Operational Procedures practice questions

A technician is called to a warehouse office where a desktop PC will not power on. The user reports that a portable space heater was recently plugged into the same wall outlet as the PC. The technician notices the outlet is not protected by a surge suppressor, and the building is old with ungrounded wiring. Which of the following is the MOST appropriate first action to ensure personal safety?

Trap 1: Ask the user to unplug the space heater and then proceed to…

Unplugging the heater reduces load but does not remove the shock hazard from the ungrounded outlet or the possibility of a shorted PC power supply. The technician could still be shocked when touching the PC. De-energizing the circuit is the only way to ensure safety before physical contact.

Trap 2: Put on an antistatic wrist strap and open the case to check the…

An antistatic wrist strap protects components from electrostatic discharge, not the technician from electrical shock. Opening the case while the PC is plugged into an ungrounded outlet and possibly still energized is dangerous. The strap may even provide a false sense of security. The outlet must be de-energized first.

Trap 3: Unplug the PC and test the outlet with a multimeter before touching…

While testing the outlet is prudent, unplugging the PC and using a multimeter does not address the immediate risk of shock from the ungrounded outlet or the heater. The technician should first de-energize the circuit at the breaker to eliminate the hazard. A multimeter reading alone does not guarantee safety, especially with ungrounded wiring.

A
Ask the user to unplug the space heater and then proceed to diagnose the PC.
Why it fails: Unplugging the heater reduces load but does not remove the shock hazard from the ungrounded outlet or the possibility of a shorted PC power supply. The technician could still be shocked when touching the PC. De-energizing the circuit is the only way to ensure safety before physical contact.
B
Locate the circuit breaker panel and turn off the breaker supplying the outlet.
The safest first step is to remove power at the source. With ungrounded wiring and a high-draw heater on the same circuit, the risk of shock or fire is significant. Turning off the breaker eliminates the electrical hazard before any further inspection or testing. This aligns with standard electrical safety procedures for IT technicians.
C
Put on an antistatic wrist strap and open the case to check the power supply.
Why it fails: An antistatic wrist strap protects components from electrostatic discharge, not the technician from electrical shock. Opening the case while the PC is plugged into an ungrounded outlet and possibly still energized is dangerous. The strap may even provide a false sense of security. The outlet must be de-energized first.
D
Unplug the PC and test the outlet with a multimeter before touching any internal components.
Why it fails: While testing the outlet is prudent, unplugging the PC and using a multimeter does not address the immediate risk of shock from the ungrounded outlet or the heater. The technician should first de-energize the circuit at the breaker to eliminate the hazard. A multimeter reading alone does not guarantee safety, especially with ungrounded wiring.

Question 2easymultiple choice

A small medical office asks you to dispose of several old hard drives that previously stored patient billing records. The drives are still functional and contain sensitive data. Which of the following is the BEST method to ensure the data cannot be recovered before the drives leave the premises?

Trap 1: Run a standard format on each drive and then donate them to a local…

A standard format only removes file system pointers; the underlying data remains and can be recovered with forensic tools. Donating the drives also transfers them outside the organization's control, increasing the risk of a data breach. This approach does not meet the requirement to make the data unrecoverable before the drives leave the premises.

Trap 2: Delete all partitions and overwrite the drives with a single pass…

A single overwrite pass is generally effective for magnetic drives but may leave recoverable data in remapped sectors or on SSDs due to wear leveling. The scenario involves hard drives, but a single pass is not as definitive as physical destruction. Since the drives are leaving the premises, physical destruction provides the highest assurance.

Trap 3: Degauss the drives with a strong magnetic field and then reuse them…

Degaussing can destroy the servo tracks on modern hard drives, making them unusable, but it may not fully erase data on all media types, especially SSDs. Reusing degaussed drives in workstations is unreliable and could expose residual data. The scenario calls for disposal, not reuse, and degaussing alone may not guarantee unrecoverability.

