techniques. Which statement correctly distinguishes a dictionary attack from a brute-force attack?
- Dictionary runs reuse a stolen account pair; brute force sprays one login
- Dictionary runs check a curated word list; brute force walks the keyspace
- Dictionary runs need the password salts; brute force needs the hash types
- Dictionary runs build a rainbow table; brute force replays a live session
Correct answer: Dictionary runs check a curated word list; brute force walks the keyspace
A dictionary attack works from a precompiled list of likely words and previously leaked passwords, while a brute-force attack mechanically works through the entire keyspace one combination at a time. Reusing stolen credential pairs is credential stuffing and trying a single password against many accounts is password spraying, so neither defines these two techniques. Salts and hash types affect how fast cracking runs but do not separate the two, and precomputed tables and session replay are different attacks entirely.
- A network administrator must explain the security difference between WPA2 and WPA3 to management. Which improvement does WPA3-Personal provide over WPA2-Personal?
- It adds the WPS enrollment button that shortens printer pairing
- It adds the TKIP cipher that reinstates obsolete client roaming
- It adds the RADIUS server that handles Personal mode accounting
- It adds the SAE handshake that blocks offline password guessing
Correct answer: It adds the SAE handshake that blocks offline password guessing
WPA3-Personal replaces the WPA2 pre-shared key exchange with Simultaneous Authentication of Equals, so a handshake captured off the air cannot be fed into an offline password-guessing tool. WPA3 does not introduce WPS, it drops the deprecated TKIP cipher rather than reviving it, and a RADIUS server belongs to WPA3-Enterprise rather than Personal mode.
- A technician needs to share a folder on an NTFS volume and is unsure how share permissions and NTFS permissions interact. Which statement is correct?
- Effective access equals the total of both permission lists added together
- Effective access equals the share permission alone at each keyboard logon
- Effective access equals the stricter of the two combined permission rules
- Effective access equals the NTFS permission alone for each remote session
Correct answer: Effective access equals the stricter of the two combined permission rules
For a connection made over the network Windows evaluates the share permissions and the NTFS permissions separately and then grants whichever result is tighter, so the more restrictive of the two decides what the user can do. The two sets are never added together, share permissions have no effect on someone signed in at the keyboard, and NTFS permissions continue to apply to network access instead of being bypassed.
- A security awareness trainer is explaining the difference between phishing and spear phishing. Which statement is accurate?
- Phishing mails a generic mass lure; spear phishing tailors one message
- Phishing dials a phone number; spear phishing plants a printed barcode
- Phishing sends a text message; spear phishing hits an executive target
- Phishing hijacks one live session; spear phishing poisons a DNS record
Correct answer: Phishing mails a generic mass lure; spear phishing tailors one message
Phishing is the untargeted form: one generic lure sent to a very large list in the hope that a small fraction respond. Spear phishing aims the same technique at a chosen person and uses details about their role, employer, or contacts to make the message credible. Voice calls are vishing, text messages are smishing, a malicious printed QR code is quishing, going after a senior executive is whaling, and session hijacking and DNS poisoning are technical attacks rather than either form of phishing.
- An organization grants each employee only the access rights needed for their job and nothing more. Which security concept does this practice define?
- Least privilege
- Implicit denial
- Role separation
- Access auditing
Correct answer: Least privilege
The principle of least privilege gives an account exactly the rights its job requires and nothing beyond that, which limits how much damage a compromised or misused account can do. Implicit denial blocks anything no rule has expressly permitted, role separation splits a sensitive task between two people so neither controls it end to end, and access auditing reviews who used what after the fact rather than deciding the rights in advance.
- A technician is explaining symmetric versus asymmetric encryption. Which statement correctly describes the key difference?
- Symmetric generates a message digest; asymmetric generates a random salt
- Symmetric requires one shared secret; asymmetric requires a matched pair
- Symmetric issues a signed certificate; asymmetric issues an access token
- Symmetric exchanges a session nonce; asymmetric exchanges a login cookie
Correct answer: Symmetric requires one shared secret; asymmetric requires a matched pair
Symmetric encryption uses one shared secret for both encryption and decryption, so every party must already hold the same key. Asymmetric encryption instead uses a mathematically linked public and private key pair, which solves the key-distribution problem at the cost of speed, and that is why bulk data is normally protected symmetrically. Digests, salts, certificates, access tokens, nonces, and cookies are all real constructs, but none of them states the difference between the two cipher families.
- A facilities security briefing distinguishes tailgating from piggybacking. Which statement is correct?
- Tailgating demands a cloned keycard; piggybacking demands a fake badge
- Tailgating happens at a turnstile; piggybacking happens at a stairwell
- Tailgating uses a shoulder surf; piggybacking uses a rehearsed pretext
- Tailgating enters a door unseen; piggybacking enters with willing help
Correct answer: Tailgating enters a door unseen; piggybacking enters with willing help
In tailgating the intruder follows an authorized person through a controlled door without that person knowing or agreeing to it. In piggybacking the authorized person is aware and cooperates, typically by holding the door open for the second person. Neither attack depends on a cloned badge or a fake ID, neither is tied to one kind of door hardware, and shoulder surfing and pretexting are separate social-engineering techniques.
- A technician documents malware categories for a training guide. Which choice correctly pairs a malware type with its defining behavior?
- Adware locks the stored data folders until a payment arrives
- Rootkits flood a target host with traffic from many machines
- Spyware reports the online activity data to an outside party
- Keyloggers rewrite the master record so the disk cannot load
Correct answer: Spyware reports the online activity data to an outside party
Spyware installs quietly and reports what the user does, such as sites visited and text entered, back to a third party. Locking files until a payment arrives is ransomware rather than adware, flooding a host with traffic from many machines is a botnet-driven denial-of-service rather than anything a rootkit defines, and overwriting the boot record is the work of a boot sector virus rather than a keylogger.
- A technician is teaching the difference between a virus, a worm, and a trojan. Which statement is accurate?
- A worm hides in a trusted tool; a virus scans the network
- A worm waits for a trigger date; a virus needs one reboot
- A worm copies itself over a network; a virus rides a file
- A worm locks the user files; a virus stops the local scan
Correct answer: A worm copies itself over a network; a virus rides a file
A worm is self-replicating: it copies itself to other hosts over the network with no user action at all. A virus is not self-contained, so it attaches to a host file and spreads only when that file is run or shared. Hiding inside a useful-looking program is what a trojan does, waiting for a trigger condition is a logic bomb, and encrypting files to force a payment is ransomware.
- A user's antivirus cannot detect a stealthy infection that loads before the operating system and hides its own processes. Which type of malware is most likely present?
- Adware, a rampant threat
- Rootkit, a common threat
- Trojan, a serious threat
- Spyware, a modern threat
Correct answer: Rootkit, a common threat
A rootkit gains privileged access and then hides itself, frequently loading at boot or inside the kernel, so its files, processes, and registry keys stay invisible to a normal antivirus scan. Adware generates unwanted advertisements, a trojan disguises itself as legitimate software to get installed, and spyware gathers and reports user data, but none of the three is built to load ahead of the operating system and conceal its own processes.
- A technician wants to encrypt an entire Windows 11 system drive so data is protected if the laptop is stolen. Which built-in feature should be used?
- Defender, a bundled tool
- SmartScreen, a free tool
- AppLocker, a policy tool
- BitLocker, a native tool
Correct answer: BitLocker, a native tool
BitLocker is the full-volume encryption feature built into Windows; it encrypts the entire system drive and normally seals the keys in the TPM, so a stolen laptop, or a drive pulled out of one, yields nothing readable. Microsoft Defender scans for malware, SmartScreen warns about unrecognized downloads and sites, and AppLocker limits which applications are allowed to run, and none of the three encrypts a volume.
- A company requires users to provide a password plus a fingerprint before accessing email. Which security control does this requirement define?
- Multifactor authentication
- Certificate authentication
- Interactive authentication
- Centralized authentication
Correct answer: Multifactor authentication
Multifactor authentication demands evidence from two or more different factor categories, and a password (something you know) plus a fingerprint (something you are) is exactly that, so a stolen password by itself is not enough to get in. Certificate authentication is a single factor based on something you have, interactive authentication simply means the person signs in at the console, and centralized authentication describes where credentials are checked rather than how many kinds of proof are demanded.
- An employee receives an email that appears to be from the IT department asking them to click a link and confirm their login credentials. Which type of attack is this?
- Pharming
- Phishing
- Spoofing
- Smishing
Correct answer: Phishing
Phishing is fraudulent email that impersonates a trusted sender, here the IT department, to push the recipient into clicking a link and handing over credentials. Smishing runs the same lure over SMS text rather than email, pharming redirects a correct address to a counterfeit site by corrupting name resolution, and spoofing means faking a source address or identity rather than the credential-harvesting message itself.
- A user can no longer open their documents, and a message demands payment in cryptocurrency to restore access. Which malware best matches this behavior?
- Ransomware, a current family
- Scareware, a familiar family
- Adware, a commonplace family
- Rootkit, a persistent family
Correct answer: Ransomware, a current family
Ransomware encrypts or locks the victim's files and then demands a payment, usually in cryptocurrency, in exchange for the decryption key, which matches both the inaccessible documents and the payment demand. Scareware only displays alarming fake alerts, adware pushes unwanted advertising, and a rootkit hides itself behind privileged access, so none of them holds documents hostage.
- An attacker calls an employee pretending to be a vendor and persuades them to reveal a password. Which broad category of attack does this represent?
- Protocol tampering
- Response splitting
- Directory browsing
- Social engineering
Correct answer: Social engineering
Social engineering is the broad category for attacks that work on a person rather than on a machine, and impersonating a vendor over the phone to talk someone out of a password is a textbook example. Protocol tampering, response splitting, and directory browsing are technical attacks aimed at systems and web servers, and none of them involves deceiving a human being.
- When a standard user attempts to install software in Windows 11, a dialog dims the screen and asks for administrator approval. Which feature produces this prompt?
- Windows Defender App
- Event Viewer Console
- User Account Control
- Registry Editor Tool
Correct answer: User Account Control
User Account Control produces the consent or credential prompt on the dimmed secure desktop whenever an action needs administrative rights, which is exactly what a standard user meets when installing software. The Windows Defender app reports protection status, Event Viewer displays logs after the fact, and the registry editor changes configuration values directly, so none of them raises the elevation prompt.
- A technician is comparing wireless protocols and wants the strongest available option for a new business network. Why is WPA3 preferred over WPA2?
- WPA3 reinstates the TKIP cipher and cancels the AES requirement
- WPA3 hardens the key exchange and adds stronger data encryption
- WPA3 discards the 5 GHz channels and rejects wireless repeaters
- WPA3 replaces the RADIUS service and blocks the 802.1X standard
Correct answer: WPA3 hardens the key exchange and adds stronger data encryption
WPA3 is preferred because it hardens the key exchange with Simultaneous Authentication of Equals and applies stronger data encryption, so a handshake captured off the air cannot be attacked offline the way a WPA2 pre-shared key handshake can. WPA3 does not bring back TKIP or cancel AES, it runs on the same 2.4 GHz and 5 GHz channels WPA2 used rather than abandoning a band, and RADIUS with 802.1X is still exactly how WPA3-Enterprise authenticates users.
- A vendor discloses that attackers are exploiting a flaw for which no patch yet exists. Which term defines this situation?
- Birthday attack
- Rollback attack
- Deepfake attack
- Zero-day attack
Correct answer: Zero-day attack
A zero-day attack exploits a vulnerability for which the vendor has not yet released a patch, which is precisely the situation described. A birthday attack targets hash collisions, a deepfake attack uses synthesized audio or video to impersonate a person, and a rollback attack forces software down to an older and weaker version, and none of those is defined by the absence of a fix.
- A small business wants to verify the identity of users connecting to its wireless network against a central server using usernames and certificates rather than a single shared passphrase. Which configuration should the technician choose?
- WPA3-Enterprise with RADIUS credentials
- WPA2-Personal with rotating passphrases
- MAC-Filtering with authorized addresses
- Open-System with unencrypted broadcasts
Correct answer: WPA3-Enterprise with RADIUS credentials
WPA3-Enterprise uses 802.1X with a RADIUS server, so each user authenticates individually with their own account or certificate against a central directory instead of sharing one network key. WPA2-Personal still hands the same passphrase to everyone, MAC filtering checks hardware addresses that are trivially forged and proves nothing about who the user is, and an open system verifies nobody at all.
- A technician is hardening a shared Windows 11 workstation. Which action best follows the principle of least privilege for daily users?
- Turn on BitLocker for the whole system volume
- Enforce a screen lock after five idle minutes
- Operate each daily account as a standard user
- Force a complex password on each user account
Correct answer: Operate each daily account as a standard user
Least privilege means a person works with the smallest set of rights the job needs, so a daily account should be a standard user and any elevation should require a separate administrator credential. Full-disk encryption, screen-lock timeouts, and password complexity are all genuine hardening measures, but none of them changes what rights the signed-in account already holds.