A
Run a standard format on each drive and then donate them to a local school.
Why it fails: A standard format only removes file system pointers; the underlying data remains and can be recovered with forensic tools. Donating the drives also transfers them outside the organization's control, increasing the risk of a data breach. This approach does not meet the requirement to make the data unrecoverable before the drives leave the premises.
B
Delete all partitions and overwrite the drives with a single pass of random data.
Why it fails: A single overwrite pass is generally effective for magnetic drives but may leave recoverable data in remapped sectors or on SSDs due to wear leveling. The scenario involves hard drives, but a single pass is not as definitive as physical destruction. Since the drives are leaving the premises, physical destruction provides the highest assurance.
C
Degauss the drives with a strong magnetic field and then reuse them in workstations.
Why it fails: Degaussing can destroy the servo tracks on modern hard drives, making them unusable, but it may not fully erase data on all media types, especially SSDs. Reusing degaussed drives in workstations is unreliable and could expose residual data. The scenario calls for disposal, not reuse, and degaussing alone may not guarantee unrecoverability.
D
Physically shred the drives using a cross-cut shredder rated for magnetic media.
Physical destruction renders the platters unreadable and is the most reliable way to guarantee data cannot be recovered. A cross-cut shredder rated for magnetic media reduces the drive to small particles, satisfying secure disposal requirements for sensitive data. This method is appropriate when the drives will leave the controlled environment and no reuse is planned.

Question 3mediummultiple choice

A technician is configuring a new Windows 11 workstation for a user who needs to run a legacy line-of-business application that requires administrative privileges. The company policy states that users should operate with standard user accounts whenever possible. Which of the following is the BEST way to meet both the application requirement and the security policy?

Trap 1: Add the user's domain account to the local Administrators group on…

Adding the user to the local Administrators group grants full administrative rights for all actions, violating the principle of least privilege. The user could inadvertently or maliciously make system-wide changes. This approach does not meet the security policy requirement to operate with standard user accounts whenever possible.

Trap 2: Disable User Account Control (UAC) for the user's account through…

Disabling UAC removes a critical security layer and allows applications to elevate silently, which can lead to malware infections and unauthorized changes. It does not align with the security policy and weakens the overall security posture. This approach is not recommended for meeting the application requirement.

Trap 3: Configure the application to run as a scheduled task with highest…

Running the application as a scheduled task with highest privileges may work but is not user-friendly and can introduce security risks if the service account is compromised. It also does not allow the user to interact with the application normally. This method is overly complex and not the best fit for a line-of-business application that the user needs to run interactively.

A
Add the user's domain account to the local Administrators group on the workstation.
Why it fails: Adding the user to the local Administrators group grants full administrative rights for all actions, violating the principle of least privilege. The user could inadvertently or maliciously make system-wide changes. This approach does not meet the security policy requirement to operate with standard user accounts whenever possible.
B
Disable User Account Control (UAC) for the user's account through Group Policy.
Why it fails: Disabling UAC removes a critical security layer and allows applications to elevate silently, which can lead to malware infections and unauthorized changes. It does not align with the security policy and weakens the overall security posture. This approach is not recommended for meeting the application requirement.
C
Configure the application to run as a scheduled task with highest privileges using a dedicated service account.
Why it fails: Running the application as a scheduled task with highest privileges may work but is not user-friendly and can introduce security risks if the service account is compromised. It also does not allow the user to interact with the application normally. This method is overly complex and not the best fit for a line-of-business application that the user needs to run interactively.
D
Use the Application Compatibility Toolkit to set the RunAsAdmin flag for the application executable.
The RunAsAdmin compatibility flag prompts for elevation only when the specific application launches, allowing the user to remain a standard user for all other tasks. This satisfies the application's need for administrative privileges while adhering to the security policy. It is a targeted solution that does not grant blanket administrative rights.

Question 4mediummultiple choice

A technician is troubleshooting a user's workstation that randomly reboots. The technician suspects a hardware issue. Which of the following should the technician do FIRST to gather information about the problem?

Trap 1: Ask the user to describe exactly what they were doing when the…

User input is valuable, but the question asks for the FIRST action to gather information about the problem. The technician can ask the user while also checking logs, but the most objective and immediate data source is Event Viewer. User descriptions may be vague or inaccurate. Technical logs provide concrete evidence.

Trap 2: Run a full malware scan on the system.

Malware can cause reboots, but it is less likely than hardware issues given the random nature. Running a full scan is time-consuming and may not address the root cause. The technician should first check system logs for hardware-related errors. Malware scan can be performed later if logs suggest it.

Trap 3: Replace the power supply unit with a known good one.

Replacing the power supply is a valid troubleshooting step, but it should not be the first action. Without evidence pointing to the PSU, this could waste time and parts. The technician should first gather data from logs or diagnostics to narrow down the cause. Event Viewer is a more efficient first step.

A
Ask the user to describe exactly what they were doing when the reboots occur.
Why it fails: User input is valuable, but the question asks for the FIRST action to gather information about the problem. The technician can ask the user while also checking logs, but the most objective and immediate data source is Event Viewer. User descriptions may be vague or inaccurate. Technical logs provide concrete evidence.
B
Run a full malware scan on the system.
Why it fails: Malware can cause reboots, but it is less likely than hardware issues given the random nature. Running a full scan is time-consuming and may not address the root cause. The technician should first check system logs for hardware-related errors. Malware scan can be performed later if logs suggest it.
C
Replace the power supply unit with a known good one.
Why it fails: Replacing the power supply is a valid troubleshooting step, but it should not be the first action. Without evidence pointing to the PSU, this could waste time and parts. The technician should first gather data from logs or diagnostics to narrow down the cause. Event Viewer is a more efficient first step.
D
Check the Event Viewer for critical errors and warnings.
Event Viewer logs system and application events, including critical errors like unexpected shutdowns or hardware faults. Checking it first provides valuable clues about the cause of random reboots, such as power supply issues or overheating. This is a non-invasive step that can guide further troubleshooting. It aligns with standard diagnostic procedures.

Question 5hardmultiple choice

A technician is creating a new local user account on a Windows 11 Pro computer for a temporary employee. The company policy requires that the account be disabled after 30 days. Which of the following should the technician use to enforce this requirement with the least administrative effort?

Trap 1: Local Group Policy Editor to set an account expiration date

Local Group Policy Editor does not have a setting to automatically disable a local user account after a specific number of days. Account expiration can be set via command line, but Group Policy is more for password policies and other restrictions. This method does not directly enforce disabling after 30 days, so it is not the correct tool.

Trap 2: Local Users and Groups snap-in

The Local Users and Groups snap-in allows you to create and manage local accounts, but it does not provide a built-in way to automatically disable an account after a set period. You could manually disable the account after 30 days, but that requires administrative effort and is prone to being forgotten. It does not meet the requirement for least effort.

Trap 3: Command Prompt with net user command

The net user command can create accounts and set expiration dates using the /expires option. However, this sets the account to expire, not disable. An expired account cannot be used, but it is not the same as disabled. The policy specifically requires disabling, so this does not meet the requirement. Additionally, using command-line tools may be less intuitive for some technicians.

A
Local Group Policy Editor to set an account expiration date
Why it fails: Local Group Policy Editor does not have a setting to automatically disable a local user account after a specific number of days. Account expiration can be set via command line, but Group Policy is more for password policies and other restrictions. This method does not directly enforce disabling after 30 days, so it is not the correct tool.
B
Local Users and Groups snap-in
Why it fails: The Local Users and Groups snap-in allows you to create and manage local accounts, but it does not provide a built-in way to automatically disable an account after a set period. You could manually disable the account after 30 days, but that requires administrative effort and is prone to being forgotten. It does not meet the requirement for least effort.
C
Schedule a task in Task Scheduler to disable the account after 30 days
Task Scheduler can run a script or command at a specified time to disable the account. You can create a task that triggers 30 days from creation and runs the 'net user <username> /active:no' command. This automates the process with minimal administrative effort and ensures the account is disabled as required. It is the most reliable method to meet the policy.
D
Command Prompt with net user command
Why it fails: The net user command can create accounts and set expiration dates using the /expires option. However, this sets the account to expire, not disable. An expired account cannot be used, but it is not the same as disabled. The policy specifically requires disabling, so this does not meet the requirement. Additionally, using command-line tools may be less intuitive for some technicians.