- A security model assumes no device or user is automatically trusted, even inside the corporate network, and verifies every access request. Which model is described?
- Zero-trust access
- Perimeter defense
- Transitive trusts
- Implicit approval
Correct answer: Zero-trust access
A zero-trust model assumes that no user, device, or network location is trustworthy by default and re-verifies every request on its own merits, summed up as never trust, always verify. Perimeter defense does the opposite by trusting whatever is already inside the firewall, transitive trusts extend trust automatically from one domain to another, and implicit approval permits anything no rule has forbidden.
- A technician needs to permanently destroy data on failed solid-state drives before disposal, but degaussing is ineffective on them. Which method reliably renders the data unrecoverable?
- Degaussing the failed magnetic platters
- Quick-formatting the failed data volume
- Defragmenting the failed storage device
- Pulverizing the failed hardware modules
Correct answer: Pulverizing the failed hardware modules
Solid-state drives keep data in flash cells, so a magnetic field does nothing to them, and a drive that has already failed cannot be overwritten or securely erased through its own controller. Destroying the device physically, by shredding or pulverizing the boards and the flash packages, is what reliably ends the data. Degaussing only works on magnetic media, and formatting or defragmenting both need a working drive and would still leave flash contents recoverable.
- An administrator wants employees to log in once and then access multiple internal applications without re-entering credentials. Which solution provides this?
- Password vault
- Ticket caching
- Single sign-on
- Kerberos realm
Correct answer: Single sign-on
Single sign-on lets a user authenticate once and then reach every connected application for the rest of the session without entering credentials again, which is what the administrator asked for. A password vault still fills in a separate login for each application, ticket caching is one mechanism inside a Kerberos exchange rather than the service being described, and a Kerberos realm is just the administrative boundary those tickets are issued within.
- A technician configures a smartphone fleet so devices lock after several failed passcode attempts and can be located or erased remotely through a central console. Which technology provides this central management?
- Virtual private networks
- Mobile device management
- Endpoint firewall policy
- Secure sockets tunneling
Correct answer: Mobile device management
Mobile device management is the platform that pushes and enforces security policy across a whole fleet of phones and tablets from one console, including passcode rules, failed-attempt lockout, remote locate, and remote wipe. A virtual private network only protects traffic in transit, an endpoint firewall policy filters connections on a single host, and secure sockets tunneling is a VPN protocol, so none of them manages devices centrally.
- A technician must decommission a hard drive but the company plans to reuse it internally rather than destroy it. Which method sanitizes the drive while keeping it usable?
- A full format that overwrites the whole volume
- A quick format that recreates the file catalog
- A partition delete that clears the drive table
- A defrag cycle that reorders the stored blocks
Correct answer: A full format that overwrites the whole volume
A full format writes across the whole volume instead of only rebuilding the file table, so the earlier contents are gone while the disk itself stays healthy and can be redeployed inside the company. A quick format only recreates the file catalog and leaves the old data in place, deleting a partition just clears its entry in the partition table, and defragmenting simply rearranges data that is still present.
- A technician notices that a user's browser keeps redirecting to advertising pages and displaying frequent pop-up ads. Which malware type is the most likely cause?
- Botnet clients
- Spyware agents
- Boot infectors
- Adware bundles
Correct answer: Adware bundles
Adware is malware whose whole payload is advertising: it injects pop-ups and pushes the browser to sponsored pages, which is exactly the behaviour being reported. Botnet clients sit quietly waiting for instructions from a controller, spyware agents collect and report data without displaying anything, and boot infectors attack the startup process, so none of them generates a stream of advertisements.
- A technician wants to confirm that downloaded software has not been altered before installation. Which security mechanism allows the user to verify the file's integrity?
- Checking the download page for a trusted certificate
- Matching the file extension against the program type
- Comparing the published hash against the stored file
- Reading the vendor changelog for the version history
Correct answer: Comparing the published hash against the stored file
A cryptographic hash such as SHA-256 changes completely if even one byte of a file changes, so recomputing the hash of the downloaded copy and holding it against the value the vendor publishes proves the file was not altered. A valid site certificate says something about the server rather than the file, the extension is only part of a name, and a changelog describes what the release contains rather than whether this copy is intact.
- An attacker leaves USB flash drives labeled "Payroll" in a company parking lot hoping employees will plug them in. Which social-engineering technique is this?
- Whaling attacks
- Baiting attacks
- Vishing attacks
- Cloning attacks
Correct answer: Baiting attacks
Baiting leaves something tempting where a victim will find it, here USB drives labelled to look valuable, and relies on curiosity to get the malicious media plugged in. Whaling is spear phishing aimed at a senior executive, vishing is a fraudulent phone call, and cloning duplicates a badge or card, so none of them describes planting attractive media.
- A technician must grant a contractor temporary elevated access to a server only for the duration of a specific maintenance task, after which the access is automatically revoked. Which logical security approach fits this requirement?
- Permanent elevation
- Certificate pinning
- Just-in-time access
- Credential vaulting
Correct answer: Just-in-time access
Just-in-time access grants the elevated rights only for the window in which the work actually happens and withdraws them automatically afterwards, so the contractor never holds standing power over the server. Permanent elevation is the opposite arrangement, credential vaulting stores and rotates secrets without time-boxing the privilege itself, and certificate pinning is a transport-security control unrelated to elevation.
- A small office relies on its router's firewall, antivirus on each PC, strong passwords, and locked server-room doors. Which security strategy does this combination represent?
- Trust by default
- Access on demand
- Patch on release
- Defense in depth
Correct answer: Defense in depth
Defense in depth layers independent controls, in this case network, host, authentication, and physical, so that a failure in any single one of them still leaves the asset protected. Trust by default is the opposite posture, access on demand describes handing out rights only for the moment they are needed, and patch on release is an update cadence, so none of the three describes stacked protection.
- A user reports a browser pop-up warning that a banking website's certificate has expired. What does an expired certificate primarily indicate?
- That the certificate validity period has already ended
- That the certificate private key was recently replaced
- That the certificate signing method has been shortened
- That the certificate hostname does not match correctly
Correct answer: That the certificate validity period has already ended
A certificate carries a fixed validity window, and once the end of that window has passed the browser can no longer treat it as current, so it cannot confirm the site's identity is still vouched for. It does not mean the private key was replaced, that the signing method was shortened, or that the name on the certificate stopped matching the site, and each of those conditions produces its own separate warning.
- A technician wants to ensure users create passwords that resist guessing and reuse. Which Windows setting best enforces this organization-wide?
- A screen lock policy that dims and terminates unused sessions
- A password policy that mandates length variety and reuse caps
- A restriction policy that blocks new apps and unsigned macros
- An audit policy that registers each console logon and refusal
Correct answer: A password policy that mandates length variety and reuse caps
A password policy applied through Group Policy or local security policy is what forces strong, non-recycled passwords across an organisation: a minimum length, a complexity requirement, and a history depth that refuses an old password. A screen-lock policy protects an unattended desk, a restriction policy controls which programs may run, and an audit policy only records what happened, so none of them governs how a password is chosen.
- A technician wants endpoints to detect suspicious behavior, contain threats, and feed alerts to a central console for investigation, going beyond signature-based antivirus. Which solution provides these capabilities?
- Backup and disaster restoration
- Endpoint detection and response
- Governance and change reporting
- Identity and account management
Correct answer: Endpoint detection and response
Endpoint detection and response continuously watches process behaviour on each endpoint, can isolate or kill a suspicious process on the spot, and streams telemetry to a central console for hunting and investigation, which is precisely the capability set described. Backup and disaster restoration returns data after an incident, governance and change reporting is an audit function, and identity and account management decides who may sign in.
- A controlled entry area requires a person to pass through two interlocking doors, where the second door will not open until the first has closed, preventing tailgating. Which physical security control is this?
- Infrared motion detector
- Concrete traffic bollard
- Contactless badge reader
- Access control vestibule
Correct answer: Access control vestibule
An access control vestibule, also called a mantrap, uses two interlocking doors where the inner door will not release until the outer one has closed, so a single authorised person passes at a time and tailgating is physically prevented. A bollard stops vehicles, an infrared motion detector notices movement but blocks nobody, and a contactless badge reader authenticates a credential at one door that a second person can still slip through behind the first.
- According to CompTIA's ten-step best practice procedure for malware removal, which step immediately follows verifying and investigating the malware symptoms?
- Quarantine the infected systems from the network
- Educate the end user about suspicious extensions
- Disable System Restore before the cleanup begins
- Schedule recurring scans and run pending updates
Correct answer: Quarantine the infected systems from the network
Quarantining the infected system is what comes immediately after the symptoms have been investigated and verified. Isolating the machine from the network and from shared storage stops the malware spreading or sending data out while the rest of the work is carried out. Disabling System Restore comes after quarantine, scheduling scans and running updates sits near the end of the procedure, and educating the end user is the final step.
- A technician is following CompTIA's malware removal best practices on a Windows 11 PC. Why must System Restore be disabled before the system is remediated?
- Restore points lock the registry hives during any rescan
- Restore points reserve the disk space which updates need
- Restore points hold old malware copies that return later
- Restore points keep the antivirus engine from any launch
Correct answer: Restore points hold old malware copies that return later
A restore point is a snapshot of system state, so if malware was present when one was captured the malicious files ride along inside it and a later rollback can bring the infection straight back. That is why the procedure has the technician switch System Restore off before remediation, which purges the existing points, and switch it back on with a fresh clean point afterwards. Restore points do not lock the registry, reserve space for updates, or stop an antivirus engine from running.
- What is System Restore in Windows 11 designed to do?
- Reinstall Windows and keep the apps that are still loaded
- Copy the user documents onto a second computer each night
- Return system files and registry keys to an earlier state
- Reset the whole device to factory state and erase folders
Correct answer: Return system files and registry keys to an earlier state
System Restore rolls system files, installed drivers, and registry settings back to a previously captured restore point while leaving personal documents, photos, and other user data untouched. It is not a file-backup product, it does not reset the device to factory condition, and it does not reinstall Windows around the existing applications, which are the jobs of File History, Reset this PC, and an in-place repair upgrade.
- A technician needs to scan a heavily infected Windows 11 PC where the malware blocks the antivirus from running normally. Which boot environment loads only essential drivers and services so the scan can run with the malware inactive?
- Fast Boot
- Test Mode
- User Mode
- Safe Mode
Correct answer: Safe Mode
Safe Mode starts Windows with only the minimal drivers and services the operating system needs, which normally leaves the malware unloaded and lets the anti-malware scan run and clean the machine. Fast Boot is a firmware setting that shortens power-on checks, Test Mode allows unsigned drivers to load, and user mode is a processor privilege level rather than a startup option.
- What does Safe Mode in Windows provide that the normal startup does not?
- A minimal startup that loads basic drivers and core services
- A faster startup that avoids the paging file and hibernation
- A verified startup that checks each driver against a catalog
- A visual startup that enables the full graphics driver stack
Correct answer: A minimal startup that loads basic drivers and core services
Safe Mode is a diagnostic startup: it loads only basic drivers and brings up a reduced set of services, leaving most third-party startup programs out, which isolates whether a fault comes from the core operating system or from something added to it. It does not skip the paging file to boot faster, it does not validate drivers against a catalog, and it deliberately uses a generic display driver rather than the full graphics stack.
- A technician needs to boot a Windows 11 laptop into Safe Mode but the system boots normally to the sign-in screen. From the Windows Recovery Environment Startup Settings menu, which key selects Safe Mode with Networking?
Correct answer: F5
F5 selects Safe Mode with Networking on the Startup Settings screen reached through the Windows Recovery Environment. The function key just before it gives plain Safe Mode with no network stack, the one just after it gives Safe Mode with Command Prompt, and the next one turns off driver signature enforcement. The legacy trick of tapping a function key during boot no longer works by default on modern systems with fast UEFI startup.
- A user wants to reach Safe Mode on a Windows 11 PC that still boots to the desktop. Which built-in method opens the Windows Recovery Environment where Safe Mode options are available?
- Hold Shift and click Restart inside the Windows power menu
- Press F8 during the vendor logo before Windows fully loads
- Open msconfig and tick the Safe Boot minimal startup entry
- Use bcdedit to change the default boot timeout value first
Correct answer: Hold Shift and click Restart inside the Windows power menu
Holding Shift while clicking Restart in the power menu boots the machine straight into the Windows Recovery Environment, where Troubleshoot, then Advanced options, then Startup Settings lead to the Safe Mode choices. Tapping a function key during the vendor logo no longer works by default on machines with fast UEFI startup, the msconfig Safe Boot checkbox reboots into Safe Mode without ever opening recovery, and a bcdedit timeout change only alters how long the boot menu waits.
- A technician is asked to remove malware from a computer for a user. Following best practices, after the malware is remediated and scans are scheduled, what should be done before considering the job complete?