Question 6hardmultiple choice

A company is implementing a backup strategy for a critical file server. The backup window is limited to 2 hours each night, and the total data set is 1.5 TB. The company requires that backups complete within the window and that restores can be performed quickly. Which of the following backup types should the technician use to meet these requirements?

Trap 1: Incremental backup every night

Incremental backups only capture changes since the last backup, so they are fast and fit the window. However, restoring requires the last full backup plus every incremental since, which can be time-consuming and complex. The requirement for quick restores makes this less ideal.

Trap 2: Full backup every night

A full backup every night would likely exceed the 2-hour window because it backs up all 1.5 TB each time. While restores are fast, the backup duration is too long. This does not meet the requirement to complete within the limited window.

Trap 3: Synthetic full backup every night

Synthetic full backups create a full backup by combining the previous full with subsequent incrementals, often on the backup server. This can reduce network load but may still require significant processing time and is not necessary for a single file server with a 2-hour window. It adds complexity without clear benefit here.

A
Differential backup every night
Differential backups capture all changes since the last full backup, so each night's backup grows but typically remains within the window for a 1.5 TB data set with moderate daily changes. Restores require only the last full backup and the latest differential, which is faster and simpler than incremental. This balances backup window and restore speed.
B
Incremental backup every night
Why it fails: Incremental backups only capture changes since the last backup, so they are fast and fit the window. However, restoring requires the last full backup plus every incremental since, which can be time-consuming and complex. The requirement for quick restores makes this less ideal.
C
Full backup every night
Why it fails: A full backup every night would likely exceed the 2-hour window because it backs up all 1.5 TB each time. While restores are fast, the backup duration is too long. This does not meet the requirement to complete within the limited window.
D
Synthetic full backup every night
Why it fails: Synthetic full backups create a full backup by combining the previous full with subsequent incrementals, often on the backup server. This can reduce network load but may still require significant processing time and is not necessary for a single file server with a 2-hour window. It adds complexity without clear benefit here.

Question 7easymultiple choice

A technician is called to a user's desk where the user has left a sticky note with their password taped to the monitor. The technician needs to document this in the ticket. Which of the following should the technician do FIRST?

Trap 1: Ignore it because it is the user's personal workspace and not the…

Ignoring a visible password violates the technician's duty to protect organizational assets. Security is everyone's responsibility, and operational procedures require reporting such incidents. The technician's scope of support includes maintaining a secure environment, so this is definitely a concern.

Trap 2: Remove the sticky note and discard it, then close the ticket as…

Removing the note destroys evidence of a policy violation and does not address the underlying security risk. Closing the ticket as resolved without educating the user or reporting the incident fails to meet operational procedures for handling sensitive information. The technician should not alter the scene before documenting and reporting.

Trap 3: Take a photo of the sticky note and post it in the team chat as a…

Sharing a photo of a password, even as a joke, further exposes credentials and violates the user's privacy and the organization's security policies. This action could lead to disciplinary action against the technician and does not follow proper incident handling. It also fails to address the security risk appropriately.

A
Report the security violation according to the organization's incident response policy.
Leaving a password visible is a security violation that must be reported through the proper incident response channel. This ensures the organization can investigate, educate the user, and enforce policies. Documenting and reporting is the first step before taking any corrective action that might destroy evidence or overstep the technician's authority.
B
Ignore it because it is the user's personal workspace and not the technician's concern.
Why it fails: Ignoring a visible password violates the technician's duty to protect organizational assets. Security is everyone's responsibility, and operational procedures require reporting such incidents. The technician's scope of support includes maintaining a secure environment, so this is definitely a concern.
C
Remove the sticky note and discard it, then close the ticket as resolved.
Why it fails: Removing the note destroys evidence of a policy violation and does not address the underlying security risk. Closing the ticket as resolved without educating the user or reporting the incident fails to meet operational procedures for handling sensitive information. The technician should not alter the scene before documenting and reporting.
D
Take a photo of the sticky note and post it in the team chat as a joke.
Why it fails: Sharing a photo of a password, even as a joke, further exposes credentials and violates the user's privacy and the organization's security policies. This action could lead to disciplinary action against the technician and does not follow proper incident handling. It also fails to address the security risk appropriately.