- Roll the machine back to the oldest saved checkpoint
- Clear the browser cache and delete the saved cookies
- Defragment the system drive and shrink the swap file
- Re-enable System Restore and then brief the end user
Correct answer: Re-enable System Restore and then brief the end user
Once remediation is finished and scans and updates are scheduled, the technician turns System Restore back on, captures a fresh clean restore point, and then educates the end user about the habits that keep it from happening again, which is the final step of the procedure. Rolling back to the oldest restore point risks reinstating the infection, and clearing browser data or defragmenting the drive does nothing about malware.
- A technician suspects a Windows 11 PC is infected but the installed antivirus reports it is clean. Following the remediation step of malware removal, what should the technician do before scanning again?
- Start Disk Cleanup to remove the temporary browser folder
- Increase the paging file allocation on the boot partition
- Update the scanner definitions from a proven clean source
- Reimage the workstation from the latest gold master image
Correct answer: Update the scanner definitions from a proven clean source
A scanner is only as good as its definitions, so during remediation the technician refreshes them before scanning again, ideally from a machine known to be clean because an infected host is often blocked from reaching the vendor. Reimaging is a later or last-resort step rather than the next thing to try, and clearing temporary files or resizing the paging file changes nothing about what the scanner is able to recognise.
- A Windows 11 workstation has become very slow over the past week. Task Manager shows disk usage pinned at 100 percent with no demanding applications open. Which is the most likely culprit a technician should investigate first?
- A drained CMOS battery or a drifting hardware clock chip
- A failing disk or a background task saturating the drive
- A low monitor refresh rate or a stale graphics processor
- A stalled audio task or a loose external network adapter
Correct answer: A failing disk or a background task saturating the drive
Sustained disk utilisation at the ceiling with nothing demanding open points either at the drive itself, which may be failing and retrying reads, or at a background job such as Windows Search indexing, SysMain, or an update hammering the disk. The technician should check drive health and find out which process is disk-bound. A CMOS battery, a refresh rate, and an audio or cabling fault have nothing to do with disk utilisation.
- A technician is troubleshooting slow performance on a Windows 11 PC and wants to identify which process is consuming the most CPU and memory in real time. Which built-in tool is the most appropriate?
- Event Viewer
- Boot Manager
- Task Manager
- File History
Correct answer: Task Manager
Task Manager reports live CPU, memory, disk, and network use broken down process by process, so it is the fastest way to see which program is eating the machine. Event Viewer records events after they happen rather than showing live consumption, Boot Manager only chooses which operating system starts, and File History copies user files to another drive, so none of them shows real-time per-process resource use.
- A Windows 11 PC repeatedly displays a low memory warning and applications begin closing on their own when several large programs are open. The machine has only 8 GB of RAM. Besides adding physical RAM, which adjustment most directly relieves the condition?
- Lower the display scaling to release the video memory
- Enlarge the paging file size to extend virtual memory
- Rebuild the startup partition from MBR into GPT table
- Turn off System Restore to reclaim the shadow storage
Correct answer: Enlarge the paging file size to extend virtual memory
When physical RAM runs out, enlarging the page file gives Windows more room to move memory pages onto disk, which directly relieves the low-memory warnings and the applications shutting themselves down, although fitting more RAM is the better long-term answer. Display scaling frees only a sliver of video memory, the partition scheme has nothing to do with available RAM, and switching System Restore off reclaims disk space rather than working memory.
- A user reports a recurring low memory warning on Windows 11. The technician finds one application steadily consuming more and more RAM the longer it runs, even when idle. What does this behavior most likely indicate?
- An application memory leak
- A defective memory package
- A corrupted page directory
- An incorrect display scale
Correct answer: An application memory leak
Memory use that climbs steadily and is never handed back, even while the program sits idle, is the signature of a memory leak in that application, and the fix is to update, reinstall, or report the faulty program. A defective memory package would throw stop errors across the whole machine rather than inflate one process, a display scale setting has no bearing on RAM use, and a page directory fault would affect the system as a whole rather than a single application.
- A user reports that one specific application crashes to the desktop within seconds of launching, while every other program runs fine. As a first troubleshooting step for application crashes, what should the technician do?
- Clear the spooler queue and restart the printing service
- Reset the network adapter and renew the DHCP reservation
- Start chkdsk and repair the volume file allocation table
- Read Event Viewer and then repair the broken application
Correct answer: Read Event Viewer and then repair the broken application
When a single application dies while everything else on the machine runs normally, the fault sits inside that application, so the technician opens the Application log in Event Viewer for the faulting module and exception code and then repairs, updates, or reinstalls just that program. Restarting the print spooler, resetting the network adapter, and running chkdsk all address subsystems that are working perfectly well here.
- A technician is troubleshooting an application that crashes intermittently on Windows 11. Which built-in log location records the faulting application name, module, and exception code to help pinpoint the cause?
- The Startup listings under Task Manager
- The Reliability report in Action Center
- The Application log inside Event Viewer
- The Boot log under System Configuration
Correct answer: The Application log inside Event Viewer
The Application log in Event Viewer records crash events with the faulting application name, the faulting module (usually a specific DLL), and the exception code, which is what points a technician at the root cause. Startup listings only show what launches at sign-in, the Action Center reliability report summarises a stability index over time without module or exception detail, and the System Configuration boot log records driver loading during startup rather than application crashes.
- After a recent feature update, a Windows 11 application that worked fine before now crashes on launch. Which approach should a technician try first to restore functionality with the least disruption?
- Repair the application and then search for a newer build
- Disable the paging file and then reboot into normal mode
- Roll the display driver back and then purge shader cache
- Clear the search index and then restart the host service
Correct answer: Repair the application and then search for a newer build
The crash began after a known change, so the least disruptive effective move is to repair the application in place and then look for a newer build that supports the updated operating system; rolling the machine back with System Restore is the other low-impact option. Disabling the paging file, rolling back the display driver, and clearing the search index all target subsystems that have nothing to do with this application.
- A Windows 11 computer presents a black screen with the message 'Operating System not found' after the user changed the boot order in UEFI. What is the most likely cause?
- The system clock was reset to the firmware default date
- The firmware was pointed at a device without any system
- The partition was assigned a new drive label by Windows
- The chassis fans were set to a quieter acoustic profile
Correct answer: The firmware was pointed at a device without any system
An 'Operating System not found' message straight after a boot order change means the firmware is now trying to start from a device that carries no operating system, so the fix is to put the real system drive back at the top of the UEFI boot order. A clock reset, a drive label change, and a fan profile change are all genuine settings, but none of them produces that firmware-level message.
- A technician wants to permanently stop several unnecessary programs from launching at boot to speed up sign-in on Windows 11. Which built-in interface is the primary place to disable startup applications in current Windows?
- The Boot tab under System Configuration
- The Driver section under Device Manager
- The Uninstall list inside Control Panel
- The Startup section inside Task Manager
Correct answer: The Startup section inside Task Manager
In current Windows the Startup section of Task Manager, mirrored under Settings then Apps then Startup, is where startup applications are switched on or off and where their startup impact is shown. The Boot tab of System Configuration controls boot options such as Safe Boot rather than the startup list, Device Manager handles hardware and drivers, and the uninstall list removes a program altogether instead of leaving it installed but dormant.
- A Windows 11 user reports that the Start menu, search, and several built-in apps suddenly fail to open or crash, though third-party software works. Which command-line tool is the most appropriate first step to repair protected system files?
- chkdsk /scan
- netstat -abn
- bcdedit /set
- sfc /scannow
Correct answer: sfc /scannow
sfc /scannow scans the protected Windows system files and replaces any that are corrupt or missing, which is the right first move when built-in components such as Start, search, and the shell apps stop opening. chkdsk checks the file system and disk structures rather than operating system files, netstat reports network connections, and bcdedit edits boot configuration entries.
- A user creates a new sign-in but their familiar desktop, documents, and settings are missing, while another local account on the same PC is fine. Windows shows a notice that it signed them in with a temporary profile. What is the most likely cause?
- An expired user account password
- A corrupted user account profile
- A blocked network folder mapping
- An unlicensed Windows home image
Correct answer: A corrupted user account profile
Windows falls back to a temporary profile when it cannot load a user's own profile, which is exactly why the desktop, documents, and settings all appear to be missing while another account on the same machine works normally. The fix is to repair the profile's registry reference or create a new profile and migrate the data across. An expired password, a broken share mapping, and an unlicensed installation all fail in other ways and would not single out one profile.
- A Windows 11 machine reboots unexpectedly with a stop error referencing a specific driver after a printer driver was updated. Booting normally fails the same way. Which step lets the technician load Windows with minimal drivers to roll the bad driver back?
- Restart into Safe Mode and roll the offending driver back
- Run Startup Repair and then reload the printer driver set
- Enter the firmware and reset the booting order to default
- Use Disk Cleanup and shrink the huge hibernation file now
Correct answer: Restart into Safe Mode and roll the offending driver back
Safe Mode starts Windows with a minimal driver set, which is enough to reach Device Manager and roll back or uninstall the printer driver that triggers the stop error. Startup Repair rebuilds boot files and does not revert a driver, resetting the firmware boot order does not touch the Windows driver store, and Disk Cleanup and the hibernation file have nothing to do with a driver fault.
- A user complains their Windows 11 PC frequently shows a 'service failed to start' message and a feature stops working. Which built-in console lets a technician view, start, stop, and set the startup type of background services?
- The Windows Firewall console
- The Resource Monitor console
- The Services control console
- The Print Management console
Correct answer: The Services control console
The Services console lists every background service and lets a technician start or stop one and set its startup type to Automatic, Manual, or Disabled, which is what a service that will not start needs. Windows Firewall manages traffic rules, Resource Monitor shows live resource consumption, and Print Management administers printers and print queues, so none of them changes how a service starts.
- An Android phone shows constant pop-up ads even outside the browser and the battery drains quickly after the user side-loaded an app from an unofficial store. Which is the most appropriate troubleshooting action?
- Clear the browser cache and reset its default search engine
- Turn off the background data and mute each app notification
- Swap the battery pack and reset the charging firmware today
- Uninstall the side-loaded app and run a mobile malware scan
Correct answer: Uninstall the side-loaded app and run a mobile malware scan
System-wide pop-ups and heavy battery drain that begin right after an app was side-loaded from an unofficial store point at mobile malware, so the right move is to remove that app and run a reputable mobile anti-malware scan, escalating to a backup and factory reset only if the symptoms survive. Clearing browser data does nothing about ads outside the browser, muting notifications hides a symptom, and the battery is draining because of the software rather than because the cell is worn.
- A user's iPhone repeatedly shows that an app is not responding and the device feels sluggish, but only since the latest app update. Which is the best first step before considering a full device reset?
- Force quit and then reinstall the single misbehaving app
- Restore the whole handset from an existing iCloud backup
- Switch airplane mode off and rejoin the wireless network
- Reset the network settings and forget each saved hotspot
Correct answer: Force quit and then reinstall the single misbehaving app
Because the slowdown arrived with one app's update and nothing else on the phone is affected, the least disruptive effective step is to force close that app and then update or reinstall it; clearing its cache or stored data can help as well. Restoring the whole handset from an older backup is far more disruptive and unnecessary at this stage, and airplane mode or network settings have no bearing on an app-specific fault.
- A technician notices a Windows 11 PC has a rogue antivirus pop-up demanding payment, the real Windows Defender is turned off and will not re-enable, and the user cannot reach security vendor websites. What does this combination of symptoms most strongly indicate, and what is the correct response?
- A DNS misconfiguration; flush the resolver cache and check
- An expired licence; reactivate Windows and re-type the key
- An active malware infection; isolate it and begin clean-up
- A failing disk controller; clone and replace the enclosure
Correct answer: An active malware infection; isolate it and begin clean-up
A fake security alert demanding payment, real-time protection that has been switched off and refuses to come back on, and blocked access to security vendor sites are together the hallmarks of an active infection defending itself. The right response is to isolate the machine and work through the malware removal steps. A name resolution fault would not disable Defender, a licensing problem would not block security sites, and a failing disk controller would not generate a payment demand.
- A backup administrator runs a full backup every Sunday and then runs a job each weeknight that copies only the files changed since the last backup of any kind, clearing the archive bit afterward. Which backup type is being run on the weeknights?
- A differential backup
- An incremental backup
- A cloud-tiered backup
- An application backup
Correct answer: An incremental backup
This is an incremental backup: each nightly job captures only what changed since the most recent backup of any type and clears the archive bit, which keeps the nightly window small but means a restore needs the full plus every job in the chain. A differential captures everything changed since the last full and leaves the archive bit alone. Cloud-tiered describes where a copy lands and application-aware describes how a database is quiesced, so neither names which changes are captured.
- A company keeps a full backup from each Sunday and a job each weeknight that captures all files changed since that Sunday full backup. To fully restore data lost Thursday morning, the technician needs the Sunday full plus only the most recent nightly job. Which backup type is in use on the weeknights?
- An incremental backup
- A volume-level backup
- An image-based backup
- A differential backup
Correct answer: A differential backup
This is a differential backup: each nightly job captures everything changed since the Sunday full, so a restore needs only that full plus the single most recent nightly set. An incremental would require the full plus every job in the chain, because each one holds nothing but the changes since the previous backup. Volume-level and image-based describe the granularity of what is copied rather than which changes since which backup are captured.
- A technician is comparing two strategies. Strategy X requires restoring the last full backup and every backup taken since, in order. Strategy Y requires restoring the last full backup and only the single most recent dated backup. Which statement correctly distinguishes incremental from differential backups?
- Both plans describe full backups taken at weekly intervals
- Each plan describes a synthetic full assembled onto arrays
- Strategy X is incremental while Strategy Y is differential
- Neither plan preserves a chain and each restores instantly
Correct answer: Strategy X is incremental while Strategy Y is differential
Strategy X is incremental and Strategy Y is differential. An incremental stores only what changed since the previous backup, so a restore has to replay the full plus the whole chain in order. A differential stores everything changed since the last full, so a restore needs the full plus one differential. Incrementals back up faster and restore slower; differentials do the reverse, and neither of them is a plain full or a synthetic full.
- A backup system periodically merges the most recent full backup with subsequent incremental backups on the backup storage itself, producing a new complete full backup without re-reading all data from the production servers. Which backup type does this describe?
- The synthetic full backup
- The scheduled cold backup
- The mirrored drive backup
- The offline system backup
Correct answer: The synthetic full backup
A synthetic full is assembled on the backup target itself by merging an existing full with the incrementals that followed it, producing a complete restore point without pushing a fresh full read across the production servers. A cold backup is taken with the system shut down, a mirrored drive keeps a live duplicate rather than a point in time, and an offline system backup describes where a copy is kept rather than how it is built.
- An organization wants its disaster-recovery plan to follow an industry rule that guards against losing data to a single site failure or media failure. The plan keeps three copies of data, on two different media types, with one copy stored off site. Which backup principle is being applied?
- The RAID media backup rule
- The 3-2-1 backup copy rule
- The 24 hour retention rule
- The 30 day expiration rule
Correct answer: The 3-2-1 backup copy rule
The 3-2-1 rule calls for three copies of the data, held on two different media types, with one copy kept off site, which covers both a media failure and a site-wide disaster such as fire or theft. RAID mirroring gives redundancy inside a single machine and is not a backup at all, and retention or expiration rules govern how long a copy is kept rather than how many copies exist and where they live.
- A data center uses tapes labeled daily, weekly, and monthly, reusing the daily tapes most often, the weekly tapes less often, and retaining the monthly tapes the longest. Which backup rotation scheme does this describe?
- The GFS media rotation
- The FIFO tape rotation
- The LIFO tape rotation
- The Hanoi set rotation
Correct answer: The GFS media rotation
This is the Grandfather-Father-Son scheme: the daily tapes are the sons and are reused most often, the weekly tapes are the fathers, and the monthly tapes are the grandfathers and are held longest. GFS balances how many tapes are needed against how far back a restore can reach. First-in-first-out and last-in-first-out simply reuse the oldest or the newest media, and the Tower of Hanoi scheme reuses sets on a recursive pattern rather than by daily, weekly, and monthly tiers.
- A manager asks a technician how much data, measured in time, the business can afford to lose if a server fails between scheduled backups. Which disaster-recovery metric answers this question?
- Business Impact Analysis
- Maximum Allowable Outage
- Continuity Test Schedule
- Recovery Point Objective
Correct answer: Recovery Point Objective
The Recovery Point Objective states how much data, expressed as an interval of time, the business is willing to lose, and it is what dictates how often backups must run. A business impact analysis identifies which functions matter and what an outage would cost, maximum allowable outage and the recovery time objective describe downtime rather than data loss, and a continuity test schedule only says when the plan is rehearsed.
- A disaster-recovery plan states that a critical application must be fully restored and operational within four hours of an outage. Which metric does the four-hour target represent?
- Service Level Agreement
- Recovery Time Objective
- Backup Retention Window
- Disaster Recovery Drill
Correct answer: Recovery Time Objective
Four hours to have the application back in service is the Recovery Time Objective, the maximum tolerable duration of downtime, and it drives decisions about standby hardware and recovery procedures. A service level agreement is the contract that may contain such a target, a backup retention window says how long copies are kept, and a disaster recovery drill is the rehearsal rather than the metric itself.
- A technician must explain the difference between RTO and RPO to a new hire. Which pairing correctly matches each term to what it measures?
- RTO measures the backup window; RPO measures the restore throughput
- RTO measures the drive capacity; RPO measures the network bandwidth
- RTO measures the tolerable downtime; RPO measures allowed data loss
- RTO measures the cartridge lifespan; RPO measures the archive depth
Correct answer: RTO measures the tolerable downtime; RPO measures allowed data loss
RTO is about downtime: how long the business can tolerate a system being unavailable. RPO is about data loss: how far back in time a restore may have to reach, which is why a tight RPO means more frequent backups while a tight RTO means faster recovery infrastructure. Neither of them measures a backup window, drive capacity, network bandwidth, or media lifespan.
- A change request is submitted to apply a routine, pre-approved monthly security patch that follows a well-documented procedure and carries low risk. Under standard change management, which change type best classifies this request?
- The standard change
- An emergency change
- An unplanned change
- A corrective change
Correct answer: The standard change
A standard change is routine, low risk, and pre-authorised: it follows an established procedure and does not need the change board to review it every time, which is exactly what a documented monthly patch is. An emergency change is reserved for urgent work such as an active outage or security incident, an unplanned change has not been assessed or approved in advance, and a corrective change repairs a fault rather than delivering routine maintenance.
- A technician is asked to define change management for a help-desk onboarding document. Which description best captures its purpose?
- A written schedule for rotating and retiring backup volumes
- A cipher standard for encrypting and signing stored records
- A ticket workflow for logging and closing hardware failures
- A formal process for approving and recording system changes
Correct answer: A formal process for approving and recording system changes
Change management is the formal process for requesting, reviewing, approving, and documenting modifications to IT systems. It reduces risk by requiring a documented purpose, a risk assessment, approvals, a rollback plan, and end-user acceptance before anything reaches production. Media rotation schedules, encryption standards, and hardware ticket workflows are all genuine operational processes, but none of them is change management.
- During a change-management review, the board sets a window of midnight to 4 a.m. Sunday as the only time a production database upgrade may be performed. What is this scheduled period called?
- Remediation window
- Observation window
- Maintenance window
- Restoration window
Correct answer: Maintenance window
A maintenance window is a pre-approved, scheduled period in which disruptive work may be carried out with the least impact on users, which is what the midnight-to-four Sunday slot is. An observation window is the watching period after a change lands, a remediation window is time set aside to correct a problem, and a restoration window describes how long a recovery is expected to take.
- After a change is approved and implemented, the change-management process calls for confirming with the people who actually use the affected system that it now works as intended before the change ticket is closed. Which step is this?
- Rollback validation
- End-user acceptance
- Deployment planning
- Configuration audit
Correct answer: End-user acceptance
End-user acceptance is the step after implementation where the people who actually use the system confirm that it behaves as intended, and it is what allows the change ticket to be closed. Rollback validation checks that the reversal plan works, deployment planning happens before the work is done, and a configuration audit compares the built state against the record rather than asking users whether it works for them.
- A change request form includes a section describing exactly which servers, applications, and user groups the proposed change will touch and which will be left untouched. Which element of the change request does this section represent?
- Risk analysis, reviewed with the approving manager
- Rollback plan, rehearsed before the planned outage
- Scope, negotiated with the affected service owners
- Purpose, justified to the requesting business unit
Correct answer: Scope, negotiated with the affected service owners
The section that draws the line between what the work will touch and what it will leave alone is the scope. Scope fixes the boundary of a change so its impact can be assessed, communicated to the right owners, and approved. The purpose states why the change is wanted, which is a separate question from what it reaches. A risk analysis weighs what could go wrong and how likely that is. A rollback plan sets out how to return to the previous state if the change fails.
- An IT department maintains a database that tracks every hardware and software asset, its configuration, and the relationships between assets, so technicians can see how a change to one item may affect others. What is this repository called?
- Knowledge base, written by technicians following each hardware upgrade
- Configuration management database, reconciled each time a device moves
- Service-level agreement, signed by both software supplier and customer
- Acceptable use policy, acknowledged by each incoming employee annually
Correct answer: Configuration management database, reconciled each time a device moves
A configuration management database is the central record of an organization's assets, the configuration of each one, and the dependencies that tie them together, which is exactly what lets a technician see how altering one item will reach others. A knowledge base stores symptom-and-fix articles, so it records solutions rather than asset relationships. A service-level agreement records the performance a provider commits to delivering. An acceptable use policy sets the rules staff must follow when using company systems.
- A technician affixes a small barcoded label with a unique identifier to each company laptop and monitor so the items can be scanned and tracked in inventory. What is this label called?
- Asset tag, attached by the owner organization after delivery
- Service tag, printed by the laptop builder during production
- Configuration baseline, captured when a change is signed off
- Chain-of-custody form, completed once a seized item moves on
Correct answer: Asset tag, attached by the owner organization after delivery
An asset tag is the identifier the owning organization attaches to equipment, commonly as a barcode, so each item can be scanned and tracked through inventory and asset management. A vendor service tag is assigned by the manufacturer for warranty lookups and is not the organization's own inventory identifier. A configuration baseline is a recorded snapshot of an approved settings state, not a physical label. A chain-of-custody form tracks the handling of evidence and has no role in routine inventory.
- A help-desk team writes step-by-step documents that define exactly how to perform recurring tasks such as imaging a new laptop or resetting an account, so every technician completes them the same way. What are these documents called?
- Incident reports, completed following a prolonged service outage
- Regulatory rules, refreshed after each external compliance audit
- Acceptable use policies, acknowledged before accounts are issued
- Standard operating procedures, rewritten when a workflow evolves
Correct answer: Standard operating procedures, rewritten when a workflow evolves
Standard operating procedures are the documents that spell out the exact steps for a routine task so the result is the same no matter who performs it. Incident reports describe what happened during one specific event and are written after the fact, not as instructions. Regulatory rules state what the organization must satisfy without describing how any task is carried out. Acceptable use policies govern what staff may do with company systems rather than how a technician images a laptop.
- A technician resolves an unusual printer error and writes a clear article describing the symptom, cause, and fix, then publishes it so other technicians can search for and reuse the solution. Which documentation resource is being added to?
- Change request form, endorsed before a maintenance window opens
- Knowledge base, expanded whenever a repeatable remedy is proven
- Network topology diagram, redrawn after every floor is recabled
- Acceptable use policy, reissued when company rules are reviewed
Correct answer: Knowledge base, expanded whenever a repeatable remedy is proven
Publishing a searchable write-up of a symptom, its cause and its fix adds to the knowledge base, the shared store technicians consult so a solved problem does not have to be solved twice. A change request form asks for approval to alter a system and is not a record of how a fault was cured. A network topology diagram shows how devices interconnect, which is design information rather than repair guidance. An acceptable use policy governs staff conduct on company systems.
- When opening a ticket, a technician records the user's contact information, a clear problem description, the device and error messages, categorizes the issue, and assigns a severity level. Which ticketing best practice does capturing this complete, structured information support?
- Automatic license reclamation and cleanup of dormant accounts
- Encrypted replication of the conversation on external servers
- Scheduled patch deployment to the connected user workstations
- Accurate categorization and priority for the queue assignment
Correct answer: Accurate categorization and priority for the queue assignment
Capturing the caller, a clear description, the device, the error text, a category and a severity is what makes accurate categorization and prioritization possible, and that is what sends the ticket to the right queue at the right urgency. Reclaiming licenses is an asset-management job that structured intake does not drive. Encrypting stored records protects data at rest but does not depend on how completely the ticket was filled in. Deploying patches on a schedule is a separate maintenance practice.
- A technician is about to install RAM and a PCIe card in a desktop. Which combination of methods best prevents electrostatic discharge from damaging the components?
- Wearing a grounded wrist strap and using one antistatic mat
- Unplugging the mains lead and tapping the power button once
- Torquing the board standoffs and screws to the stated value
- Applying new paste and seating the cooler bracket back down
Correct answer: Wearing a grounded wrist strap and using one antistatic mat
A wrist strap bonded to the chassis together with an antistatic mat holds the technician, the bench and the parts at one potential, so no charge can build up and arc into the memory or the expansion card. Draining the supply by unplugging and pressing the power button is a genuine electrical-safety step, but it does nothing about static on the person handling the parts. Torquing standoffs and screws prevents board flex and shorts. Fresh thermal paste and a properly seated bracket control heat, not static.
- A technician notices a coworker handling a graphics card while standing on carpet in a dry room without any grounding equipment. Which additional ESD-prevention measure should the technician recommend?