Question 8mediummultiple choice

A company is implementing a new policy that requires all employee laptops to have full-disk encryption enabled. A technician is asked to verify compliance on a Windows 11 Pro laptop. Which of the following tools should the technician use to check the encryption status?

Trap 1: Device Manager

Device Manager is used to manage hardware devices and drivers, not to check disk encryption status. It does not display BitLocker information. While it can show storage controllers, it does not indicate whether encryption is enabled. Therefore, it is not the appropriate tool for verifying full-disk encryption compliance.

Trap 2: Disk Management console

Disk Management allows you to view and manage disk partitions and volumes, but it does not show BitLocker encryption status. It might display volumes as encrypted if BitLocker is on, but it does not provide detailed encryption information or compliance status. It is not the correct tool for this purpose.

Trap 3: Task Manager

Task Manager provides information about running processes, performance, and startup apps. It does not display disk encryption status. While it can show disk usage, it cannot verify BitLocker compliance. Thus, it is not suitable for checking full-disk encryption.

A
Device Manager
Why it fails: Device Manager is used to manage hardware devices and drivers, not to check disk encryption status. It does not display BitLocker information. While it can show storage controllers, it does not indicate whether encryption is enabled. Therefore, it is not the appropriate tool for verifying full-disk encryption compliance.
B
Disk Management console
Why it fails: Disk Management allows you to view and manage disk partitions and volumes, but it does not show BitLocker encryption status. It might display volumes as encrypted if BitLocker is on, but it does not provide detailed encryption information or compliance status. It is not the correct tool for this purpose.
C
Task Manager
Why it fails: Task Manager provides information about running processes, performance, and startup apps. It does not display disk encryption status. While it can show disk usage, it cannot verify BitLocker compliance. Thus, it is not suitable for checking full-disk encryption.
D
BitLocker Drive Encryption Control Panel applet
The BitLocker Drive Encryption Control Panel applet provides a straightforward interface to view the encryption status of each drive. It shows whether BitLocker is on or off, and the encryption method used. This is the correct tool for quickly verifying compliance with the full-disk encryption policy on a Windows 11 Pro system.

Question 9easymultiple choice

A user calls the help desk stating that their laptop screen is cracked and they need it replaced. The company policy requires that all hardware repairs be performed by the IT department. The user is remote and cannot come to the office. Which of the following should the technician do FIRST?

Trap 1: Instruct the user to purchase a replacement screen online and…

This violates company policy that IT must perform all hardware repairs. It also risks further damage and voids warranties. The technician should not delegate authorized repairs to the user. The correct first step is to follow internal procedures for repair, not to have the user self-repair.

Trap 2: Remote into the laptop and run diagnostics to confirm the screen is…

Remote diagnostics cannot physically confirm a cracked screen; the user already reported visible damage. Remote tools may not even be accessible if the screen is unusable. The priority is to initiate the repair process, not to run unnecessary diagnostics. Documenting the issue and arranging service is the correct first action.

Trap 3: Ship the user a replacement laptop and have them return the damaged…

Shipping a replacement laptop may be part of the solution, but it is not the first step. The technician must first follow the proper incident management process, which includes documenting the issue and obtaining authorization. Skipping this step could lead to inventory discrepancies and policy violations. The first action should be to log the ticket and initiate the repair workflow.

A
Instruct the user to purchase a replacement screen online and install it themselves.
Why it fails: This violates company policy that IT must perform all hardware repairs. It also risks further damage and voids warranties. The technician should not delegate authorized repairs to the user. The correct first step is to follow internal procedures for repair, not to have the user self-repair.
B
Remote into the laptop and run diagnostics to confirm the screen is cracked.
Why it fails: Remote diagnostics cannot physically confirm a cracked screen; the user already reported visible damage. Remote tools may not even be accessible if the screen is unusable. The priority is to initiate the repair process, not to run unnecessary diagnostics. Documenting the issue and arranging service is the correct first action.
C
Create a ticket, document the damage, and arrange for a depot repair or onsite service.
Following standard operating procedures, the technician should first create a ticket to document the issue, then arrange for repair according to company policy. Since the user is remote, a depot repair or authorized onsite service is appropriate. This ensures accountability and proper asset tracking. It also aligns with the requirement that IT performs all hardware repairs.
D
Ship the user a replacement laptop and have them return the damaged one.
Why it fails: Shipping a replacement laptop may be part of the solution, but it is not the first step. The technician must first follow the proper incident management process, which includes documenting the issue and obtaining authorization. Skipping this step could lead to inventory discrepancies and policy violations. The first action should be to log the ticket and initiate the repair workflow.