- Fit a surge suppressor between the wall socket and workstation
- Position the module onto a thick rubber insulating floor sheet
- Increase the humidity and connect the colleague to the chassis
- Blow the debris from a heatsink with compressed air beforehand
Correct answer: Increase the humidity and connect the colleague to the chassis
Dry air and a carpeted floor are the two conditions that let a charge build on a person, so the answer is to bring the humidity up and bond the handler to the chassis with a strap or mat so both sit at one potential. A surge protector guards against spikes arriving on the mains and does nothing for a charge already on the body. Rubber is an insulator, so resting a part on it traps charge instead of draining it away. Blowing dust out cools a part but leaves the static hazard untouched.
- A technician straps a band around the wrist and clips its lead to the metal frame of the computer chassis before touching internal components. What is the purpose of this antistatic wrist strap?
- To drain residual charge from the power supply filter capacitors
- To stabilize the wearer and enclosure at one identical potential
- To redirect mains earth fault current away from this motherboard
- To damp voltage ripple reaching the memory and expansion sockets
Correct answer: To stabilize the wearer and enclosure at one identical potential
Clipping the strap's lead to the metal frame bonds the wearer to the equipment, so both sit at the same potential and there is no difference for a charge to jump across into the circuitry. The strap does not discharge the supply's filter capacitors, which bleed through their own resistors after the mains lead is pulled. It carries no fault current, and its built-in high-value resistor is there to limit current through the wearer, not to route it. Smoothing supply ripple is the regulator's job.
- A cleaning chemical is spilled in a workshop and a technician needs to know its hazards, required protective equipment, first-aid steps, and proper disposal. Which document provides this information?
- Acceptable use policy, published by the employer to every employee
- Standard operating procedure, written by the team that performs it
- Service-level agreement, drawn between a provider and a sole buyer
- Safety data sheet, furnished by the manufacturer with each product
Correct answer: Safety data sheet, furnished by the manufacturer with each product
The safety data sheet, once called the MSDS, is the manufacturer's document listing a substance's hazards, the protective equipment required, first-aid measures for exposure, spill handling and lawful disposal, so it is what the technician needs after the spill. An acceptable use policy governs how staff may use company systems. A standard operating procedure describes the steps of a routine task but carries no chemical hazard data. A service-level agreement records the service targets a provider promises.
- A technician must collect a hard drive as potential evidence in a legal investigation. Which practice documents every person who handled the drive, along with the dates, times, and reasons, to preserve its integrity?
- Service-level agreement, renewed at the close of every contract
- Acceptable use policy, published on the company intranet portal
- Chain of custody, instituted whenever the evidence is impounded
- Change request log, inspected at the fortnightly advisory board
Correct answer: Chain of custody, instituted whenever the evidence is impounded
Chain of custody is the unbroken written record of every person who has held an item of evidence, with the date, the time and the reason for each transfer, and it is what keeps the drive admissible. A service-level agreement records service targets between a provider and a customer. An acceptable use policy states what staff may do with company equipment. A change request log tracks approved alterations to systems and says nothing about who physically handled a piece of evidence.
- While repairing a laptop, a technician discovers files that appear to violate the law. Following first-response incident-handling procedures, what should the technician do first?
- Identify the find, preserve the data intact, and escalate it
- Complete the repair, record the parts fitted, and invoice it
- Duplicate the storage, launch a malware scan, and archive it
- Return the device, log the discovery, and continue the queue
Correct answer: Identify the find, preserve the data intact, and escalate it
First response is to recognize what has been found, leave the data exactly as it is, and hand it up through the documented chain of custody so the evidence stays intact and admissible. Completing the repair and closing the ticket buries the find and destroys the timeline. Making a copy and running a scan writes to the device and breaks the chain of custody even when the intent is honest. Handing the machine back and moving on removes the only copy of the evidence from the organization's control.
- A technician services a laser printer whose pages have a sharp, dark vertical line running the full length of every sheet at the same horizontal position. The line repeats on each page in exactly the same spot. What is the most likely cause?
- A polished separation pad slipping inside the paper feed pathway
- A fusing roller sitting well below its usual working temperature
- A duplexing flap sensor reporting the rear access door unlatched
- A deep groove running round the main photosensitive drum surface
Correct answer: A deep groove running round the main photosensitive drum surface
A mark that lands in the same horizontal position on every sheet, for the whole length of the sheet, is coming from something that turns once per page and is physically damaged: a groove or scratch on the imaging drum picks up toner where the surface should stay clean, and replacing the drum or the cartridge that holds it clears it. A worn separation pad causes multi-sheet feeds and jams, not printed marks. A cool fuser leaves toner that smears or lifts off, not a crisp line. A duplexer door sensor stops the job rather than marking the page.
- A user's smartphone shows full Wi-Fi signal bars but pages will not load, while other devices on the same access point work fine. Toggling airplane mode and rebooting does not help. What should the technician try next?
- Forget the stored wireless profile on this phone and rejoin
- Reseat the SIM card and authenticate with the cell operator
- Update the saved APN entry inside the handset cellular menu
- Reconfigure the access points onto a broader 40 MHz channel
Correct answer: Forget the stored wireless profile on this phone and rejoin
Other clients on the same access point are fine, so the fault is in this handset's stored profile: deleting the saved network and joining it again clears a stale lease, a bad gateway entry or corrupted credentials and forces a fresh association. Reseating the SIM affects the cellular radio, which is not carrying this traffic. An APN edit configures the mobile data connection and has no effect on Wi-Fi. Widening the channel changes throughput for everyone and does not repair one client's saved profile.
- A desktop displays distorted, garbled video with random colored artifacts and occasional checkerboard patterns across the screen, and the artifacts worsen as the system runs longer. The monitor and cable test good on another PC. What is the most likely cause?
- An unfastened SATA lead serving the internal storage subsystem
- An exhausted CMOS battery fastened onto the system motherboard
- An overheating graphics processor on the fitted expansion card
- An unsupported refresh rate set inside the display preferences
Correct answer: An overheating graphics processor on the fitted expansion card
Random colored speckles, checkerboard blocks and distortion that get worse the longer the machine runs are the signature of a graphics processor losing stability as it heats, and the monitor and cable already tested good elsewhere. Cleaning the cooler, reseating the card or replacing it is the fix. A loose drive cable produces boot and read errors, never image corruption. A dead CMOS cell loses the clock and firmware settings. A refresh rate the panel cannot accept gives a blank or out-of-range screen.
- A laptop frequently shows a 'Plugged in, not charging' status even though the correct AC adapter is connected and the system runs on AC power. The battery percentage stays frozen. What is the most likely cause?
- A detached video ribbon behind the lower hinge housing
- A degraded battery pack the firmware will not recharge
- A blown backlight inverter in the laptop display panel
- A disabled wireless adapter switched off in BIOS setup
Correct answer: A degraded battery pack the firmware will not recharge
When the machine runs happily on mains but the charge level never moves and the status reads plugged in and not charging, the pack has lost enough health that the charging circuit stops feeding it deliberately, to avoid stressing worn cells; fitting a new battery restores normal charging. A loose display cable shows up as a flickering or dead image. A failed inverter darkens the backlight. A wireless adapter turned off in firmware affects networking only, not the power path.
- After moving a desktop to a new desk, the technician powers it on and the system posts but no Ethernet link light appears at the wall jack or the NIC, and the cable tester shows an open on one wire pair. What is the most likely cause?
- An incorrect subnet mask entered on the workstation interface
- A duplicate address conflict between two desktop hosts nearby
- A fractured conductor inside the freshly routed patch cabling
- A malfunctioning resolver set within the local equipment room
Correct answer: A fractured conductor inside the freshly routed patch cabling
A tester reporting an open on one pair, with no link light at either end, is a physical fault: a conductor is broken or a plug is badly terminated, and re-terminating or swapping the lead brings the link back. A wrong subnet mask is a logical setting that still leaves the link light lit. An address conflict likewise needs a working physical link before it can happen at all. A dead name server breaks name lookups while the interface stays up, and none of the three can register on a continuity tester.
- A user reports that their inkjet printer produces printouts with horizontal white gaps or banding through solid color areas, even on a high-quality setting. What should the technician try first?
- Replace the fusing assembly and rerun the identical test page
- Run the nozzle check and head-cleaning cycle from the utility
- Reseat the paper cassette and reload it using heavy cardstock
- Reduce the image resolution and turn off the color management
Correct answer: Run the nozzle check and head-cleaning cycle from the utility
Horizontal white stripes through areas that should be solid mean some nozzles are not firing, usually because ink has dried in them, so the built-in nozzle check and head-cleaning cycle is the first and cheapest thing to try. A fuser belongs to a laser engine and does not exist in an inkjet. Changing tray or paper weight alters feeding and absorption, not which nozzles fire. Dropping resolution and turning off color management changes how the image is rendered while the blocked nozzles stay blocked.
- A workstation intermittently freezes and reboots, and after the reboots the BIOS clock has reset to a default date and the system asks to re-enter setup. What is the most likely cause?
- A failing hard drive gradually losing its own leveling table
- A wrongly sized DHCP scope handing out expired lease periods
- A video cable seated poorly against the graphics card header
- A depleted coin cell no longer backing the firmware settings
Correct answer: A depleted coin cell no longer backing the firmware settings
Losing the date and the firmware configuration across power cycles means the small coin cell that keeps CMOS memory alive while the machine is off has run flat; fitting a fresh cell and re-entering the settings resolves it. A dying solid-state drive gives read errors and corruption but cannot reset the clock. A badly configured address pool affects network leases only. A loose video cable produces a missing or intermittent picture, which has nothing to do with retained firmware settings.
- A technician runs ipconfig on a Windows PC that has no network access and sees an address in the 169.254.x.x range. What does this indicate?
- The client found no DHCP server and self-assigned an APIPA address
- The client negotiated a routable public address and kept it active
- The client is using a static address typed into adapter properties
- The client remembered a stale DNS address for the same destination
Correct answer: The client found no DHCP server and self-assigned an APIPA address
Addresses beginning 169.254 are the reserved automatic private range, which Windows assigns to itself only after no DHCP server answers, so the finding says the lease request failed and the cable, the switch port and the DHCP service are what to check. A routable public address is never drawn from that block. A statically entered address is whatever the administrator typed and would not land in the automatic range by accident. Stale name-resolution data does not alter the interface address at all.
- A desktop's chassis cooling fan spins for a moment at power-on then stops, and the system shuts down after a few seconds without completing POST. The technician already verified the PSU outputs correct voltages. What should be checked next?
- Whether the chassis panel switch header presses on the wrong pins
- Whether the memory modules are seated and locked in both channels
- Whether the graphics card and its power lead are pressed squarely
- Whether the heatsink is fastened down and its fan cable connected
Correct answer: Whether the heatsink is fastened down and its fan cable connected
With the supply rails already measured good, a machine that runs for a few seconds and then cuts out before POST completes is protecting the processor: the cooler is not making contact or its fan is not spinning, so reseating the heatsink with fresh paste and plugging the fan into its header is the next check. A misplaced front panel header prevents the machine from starting at all. Unseated memory halts with beeps while the fans keep running. A loose card power lead leaves the system running without video.
- Several users on the same wireless access point report slow speeds and frequent disconnects only during busy afternoon hours, while early morning performance is fine. A site survey shows many neighboring networks on the same 2.4 GHz channel. What is the most likely cause?
- A failing switch uplink saturating the wiring route upstream
- A crowded radio channel shared with the neighboring networks
- An expired certificate on the internal captive portal server
- A depleted lithium battery inside the access point enclosure
Correct answer: A crowded radio channel shared with the neighboring networks
Slowdowns and drops that appear only when the area is busy, on a band the survey shows is packed with other networks using the same channel, are contention: every nearby radio has to take turns on shared airtime. Moving to a quieter channel or steering clients to 5 GHz fixes it. A saturated wired uplink would slow every client at all hours, not only the wireless ones in the afternoon. An expired certificate blocks the portal outright. A backup cell has no bearing on radio throughput.
- A technician is configuring RAM for a new build and wants the memory controller to address two modules simultaneously to increase bandwidth. To enable dual-channel mode, how should the matched DIMMs be installed?
- In the two color-matched slots the board manual pairs together
- In the two slots positioned nearest the processor socket alone
- In any two adjoining slots because the pairing happens quietly
- In the outermost slots first so the chipset mirrors everything
Correct answer: In the two color-matched slots the board manual pairs together
Dual-channel operation needs one module on each of the controller's two channels, and the board maker marks that pairing with matching slot colors and states it in the manual, which on four-slot boards usually means the first and third or the second and fourth. Proximity to the processor does not decide which channel a slot belongs to. Adjacent slots normally sit on the same channel, so filling them leaves the controller in single-channel mode. Mirroring memory is a server feature and is not what channel pairing does.
- A technician must connect a high-speed external drive enclosure and sees the port labeled USB 3.2 Gen 2x2. What maximum theoretical data rate does this standard provide?
- 5 Gbps, listed under one certified copper link
- 10 Gbps, named beside each tested passive cord
- 20 Gbps, quoted with any rated screened cables
- 40 Gbps, printed on all standard shielded runs
Correct answer: 20 Gbps, quoted with any rated screened cables
USB 3.2 Gen 2x2 runs two 10 Gbps lanes together over a USB-C connector, so the combined ceiling is 20 Gbps. The 5 Gbps figure belongs to USB 3.2 Gen 1, the original SuperSpeed rate. The 10 Gbps figure is a single Gen 2 lane, which is what the 2x2 designation doubles. The 40 Gbps figure belongs to Thunderbolt 3 and 4 and to USB4, which are different specifications and are not what a port labeled Gen 2x2 provides.
- A technician is replacing a failed compact flash storage module soldered onto a thin-and-light laptop's board and notes it is eMMC rather than an SSD. Which statement best describes eMMC storage?
- A volatile memory type cleared whenever the current is removed
- A rotating magnetic platter spun and read in cheaper notebooks
- A high-end interface running faster than any M.2 NVMe hardware
- A flash package holding the controller and NAND chips together
Correct answer: A flash package holding the controller and NAND chips together
Embedded MultiMediaCard storage puts non-volatile NAND flash and its controller into a single package that is normally soldered to the board of a budget or ultra-thin machine, which is why it cannot be upgraded and why it is slower and smaller than a discrete NVMe drive. It is not volatile, so it keeps its contents with the power off. It has no platters and no moving parts. And it sits below M.2 NVMe on every performance measure rather than above it.
- A technician is asked to set up a way for users to generate a shareable file from any application's Print dialog without sending output to physical paper. Which solution correctly accomplishes this?
- Fitting a higher-temperature fuser into this laser print machine
- Adding a second cassette underneath the networked color hardware
- Installing a virtual printer driver capturing printouts as files
- Reconnecting the peripheral from USB across to obsolete parallel
Correct answer: Installing a virtual printer driver capturing printouts as files
A virtual print driver appears in the Print dialog alongside real hardware but writes the rendered job to a file, such as a PDF, instead of sending it to an engine, which is exactly the shareable file the users want. Fitting a hotter fuser changes how toner bonds to paper and still produces a printed sheet. Adding a cassette only increases how much media the device holds. Changing the physical interface alters how the job reaches the hardware, not whether paper comes out.
- A technician must open the firewall so administrators can securely manage a Linux server through an encrypted command-line session. Which port should be allowed?
- Port 22, opened for SSH by the perimeter firewall rule
- Port 21, cleared for FTP via the office gateway tables
- Port 23, listed for Telnet on an older access register
- Port 80, granted to HTTP across the public web filters
Correct answer: Port 22, opened for SSH by the perimeter firewall rule
Secure Shell listens on TCP 22 and wraps the remote command line in encryption, so opening 22 is what lets an administrator manage the server safely. Port 21 carries the FTP control channel, which is file transfer rather than a shell and is unencrypted. Port 23 carries Telnet, which does give a remote command line but sends the session, passwords included, in clear text. Port 80 carries unencrypted web traffic and offers no command line at all.
- A technician is installing a wireless access point on a ceiling where no power outlet is available and wants to deliver both data and electrical power over a single Ethernet cable. Which technology makes this possible?
- Network address translation, set on the wireless border router
- Power over Ethernet, delivered by a midspan injector appliance
- Universal plug and play, left on automatically inside gateways
- Quality of service, configured to prioritize the voice traffic
Correct answer: Power over Ethernet, delivered by a midspan injector appliance
Power over Ethernet carries direct current and data on the same twisted-pair run, so a device on a ceiling or a pole works with only one cable and no outlet nearby. Address translation rewrites source and destination addresses so private hosts can reach the internet; it moves no current. Universal plug and play lets a device request its own port mappings automatically. Quality of service ranks traffic so latency-sensitive flows go first. None of the three can energize a remote device.
- On a SOHO router's DHCP settings, a technician sees a configurable 'lease time.' What does increasing the DHCP lease time accomplish?
- It reserves a single fixed address and ties one client forever
- It noticeably widens the range so every client gets an address
- It extends how long a client keeps an address between renewals
- It forces each active client onto a hand typed address instead
Correct answer: It extends how long a client keeps an address between renewals
Lease time is the period a client may hold the address it was granted before it has to renew with the server, so raising it means fewer renewals and a longer hold on each address; lowering it returns idle addresses to the pool sooner. Tying one address permanently to one machine is a reservation, which is configured separately. The size of the pool is set by the scope's start and end addresses, not by the lease. And nothing about the lease turns dynamic addressing into manual addressing.
- A technician is configuring several 2.4 GHz access points in one building and wants to minimize co-channel interference in North America. Which set of channels is non-overlapping and should be used?
- Channels 1, 6, and 11 for the office radios
- Channels 2, 5, and 8 for the ceiling radios
- Channels 1, 5, and 9 for the outdoor radios
- Channels 3, 6, and 9 for the hallway radios
Correct answer: Channels 1, 6, and 11 for the office radios
In the 2.4 GHz band each channel is about 22 MHz wide while the channel centers are only 5 MHz apart, so neighbors overlap unless they are five channels apart. Only 1, 6 and 11 clear that spacing within the North American allocation, which is why access points in one building are set to those three. Every other grouping listed puts at least two radios within five channels of each other, so their signals sit on top of one another and both sides retransmit.
- A user reports that the backlight on their laptop's LCD screen has gone dark, although a faint image is still visible when light is shined directly on the panel. Which field-replaceable component is the most likely cause?
- The touch digitizer bonded across the screen glass surface
- The wireless antenna wire running around the hinge channel
- The memory module seated beneath the keyboard access cover
- The backlight driver board powering the lamp string within
Correct answer: The backlight driver board powering the lamp string within
A panel that still forms an image under a torch but is otherwise black has lost its illumination, not its picture, and the illumination comes from a separate driver board, the inverter on older CCFL panels or the LED driver on newer ones; replacing that board restores the light. The digitizer only reports touch positions. The antenna wire affects signal strength. A memory fault stops the machine booting or crashes it rather than dimming a screen that is still drawing an image.
- A technician is replacing a SO-DIMM in a laptop to upgrade its memory. Which characteristic distinguishes SO-DIMM modules from the DIMM modules used in desktop computers?
- They carry their own onboard power regulation chips inside them
- They are shorter modules built for the cramped portable chassis
- They must always be fitted in carefully matched identical pairs
- They operate at a markedly higher voltage than desktop packages
Correct answer: They are shorter modules built for the cramped portable chassis
Small outline modules exist because a notebook has no room for a full-length card: the board is physically shorter and narrower, with a different notch and pin count, so it fits a laptop socket and not a desktop one. Voltage is set by the memory generation, not the form factor, so both types run at the same rails. Neither type carries its own regulator; the board supplies the rails. And neither has to be installed in pairs, though pairing enables dual-channel operation.
- A laptop's touchscreen no longer responds to finger taps, but the display still shows a clear, bright image and the system functions normally with an external mouse. Which component should the technician replace?
- The backlight inverter attached beneath the lower screen bezel
- The liquid crystal panel producing the bright viewable picture
- The system board battery maintaining the retained setup values
- The digitizer layer seeing precisely where each finger touches
Correct answer: The digitizer layer seeing precisely where each finger touches
The layer that turns a touch into coordinates is the digitizer, so when taps do nothing while the picture stays bright and a mouse still drives the machine, that layer is the failed part. The inverter drives the illumination, and its failure darkens the screen rather than deadening touch. The liquid crystal panel forms the image, which is plainly still working. The coin cell only preserves the clock and firmware settings while the machine is off.
- After replacing the cracked display assembly on a laptop, a technician notices that Wi-Fi signal strength is now much weaker than before the repair. Which step was most likely missed during reassembly?
- Reattaching the antenna leads running inside the cover
- Reflashing the system firmware after the screen change
- Recalibrating the digitizer onto the newly fixed glass
- Reseating the memory modules beneath the service hatch
Correct answer: Reattaching the antenna leads running inside the cover
Notebook wireless antennas sit in the lid, where they are clear of the metal in the base, and their thin leads run down the hinge to the wireless card; if they are left unplugged after a screen assembly is changed, the radio falls back to whatever stray coupling it has and range collapses. Firmware version has no bearing on antenna gain. Digitizer calibration affects touch accuracy only. Memory seating affects stability and capacity, never received signal strength.
- A technician wants to test a piece of software inside a virtual machine on their existing Windows laptop without wiping the operating system. Which type of virtualization software runs as an application on top of the host operating system to accomplish this?
- A bare-metal hypervisor that owns the entire host machine directly
- A container runtime sharing the operating system kernel beneath it
- A hosted virtualization product that runs above the loaded desktop
- A load balancer splitting client sessions among many distant nodes
Correct answer: A hosted virtualization product that runs above the loaded desktop
A hosted, or type 2, hypervisor installs like any other application on top of an operating system that is already there, which is what lets the technician keep the existing Windows install and still boot a guest inside it. A bare-metal hypervisor replaces that operating system and owns the hardware directly, so it cannot be launched from the desktop. A container engine runs isolated processes on the shared kernel rather than a full guest with its own kernel. A load balancer distributes traffic and virtualizes nothing.
- A group of separate hospitals that must all comply with the same healthcare privacy regulations wants to share a single cloud infrastructure restricted to organizations with those shared concerns. Which cloud deployment model best fits this requirement?
- Public cloud, hired by any paying customer without restriction
- Community cloud, operated jointly by a defined membership body
- Private cloud, dedicated to a single tenant organization alone
- Hybrid cloud, joining two platforms into one integrated estate
Correct answer: Community cloud, operated jointly by a defined membership body
A community deployment is one infrastructure operated for a limited set of organizations that share a mission, a jurisdiction or a regulatory regime, which is exactly what several hospitals under the same privacy rules need. A public deployment is open to anyone who pays and cannot be restricted to that set. A private deployment serves one organization, so it cannot be pooled across several hospitals. A hybrid deployment links two or more deployment models together, which is a different question from who may join.
- A company is billed by its cloud provider only for the exact amount of compute time and storage it consumes each month, with usage tracked and reported through a dashboard. Which essential characteristic of cloud computing does this billing approach describe?
- Resource pooling, defined by the NIST cloud model itself
- Rapid elasticity, defined by the NIST cloud model itself
- Broad network access, defined under the NIST cloud model
- Measured service, defined by the NIST cloud model itself
Correct answer: Measured service, defined by the NIST cloud model itself
Metering is the characteristic that has the provider count what each tenant actually consumes and report it back, which is what turns raw usage into a monthly bill for exactly the compute hours and storage used. Resource pooling is about many tenants drawing on one shared pool of hardware. Broad network access is about reaching the service from ordinary devices over the network. Rapid elasticity is about adding and removing capacity quickly. None of those three has anything to do with counting and charging.
- In a public cloud, a single physical server simultaneously hosts virtual machines belonging to several different, unrelated customers, with each customer logically isolated from the others. What is this arrangement called?
- Clustering, where multiple nodes process one workload together
- Multitenancy, where one platform carries many separate tenants
- Failover, where a replacement machine takes over automatically
- Thin provisioning, where storage is committed rather gradually
Correct answer: Multitenancy, where one platform carries many separate tenants
One physical host carrying instances that belong to several unrelated customers, each walled off from the others, is multitenancy: the hardware is shared while the data and the running instances are kept separate. Clustering ties several machines together so they behave as one system for a single owner. Failover is the automatic move to standby capacity when something breaks. Thin provisioning is a storage technique that allocates blocks only as they are written, which is unrelated to who the tenants are.
- A security analyst needs to safely open and observe a suspicious email attachment in an isolated, disposable virtual environment that cannot affect the production network. Which use of virtualization is the analyst applying?
- A virtual sandbox, destroyed after the analysis work completes
- A thin provisioned volume, stretched only as blocks accumulate
- A pooled resource cluster, shared across the production estate
- A guest machine, running an unlike operating system internally
Correct answer: A virtual sandbox, destroyed after the analysis work completes
Opening something untrusted inside a throwaway virtual machine that has no path to production is sandboxing: the analyst can watch what the file does and then destroy the whole environment, taking any damage with it. A thin provisioned volume is a storage allocation trick with no isolation properties. A pooled resource cluster is shared infrastructure, which is the opposite of the containment wanted here. Running a guest of a different family is cross-platform virtualization and says nothing about isolation.
- A technician needs to enable or disable individual startup programs and toggle which services load during a Windows boot, primarily for troubleshooting. Which built-in utility opens the System Configuration interface for these tasks?