Question 10hardmulti select

A technician is preparing to dispose of several old hard drives that contain sensitive company data. The organization's data destruction policy requires physical destruction. Which of the following methods are appropriate for physically destroying the drives? (Choose two.)

Trap 1: Low-level formatting

Low-level formatting is a factory process that sets up the drive's sectors. It does not securely erase data and is not a physical destruction method. In fact, it may leave data remnants. Since the policy requires physical destruction, this method is inappropriate and does not meet the security requirement.

Trap 2: Overwriting

Overwriting writes new data over the old data, effectively erasing it. However, it is a logical destruction method, not physical. The policy explicitly requires physical destruction, so overwriting does not comply. Additionally, overwriting may not be reliable on all drive types, such as SSDs with wear leveling, making it less secure than physical destruction.

Trap 3: Degaussing

Degaussing uses a strong magnetic field to erase data on magnetic media. However, it does not physically destroy the drive, and it is ineffective on solid-state drives (SSDs). Since the policy requires physical destruction, degaussing alone may not meet the requirement, especially if SSDs are present. It also leaves the drive intact, so it is not a physical destruction method.

A
Incineration
Incineration burns the drive at high temperatures, completely destroying the media and any data. This is a form of physical destruction that ensures no recoverable data remains. It must be performed in a controlled environment that meets environmental regulations. For organizations with strict data destruction policies, incineration is an appropriate method.
B
Shredding
Shredding physically breaks the drive into small pieces, making data recovery virtually impossible. This meets the requirement for physical destruction. Industrial shredders are designed for this purpose and can handle both HDDs and SSDs. It is a widely accepted method for secure data destruction when the media will not be reused.
C
Low-level formatting
Why it fails: Low-level formatting is a factory process that sets up the drive's sectors. It does not securely erase data and is not a physical destruction method. In fact, it may leave data remnants. Since the policy requires physical destruction, this method is inappropriate and does not meet the security requirement.
D
Overwriting
Why it fails: Overwriting writes new data over the old data, effectively erasing it. However, it is a logical destruction method, not physical. The policy explicitly requires physical destruction, so overwriting does not comply. Additionally, overwriting may not be reliable on all drive types, such as SSDs with wear leveling, making it less secure than physical destruction.
E
Degaussing
Why it fails: Degaussing uses a strong magnetic field to erase data on magnetic media. However, it does not physically destroy the drive, and it is ineffective on solid-state drives (SSDs). Since the policy requires physical destruction, degaussing alone may not meet the requirement, especially if SSDs are present. It also leaves the drive intact, so it is not a physical destruction method.

Question 11hardmulti select

A technician is preparing to replace a failed hard drive in a user's desktop PC. The drive contains sensitive company data. The technician wants to ensure proper disposal of the old drive and maintain data security. Which of the following TWO actions should the technician take? (Choose two.)

Trap 1: Run a standard format on the drive before disposal.

A standard format does not securely erase data; it only removes file system pointers. Data can still be recovered with forensic tools. For sensitive company data, a more robust method like physical destruction or secure wipe is required. Standard format is insufficient for data security and does not meet disposal policies.

Trap 2: Delete all partitions and recreate a single empty partition.

Deleting partitions and recreating one does not erase the data; it merely alters the partition table. The underlying data remains on the disk and can be recovered. This method is inadequate for protecting sensitive information and does not meet secure disposal requirements. It should not be used for drives containing confidential data.

Trap 3: Store the drive in a secure cabinet until it can be reused.