- Msinfo32, a utility that any competent technician may launch
- Regsvr32, a utility that any attentive technician may launch
- Msconfig, a utility that any certified technician may launch
- Dxdiag, a utility that any experienced technician may launch
Correct answer: Msconfig, a utility that any certified technician may launch
The System Configuration utility is msconfig, and it is where a technician chooses a diagnostic or selective startup, disables individual services and controls the boot options while narrowing down a startup fault. Msinfo32 only displays a read-only inventory of the machine and changes nothing. Regsvr32 registers and unregisters library files. Dxdiag reports on the DirectX, display and sound stack. None of the three offers the startup and service toggles the technician needs.
- A help-desk technician wants to view Windows logs for application errors, security audits, and system events when diagnosing recurring crashes. Which Microsoft Management Console snap-in should be opened?
- Performance Monitor, a snap-in that any busy technician may open
- Registry Editor, a snap-in that any seasoned technician may open
- Device Manager, a snap-in that any competent technician may open
- Event Viewer, a snap-in that any experienced technician may open
Correct answer: Event Viewer, a snap-in that any experienced technician may open
Windows writes its application, security, setup and system logs into the Event Viewer console, so the errors, warnings and audit entries left behind by repeated crashes are read there. Performance Monitor charts live and recorded counters, which describes load rather than faults. The Registry Editor exposes configuration keys and keeps no event history. Device Manager lists hardware and driver status but does not hold the logged record of what happened at the moment of each crash.
- On a modern Linux system, a technician wants to install a new software package and automatically resolve its dependencies from the distribution's repositories on a Debian or Ubuntu-based system. Which command is appropriate?
- Apt, entered inside a simple command console
- Grep, written within a regular shell session
- Chmod, issued from any standard text display
- Ps, launched on every ordinary system screen
Correct answer: Apt, entered inside a simple command console
On Debian and Ubuntu derivatives the package manager is apt, which fetches a package from the configured repositories and pulls in whatever it depends on in the same operation. Grep searches text for a pattern and installs nothing. Chmod changes the permission bits on a file. Ps prints a snapshot of the processes currently running. None of those three reads a repository, resolves a dependency tree or writes a package onto the system.
- A technician is searching a large Linux log file for every line that contains the word 'denied' to investigate access failures. Which command is designed to filter text by matching a pattern?
- Cat, typed at any standard shell prompt
- Grep, typed at any regular shell prompt
- Pwd, typed at any familiar shell prompt
- Df, typed at any graphical shell prompt
Correct answer: Grep, typed at any regular shell prompt
Grep reads its input line by line and prints only the lines matching the pattern it was given, which is exactly how a technician pulls every entry containing a word out of a long log. Cat prints a file in full and filters nothing. Pwd reports the working directory. Df summarizes free and used space on mounted file systems. None of those three can select lines by content.
- A macOS user wants a fast way to find files, applications, and even perform calculations by typing a query that appears as a search bar at the top of the screen. Which built-in feature provides this system-wide search?
- Mission Control, part of the macOS desktop experience
- Time Machine, part of the standard macOS installation
- Spotlight, part of the included macOS system software
- Finder, part of the supplied macOS application bundle
Correct answer: Spotlight, part of the included macOS system software
The system-wide search field that drops down from the menu bar is Spotlight, which indexes files and applications and also answers definitions, conversions and arithmetic typed straight into it. Mission Control arranges open windows and spaces on screen. Time Machine runs incremental backups to an attached or networked disk. Finder browses the file system in windows rather than answering a typed query. None of the three provides that single search field.
- A technician must open a Windows tool that shows real-time CPU, memory, disk, and network usage per process, along with tabs for Startup apps, Services, and user sessions, to identify a process consuming excessive resources. Which utility provides this?
- Task Manager, a console that any experienced user may run
- Disk Management, a console that any seasoned user may run
- Device Manager, a console that any attentive user may run
- System Information, a console that any local user may run
Correct answer: Task Manager, a console that any experienced user may run
Task Manager is the tool with per-process figures for processor, memory, disk and network use, alongside tabs for startup items, services, app history and signed-in users, so a runaway process is found and ended there. Disk Management works on partitions and volumes. Device Manager lists hardware and driver status with no live measurement of consumption. System Information prints a static inventory of the machine and cannot end a process.
- A macOS user wants the system to automatically store website logins, Wi-Fi passwords, and certificates securely so they can be retrieved without retyping. Which built-in macOS feature manages these saved credentials?
- Time Machine, shipped with macOS since its earliest releases
- Keychain Access, shipped with macOS since its early releases
- Mission Control, shipped with macOS since its first releases
- Disk Utility, shipped with macOS since its original releases
Correct answer: Keychain Access, shipped with macOS since its early releases
Saved website logins, wireless network keys, certificates and other secrets are held in the keychain, which unlocks with the account and hands the credential back to Safari or an app without the user retyping it. Time Machine keeps versioned backups of files, not credentials. Mission Control arranges windows and desktops. Disk Utility partitions, erases and repairs volumes. None of the three stores a password for an application to retrieve.
- A technician needs to immediately stop a misbehaving Linux process and knows its process ID from a prior listing. Which command terminates a process by its PID?
- Ls, a short command found on any networked system
- Mv, a short command found on any available system
- Dig, a short command found on any standard system
- Kill, a short command found on any typical system
Correct answer: Kill, a short command found on any typical system
Kill sends a signal to the process whose identifier it is given, by default the request to terminate, which is how a technician stops something that has stopped responding. Ls lists the contents of a directory. Mv renames a file or moves it somewhere else. Dig queries name servers and prints the records it gets back. None of the three can signal a running process by its identifier.
- A technician is configuring inbound and outbound traffic rules on a Windows 11 workstation to block a specific application from communicating over the network. Which built-in component should be used to create these rules?
- Windows Memory Diagnostic, a component included with every regular install
- Windows Credential Manager, a component included with every retail install
- Windows Defender Firewall, a component included with every current install
- Windows Disk Management, a component included with every supported install
Correct answer: Windows Defender Firewall, a component included with every current install
The Advanced Security console of the built-in firewall is where inbound and outbound rules are written against a program, a port, a protocol or a network profile, so blocking one application's traffic is done there. The Memory Diagnostic tests the memory modules for faults. The Credential Manager stores saved logon details for sites and shares. Disk Management partitions and formats volumes. None of the three can permit or deny an application's network traffic.
- A web application accepts user input in a search box, and an attacker enters a string that manipulates the back-end database to dump customer records. Which type of attack is this?
- SQL injection, an attack covered by the certification syllabus
- Cross-site scripting, an attack included in the course outline
- Denial-of-service traffic, an attack picked out in past papers
- ARP poisoning, an attack reproduced in the training laboratory
Correct answer: SQL injection, an attack covered by the certification syllabus
Text typed into a form field that the application passes into its database query unsanitized, so the database executes it, is SQL injection, and dumping the customer table is its classic result. Cross-site scripting also injects, but the payload is script that runs in another visitor's browser rather than commands the database executes. Flooding a service with traffic denies access without reading a single record. ARP poisoning corrupts the mapping of addresses on the local segment and never touches the database.
- A technician wants only approved corporate laptops to connect to the office wireless network by allowing specific hardware addresses. Which control accomplishes this?
- Static port forwarding, a setting the careful admin may enable
- Web content inspection, a setting the prudent admin may enable
- MAC address filtering, a setting the cautious admin may enable
- Dynamic DNS updating, a setting the attentive admin may enable
Correct answer: MAC address filtering, a setting the cautious admin may enable
Allowing only listed hardware addresses onto the wireless network is MAC address filtering, which admits or refuses each device by the identifier burned into its adapter. Port forwarding sends inbound connections to a chosen internal host and decides nothing about which laptops may associate. Content inspection classifies the sites users reach, which is about destinations rather than devices. Dynamic DNS keeps a hostname pointed at a changing public address and grants no access at all.
- A remote employee needs to securely access internal company resources over the public internet as if connected to the local network. Which technology provides this encrypted connection?
- Forward proxy server, a design the attentive architect may choose
- Static address mapping, a design the careful architect may choose
- Screened subnet zoning, a design the prudent architect may choose
- Virtual private network, a design the senior architect may choose
Correct answer: Virtual private network, a design the senior architect may choose
An encrypted tunnel across the public internet that puts the remote machine logically inside the corporate network is a virtual private network, and everything it carries is protected in transit. A forward proxy relays requests on the client's behalf but builds no private path into internal systems. Address mapping rewrites addresses so private hosts can route outward. A screened subnet is a segment for publicly reachable servers, which is about placement rather than an encrypted remote connection.
- An attacker secretly intercepts and relays communication between two parties who believe they are talking directly to each other. Which attack does this describe?
- Malicious insider, a threat the knowledgeable analyst may name
- On-path interception, a threat the methodical analyst may name
- Brute-force guessing, a threat the practising analyst may name
- Credential stuffing, a threat the experienced analyst may name
Correct answer: On-path interception, a threat the methodical analyst may name
Sitting between two parties, relaying what each says to the other while both believe the line is direct, is the on-path attack once called man-in-the-middle, and it allows both eavesdropping and quiet alteration. A malicious insider abuses access already granted rather than intercepting a conversation. Brute-force guessing works through candidate passwords until one is accepted. Credential stuffing replays username and password pairs leaked elsewhere. None of those three sits in the middle of a live exchange.
- A company wants to enforce that every Windows workstation automatically locks after 10 minutes of inactivity to protect against unauthorized access. Which setting should the technician configure?
- Enabling whole disk encryption on the system volume
- Turning on fast startup inside the battery settings
- Setting an idle lock demanding the account password
- Blocking all removable storage via the group policy
Correct answer: Setting an idle lock demanding the account password
An inactivity timer that locks the session and requires the account password to resume is what stops a passer-by using a machine its owner walked away from, and it is applied centrally so every workstation behaves the same way. Full disk encryption protects the data if the drive is stolen but leaves an unlocked session wide open. Fast startup shortens boot time. Blocking removable media stops data leaving on a stick and does nothing about an unattended desktop.
- A technician must verify a user's identity before issuing a smart card by checking authentication, authorization, and accounting through a central server. Which framework describes these three functions?
- ACL, a label seen inside many vendor handbooks
- AAA, a phrase heard amongst most support teams
- DLP, a code printed within some product guides
- UTM, a name given during every training course
Correct answer: AAA, a phrase heard amongst most support teams
Authentication, authorization and accounting are the three functions bundled together as AAA, usually delivered by a central server such as RADIUS or TACACS+, which proves who the person is, decides what they may reach and records what they did. An access control list is a set of permit and deny rules on one device, not a three-part framework with a central server. Data loss prevention watches for sensitive content leaving the organization. Unified threat management bundles several defenses into one appliance.
- An attacker stands behind an employee at an ATM-style kiosk and watches them type their PIN to steal it. Which low-tech attack is this?
- Shoulder surfing, a trick the cautious attacker may try
- Dumpster diving, a trick the attentive attacker may try
- Phone pretexting, a trick the resolute attacker may try
- Voice phishing, a trick the determined attacker may try
Correct answer: Shoulder surfing, a trick the cautious attacker may try
Standing close enough to watch the digits go in is shoulder surfing: the attacker reads the credential straight off the keypad or the screen with no technology at all. Dumpster diving recovers information from what was thrown away. Pretexting invents a false story to talk information out of someone. Voice phishing uses a call that impersonates a trusted party. Only one of the four depends on watching the victim in the act.
- An organization wants software updates and security patches deployed to all workstations on a tested, regular schedule rather than letting users install them ad hoc. Which practice is this?
- Asset tagging, a practice the supporting team may adopt
- Change rollback, a practice the seasoned team may adopt
- Disk imaging, a practice the experienced team may adopt
- Patch management, a practice the trained team may adopt
Correct answer: Patch management, a practice the trained team may adopt
Testing vendor updates and then rolling them out to every machine on a published schedule, rather than leaving each user to install what they like, is patch management, and it is how known vulnerabilities get closed predictably. Asset tagging identifies equipment for inventory. Rollback returns a system to its previous state after a change goes wrong. Disk imaging captures a whole system for deployment or recovery, which delivers a build rather than a stream of updates.
- A help-desk technician must reset a forgotten password but first confirms the caller's identity by asking security questions and verifying their employee record. Which best practice does this represent?
- Recording the outstanding enquiry within the helpdesk system
- Checking the telephone number against the company repository
- Resetting the forgotten password into a generated passphrase
- Confirming the caller's identity before altering the account
Correct answer: Confirming the caller's identity before altering the account
Asking questions only the account holder should be able to answer, and matching the answers against the employee record, is identity verification, and it is the step that stops an attacker talking the help desk into handing over someone else's account. Writing the call up afterwards records what happened but proves nothing about who called. Checking which device the caller holds identifies hardware, not a person. Generating a strong replacement password is worthless if it is issued to an impostor.
- A Windows 11 user complains that File Explorer keeps freezing and the taskbar occasionally becomes unresponsive, but a full restart is impractical right now. Which Task Manager action best restores the desktop shell without rebooting?
- Restrict the busiest job and threads to one processor
- End the explorer.exe process and then launch it again
- End the search indexer service using the Task Manager
- Disable every listed startup entry for the first boot
Correct answer: End the explorer.exe process and then launch it again
The desktop, the taskbar and the file browser windows are all drawn by explorer.exe, so ending that process and starting it again from Task Manager reloads the shell and clears a hung interface without a reboot. Pinning a task to one core changes scheduling and leaves the hung shell exactly as it was. Ending the search indexer frees a little disk activity. Disabling startup entries changes what loads at the next sign-in, which does nothing for the session already running.
- A user reports that opening a single Office document is extremely slow and the application shows 'Not Responding' for long periods, yet the same files open quickly on a colleague's PC. The technician suspects the local Office installation is damaged. Which built-in action targets the application files most directly?
- Reinstall the entire Windows operating system from fresh media
- Increase the paging region to its maximum permitted allocation
- Perform an Online Repair on the malfunctioning Office software
- Turn off hardware acceleration in the display adapter settings
Correct answer: Perform an Online Repair on the malfunctioning Office software
An Online Repair re-downloads and replaces the application's own files while leaving documents and settings alone, which is exactly what a damaged local installation needs when the same files open normally elsewhere. Reinstalling the operating system rebuilds everything to fix one application. Enlarging the paging file addresses memory pressure, which is not what the symptom describes. Turning off hardware acceleration cures rendering glitches rather than missing or corrupted program files.
- After connecting to a corporate Wi-Fi network, a Windows 11 laptop shows 'No Internet, secured' and cannot browse, while other devices on the same network work. Which command sequence is the most appropriate first step to renew the network configuration?
- Ipconfig /release then ipconfig /renew, run from the shared prompt
- Defrag /o then cleanmgr /verylowdisk, run from the elevated prompt
- Diskpart select then diskpart clean, run from the protected prompt
- Shutdown /r then bootrec /rebuildbcd, run from the unlocked prompt
Correct answer: Ipconfig /release then ipconfig /renew, run from the shared prompt
Dropping the current lease and asking the server for a new one is what clears a stale or invalid address, and a client that associates but reports no internet almost always holds an address it cannot use. Defragmenting and clearing temporary files reclaims disk space and changes nothing about addressing. Selecting a disk and wiping its partition table destroys data and is not a network step at all. Rebooting and rebuilding the boot configuration repairs startup, which is not what has failed here.
- A Windows 11 computer repeatedly displays a stop error and reboots, and the technician needs to examine the crash data after the system comes back up to identify the failing component. Which approach lets the technician analyze the captured crash information?
- Run the disk cleanup wizard and delete temporary files
- Switch off fast startup within the power saver options
- Return the firmware setup back to its factory defaults
- Inspect the memory dump with a kernel debugger utility
Correct answer: Inspect the memory dump with a kernel debugger utility
During a stop error Windows writes the contents of memory, or a summary of it, to a dump file, and loading that file into a kernel debugger names the driver or module that was executing when the fault occurred. Deleting temporary files reclaims space and destroys nothing useful, but it reads no crash data. Changing the fast startup setting alters how the machine shuts down and starts. Returning firmware to its defaults changes configuration without interpreting the dump that already exists on disk.
- An iPhone user reports that the device becomes unresponsive and the screen is frozen, with no reaction to taps and the power button alone failing to wake it. Which step should the technician try first to recover the device?
- Restore this handset to factory settings with Finder
- Perform a forced restart with the documented buttons
- Remove and reseat the SIM tray before re-registering
- Recharge the equipment for one whole hour beforehand
Correct answer: Perform a forced restart with the documented buttons
A forced restart uses the button sequence the manufacturer documents and reboots a frozen device without erasing anything, which makes it the least invasive first move on a handset that will not respond. A factory restore does eventually clear a software fault but destroys the user's data, so it belongs at the end of the sequence rather than the start. Reseating the SIM affects cellular registration only. Charging helps a flat battery, but a frozen screen with power is a different fault.
- A clinic asks a technician to handle workstations that store patients' medical histories, diagnoses, and treatment records. Which category of regulated data best describes this information?
- Payment cardholder information, a category the seasoned auditor may cite
- Public marketing information, a category the meticulous auditor may cite
- Protected health information, a category the methodical auditor may cite
- Vendor licensing information, a category the persistent auditor may cite
Correct answer: Protected health information, a category the methodical auditor may cite
Medical histories, diagnoses and treatment records are health data tied to identifiable individuals, which places them in the protected health information category and under healthcare privacy law. Cardholder data covers payment card numbers and the details that travel with them, a different regime with different rules. Marketing material released to the public carries no such protection. Licensing records describe entitlements to software and are commercial documents rather than regulated personal data.
- A company installs a paid application and must comply with the agreement that limits how many devices may run the software and prohibits redistribution. Which type of software license is being used?
- Commercial purchase, a license type the attentive buyer may meet
- Open-source code, a license type the professional buyer may meet
- Public-domain release, a license type the careful buyer may meet
- Freeware download, a license type the experienced buyer may meet
Correct answer: Commercial purchase, a license type the attentive buyer may meet
Paying for software whose agreement caps the number of machines it may run on and forbids passing it along is a commercial, proprietary arrangement sold as a fixed count of seats. Open-source terms are written to permit study, modification and redistribution, which is the opposite of the restriction described. Public-domain works carry no conditions at all, so there would be nothing to comply with. Freeware costs nothing to use, and the money paid here already rules it out.
- While on a service call, a customer becomes upset and starts venting about an unrelated problem. According to professional communication best practices, what should the technician do?
- Promise the customer a reduction on the repeat call-out
- Escalate the complaint to a local manager straight away
- Record the remaining issue and raise a separate enquiry
- Listen without interrupting and then turn to the repair
Correct answer: Listen without interrupting and then turn to the repair
Professional communication asks the technician to let the customer finish, avoid arguing or judging, clarify anything unclear and then steer the conversation back to the work in hand, which keeps the visit productive without dismissing the person. Offering a discount buys goodwill the technician may not be authorized to give and still leaves the customer unheard. Escalating a matter nobody has asked to escalate removes the technician from a problem they can handle. Raising a second ticket files the complaint rather than acknowledging it.
- A server room repeatedly overheats, and equipment fails when the air becomes too dry or too humid. Which environmental control most directly addresses both excessive heat and improper moisture levels?
- Fitting extra surge suppressors and filters into cabinets
- Giving antistatic wristbands to everyone entering the lab
- Regulating the temperature and humidity with HVAC systems
- Displaying the acceptable use policy outside the entrance
Correct answer: Regulating the temperature and humidity with HVAC systems
Heating, ventilation and air conditioning equipment is what holds both the temperature and the moisture level inside their safe bands, which prevents the overheating and stops the air becoming dry enough to build static or damp enough to condense. Surge suppression protects against electrical transients arriving on the supply. Antistatic straps protect a component during handling and control nothing about the room. An acceptable use policy governs behaviour and has no effect on the physical environment.
- An IT team maintains a labeled drawing that shows how each switch, router, server, and subnet connects across the building. Which type of documentation are they keeping current?
- Safety data sheet, a document the knowledgeable team may keep
- Network topology diagram, a document the senior team may keep
- Acceptable use policy, a document the attentive team may keep
- Evidence custody form, a document the efficient team may keep
Correct answer: Network topology diagram, a document the senior team may keep
A labelled drawing showing which switches, routers, servers and subnets connect to which is the topology diagram, and keeping it current is what lets the team reason about the infrastructure when something breaks. A safety data sheet describes the hazards of a chemical. An acceptable use policy states what staff may do with company systems. An evidence custody form records who has held an item and when, which is a legal record rather than a picture of the network.
- A technician needs to compare current performance counters against a previously saved baseline on a Windows 11 workstation to spot what changed after a hardware upgrade. Which built-in console is designed to collect and log this performance data over time?
- Performance Monitor, a tool the careful engineer may start
- Storage Spaces, a tool the professional engineer may start
- System Configuration, a tool the senior engineer may start
- Optimize Drives, a tool the experienced engineer may start
Correct answer: Performance Monitor, a tool the careful engineer may start
Performance Monitor is the console that adds named counters, records them into data collector sets and replays them later, which is how a saved baseline is compared against what the machine is doing now. Storage Spaces groups physical disks into resilient pools and measures nothing. System Configuration governs boot mode and which services start. Optimize Drives reorganizes file placement on mechanical disks and trims solid-state ones, neither of which produces a comparable performance log.
- A Windows 11 user wants to recover from a problem by reverting the entire PC to an earlier point while keeping personal files but removing recently installed apps and drivers. Which Recovery option in Settings best matches this request?
- Remove the most recent preview feature update instead
- Run the automated Startup Repair using recovery media
- Reset this laptop and preserve the personal documents
- Reinstall cleanly and format the entire system volume
Correct answer: Reset this laptop and preserve the personal documents
Resetting the machine with the option that preserves personal files reinstalls Windows, keeps documents in place and strips out the applications and most drivers added since, which is exactly the outcome described. Rolling back to a previous build only undoes a feature update and leaves everything else. Startup Repair fixes what prevents the machine booting and changes no installed software. A clean reinstall that formats the drive removes the personal files the user wants to keep.
- A technician is documenting the connectors on a power supply and must identify the connector that delivers supplemental power directly to the CPU through the motherboard. Which connector is this?
- The 15-pin SATA connector, shown on the printed supply diagram
- The 8-pin EPS connector, shown on the published supply diagram
- The 6-pin PCIe connector, shown on the detailed supply diagram
- The 4-pin Molex connector, shown on the labeled supply diagram
Correct answer: The 8-pin EPS connector, shown on the published supply diagram
The EPS connector, four or eight pins depending on the board, plugs into a dedicated socket near the processor and feeds the processor's voltage regulator directly, which is the supplemental rail the question describes. The 15-pin SATA connector powers drives. The 6-pin PCIe connector feeds an expansion card such as a graphics card. The legacy 4-pin Molex connector powers older peripherals like fans and optical drives. None of those three reaches the processor.
- A user reports that double-clicks on certain file types open the wrong program after installing new software on Windows 11. Which is the most appropriate first step to restore the intended behavior?
- Repair the freshly installed program using Apps settings
- Reinstate the previous graphics driver in Device Manager
- Rebuild the desktop thumbnail cache and restart Explorer
- Reassign the default application for this file extension
Correct answer: Reassign the default application for this file extension
Newly installed software commonly registers itself as the handler for extensions it recognizes, so pointing the extension back at the intended program in the default apps settings restores the behaviour the user expects. Repairing the new application leaves its registration in place. Rolling back a display driver addresses graphics faults. Clearing the icon cache fixes wrong or blank icons while the wrong program still opens on a double-click.
- An organization wants to require additional verification only when a sign-in looks unusual, such as a login from a new location or device, rather than prompting for a second factor every time. Which security approach describes this behavior?
- Risk-based authentication, an option the senior reader may meet
- Continuous authorization, an option the prudent reader may meet
- Credential rotation, an option the professional reader may meet
- Mandatory classification, an option the careful reader may meet
Correct answer: Risk-based authentication, an option the senior reader may meet
Weighing signals such as the location, the device and the pattern of the sign-in, and demanding a second factor only when those signals look unusual, is risk-based or adaptive authentication. Continuous authorization keeps re-checking entitlements during a session, which is about what a user may reach rather than how the login was proved. Rotating credentials on a schedule changes the secret for everyone alike, whatever the circumstances of the attempt. Mandatory classification decides access from labels on data and subjects and never adapts the challenge to context.
- A technician must explain why a smartphone screen rotates the displayed image but the photos themselves are stabilized while recording video. Which mobile feature provides the stabilization for video capture?
- Near-field communication, a feature the slim handset may offer
- Optical stabilization, a feature the premium handset may offer
- Proximity sensing, a feature the inexpensive handset may offer
- Fingerprint reading, a feature the customary handset may offer
Correct answer: Optical stabilization, a feature the premium handset may offer
Stabilization, whether the lens is moved optically or the frame is corrected electronically, cancels the small movements of the hand so recorded footage looks steady. Near-field communication is a short-range radio link used for payments and pairing. The proximity sensor blanks the screen when the phone is held to the face on a call. The fingerprint reader authenticates the owner. None of those three has any effect on what the camera records.
- A company wants its cloud workloads to keep running by automatically shifting to resources in another region if the primary region goes offline. Which cloud characteristic best describes designing for this continued operation despite a failure?
- High availability, a property the attentive designer may seek
- Metered utilization, a property the careful designer may seek
- Rapid elasticity, a property the methodical designer may seek
- Resource pooling, a property the thoughtful designer may seek
Correct answer: High availability, a property the attentive designer may seek
Designing so that work continues when a component, a zone or a whole region fails, by holding redundant capacity and switching to it automatically, is high availability. Metered utilization is about counting consumption so it can be billed. Rapid elasticity is about adding and shedding capacity quickly as demand moves. Resource pooling is about many tenants drawing on shared hardware. None of those three describes surviving the loss of the primary site.