Storing the drive does not address data security if the drive is eventually disposed of or stolen. The question asks about disposal and maintaining data security. Simply storing it delays the problem and does not sanitize the data. The technician must either destroy or securely wipe the drive before disposal or reuse.

A
Use a software tool to perform a secure erase or wipe.
A secure erase or wipe overwrites the entire drive with random data, making recovery extremely difficult. This is a valid method for sanitizing storage media before disposal or reuse. It complies with data security policies and is appropriate when physical destruction is not feasible. The technician should verify the wipe completed successfully.
B
Run a standard format on the drive before disposal.
Why it fails: A standard format does not securely erase data; it only removes file system pointers. Data can still be recovered with forensic tools. For sensitive company data, a more robust method like physical destruction or secure wipe is required. Standard format is insufficient for data security and does not meet disposal policies.
C
Delete all partitions and recreate a single empty partition.
Why it fails: Deleting partitions and recreating one does not erase the data; it merely alters the partition table. The underlying data remains on the disk and can be recovered. This method is inadequate for protecting sensitive information and does not meet secure disposal requirements. It should not be used for drives containing confidential data.
D
Physically destroy the drive by shredding or degaussing.
Physical destruction ensures that data cannot be recovered, which is critical for sensitive company data. Shredding or degaussing renders the drive unusable and is a recommended method for end-of-life storage media. This action aligns with data security policies and prevents data remanence. It is especially important if the drive is not being reused or if encryption was not employed.
E
Store the drive in a secure cabinet until it can be reused.
Why it fails: Storing the drive does not address data security if the drive is eventually disposed of or stolen. The question asks about disposal and maintaining data security. Simply storing it delays the problem and does not sanitize the data. The technician must either destroy or securely wipe the drive before disposal or reuse.

Question 12mediummultiple choice

A technician is troubleshooting a Windows 10 workstation that is running very slowly. The technician suspects a malware infection. Which of the following should the technician do FIRST according to best practices for malware removal?

Trap 1: Restore the system from a known good backup.

Restoring from backup might be necessary if the malware cannot be removed, but it is not the first step. You should first attempt to quarantine and remove the malware. Restoring prematurely could reintroduce the malware if the backup is also infected or if the root cause is not addressed. Backup restoration is typically a later step in the remediation process.

Trap 2: Educate the end user about safe browsing habits.

User education is valuable for prevention, but it is not the first step during an active infection. The priority is to contain and remove the malware. Educating the user can happen later as part of post-incident follow-up. Focusing on education first leaves the system vulnerable and the malware active.

Trap 3: Run a full antivirus scan immediately.

Running a full scan is important, but it should be done after quarantining the system. If the system remains connected, the malware could spread or the scan might be ineffective if the malware disables the antivirus. The first step is to isolate the system to prevent propagation, then proceed with scanning and removal.

A
Quarantine the system by disconnecting it from the network.
Disconnecting the system from the network prevents the malware from spreading or communicating with command-and-control servers. This is the first step in the malware removal process to contain the infection. It also preserves evidence and prevents further damage while the technician investigates. Quarantining is a critical initial action before attempting removal.
B
Restore the system from a known good backup.
Why it fails: Restoring from backup might be necessary if the malware cannot be removed, but it is not the first step. You should first attempt to quarantine and remove the malware. Restoring prematurely could reintroduce the malware if the backup is also infected or if the root cause is not addressed. Backup restoration is typically a later step in the remediation process.
C
Educate the end user about safe browsing habits.
Why it fails: User education is valuable for prevention, but it is not the first step during an active infection. The priority is to contain and remove the malware. Educating the user can happen later as part of post-incident follow-up. Focusing on education first leaves the system vulnerable and the malware active.
D
Run a full antivirus scan immediately.
Why it fails: Running a full scan is important, but it should be done after quarantining the system. If the system remains connected, the malware could spread or the scan might be ineffective if the malware disables the antivirus. The first step is to isolate the system to prevent propagation, then proceed with scanning and removal.

Question 13mediummulti select

A technician is preparing to replace a faulty power supply in a desktop computer. Which of the following safety precautions should the technician take? (Choose two.)

Trap 1: Leave the power cord connected but turn off the power supply switch.

Leaving the power cord connected, even with the switch off, still provides a path for electrical current and keeps the system grounded. This can be dangerous if the switch fails or if there is a short. The power cord should be completely disconnected before opening the case.

Trap 2: Use a magnetic screwdriver to retrieve screws from inside the power…

A magnetic screwdriver can damage sensitive components or interfere with the power supply's operation. It may also attract metal debris that could cause short circuits. Using a magnetic tool inside a power supply is unsafe and not recommended.

Trap 3: Work on a carpeted floor to cushion the components.

Carpet generates static electricity, increasing the risk of ESD damage to components. Working on a carpeted floor is strongly discouraged unless antistatic measures are in place. A hard, non-conductive surface is preferred to minimize static buildup.

A
Disconnect the power cord from the wall outlet before opening the case.
Disconnecting the power cord removes the risk of electric shock and prevents the system from powering on accidentally. It is a fundamental safety step before working inside any computer. This precaution also allows the power supply to discharge residual power, reducing the chance of damage to components.
B
Leave the power cord connected but turn off the power supply switch.
Why it fails: Leaving the power cord connected, even with the switch off, still provides a path for electrical current and keeps the system grounded. This can be dangerous if the switch fails or if there is a short. The power cord should be completely disconnected before opening the case.
C
Wear an antistatic wrist strap connected to a grounded surface.
An antistatic wrist strap prevents electrostatic discharge (ESD) from damaging sensitive electronic components. Connecting it to a grounded surface equalizes the technician's potential with the equipment. This is essential when handling internal components like the power supply and motherboard.
D
Use a magnetic screwdriver to retrieve screws from inside the power supply.
Why it fails: A magnetic screwdriver can damage sensitive components or interfere with the power supply's operation. It may also attract metal debris that could cause short circuits. Using a magnetic tool inside a power supply is unsafe and not recommended.
E
Work on a carpeted floor to cushion the components.
Why it fails: Carpet generates static electricity, increasing the risk of ESD damage to components. Working on a carpeted floor is strongly discouraged unless antistatic measures are in place. A hard, non-conductive surface is preferred to minimize static buildup.

Question 14easymultiple choice

A user reports that their Windows 10 laptop is running very slowly and the hard drive light is constantly active. The technician suspects a malware infection. Which of the following should the technician perform FIRST according to best practices?

Trap 1: Restart the laptop in Safe Mode with Networking.

Restarting in Safe Mode with Networking may help troubleshoot, but it keeps the system connected to the network, potentially allowing malware to spread. It also does not address containment as the first priority. The initial step should be to isolate the system from the network.

Trap 2: Run a full antivirus scan on the laptop.

Running a full antivirus scan is a good step, but it should not be the first action. Malware can interfere with the scan or hide from it. The first step is to isolate the system to prevent further spread or damage, then proceed with remediation.

Trap 3: Use System Restore to revert to a previous restore point.

System Restore can revert system files and settings but does not remove malware from user data or other partitions. It may also remove legitimate changes. It is not the first step and could destroy evidence. Containment should precede any remediation attempts.

A
Restart the laptop in Safe Mode with Networking.
Why it fails: Restarting in Safe Mode with Networking may help troubleshoot, but it keeps the system connected to the network, potentially allowing malware to spread. It also does not address containment as the first priority. The initial step should be to isolate the system from the network.
B
Disconnect the laptop from the network.
Disconnecting from the network immediately contains the potential infection, preventing malware from spreading to other systems or communicating with command-and-control servers. This is the first step in the incident response process for a suspected malware infection. It also preserves evidence for later analysis.
C
Run a full antivirus scan on the laptop.
Why it fails: Running a full antivirus scan is a good step, but it should not be the first action. Malware can interfere with the scan or hide from it. The first step is to isolate the system to prevent further spread or damage, then proceed with remediation.
D
Use System Restore to revert to a previous restore point.
Why it fails: System Restore can revert system files and settings but does not remove malware from user data or other partitions. It may also remove legitimate changes. It is not the first step and could destroy evidence. Containment should precede any remediation attempts.